> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spurtcommerce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment setup

The repository's `.env.example` is the primary configuration reference. Create a private `.env` at the application root and supply values appropriate to the deployment.

## Configuration groups

| Group | Variables shown in repository template | Purpose |
| - | - | - |
| Application | `APP_NAME`, `APP_SCHEMA`, `APP_HOST`, `APP_PORT`, `APP_ROUTE_PREFIX`, `APP_BANNER` | Application identity and listener/routing |
| Tenant/application | `TENANT_ID`, `APP_ID` | Tenant/application resolution |
| Logging | `LOG_LEVEL`, `LOG_OUTPUT` | Runtime logging |
| Database | `TYPEORM_CONNECTION`, `TYPEORM_HOST`, `TYPEORM_PORT`, `TYPEORM_USERNAME`, `TYPEORM_PASSWORD`, `TYPEORM_DATABASE` | MySQL connection |
| ORM behavior | `TYPEORM_SYNCHRONIZE`, `TYPEORM_LOGGING`, `TYPEORM_LOGGER` | TypeORM schema/logging configuration |
| Discovery paths | `TYPEORM_MIGRATIONS`, `TYPEORM_ENTITIES`, `CONTROLLERS`, `MIDDLEWARES`, `SUBSCRIBERS` and related `*_DIR` values | Code discovery |
| API docs/monitor | `APIDOC_*`, `MONITOR_*`, `SWAGGER_*` | API documentation and operational endpoints |
| Mail | `MAIL_*`, optional `SES_*` | SMTP or SES delivery |
| Storage | `IMAGE_SERVER`, `AWS_*`, optional GCP values | File/media storage |
| URLs | `STORE_URL`, `BASE_URL`, redirect and image URL variables | Frontend and callback URLs |
| Security | `JWT_SECRET`, `JWT_EXPIRY_TIME`, `CRYPTO_SECRET`, login-attempt settings | Token and security behavior |

## Example workflow

```bash theme={null}
cp .env.example .env
chmod 600 .env
```

Edit values using a secure editor or deployment secret manager. Do not paste real `.env` contents into tickets or documentation.

## Production checklist

* Generate unique, high-entropy secrets per environment.
* Use a restricted database account and encrypted database connections where supported.
* Set production logging to an appropriate level; avoid verbose SQL logging containing personal data.
* Disable public debug/monitor endpoints or protect them with strong access controls.
* Restrict CORS, trusted origins, and redirect URLs.
* Verify that file storage and mail credentials have least privilege.
* Confirm that `TYPEORM_SYNCHRONIZE` is disabled for production schema management unless release guidance explicitly says otherwise.
* Validate required variables at startup and fail safely when critical configuration is missing.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.