Configuration#
This page lists every environment variable a WELD app reads, its default from .env.example, and what the sources say about it.
Environment variables#
| Name | Default | Notes |
|---|---|---|
APP_NAME |
WELD |
Renamed when you clone and rename; VITE_APP_NAME follows it through ${APP_NAME}. |
APP_ENV |
local |
|
APP_KEY |
(empty) |
Generate it with php artisan key:generate; weld:doctor checks the app key. |
APP_DEBUG |
true |
The local default; keep APP_DEBUG=false in production (W26). |
APP_URL |
http://localhost |
Set it to the real host (W17); Laravel trusts subdomains of APP_URL unless subdomains: false. |
APP_LOCALE |
en |
|
APP_FALLBACK_LOCALE |
en |
|
APP_FAKER_LOCALE |
en_US |
|
APP_MAINTENANCE_DRIVER |
file |
|
APP_MAINTENANCE_STORE |
database (commented out) |
|
PHP_CLI_SERVER_WORKERS |
4 |
|
BCRYPT_ROUNDS |
12 |
|
LOG_CHANNEL |
stderr |
Everything goes to php://stderr; nothing under storage/logs (W14). |
LOG_STACK |
single |
|
LOG_DEPRECATIONS_CHANNEL |
null |
|
LOG_LEVEL |
debug |
|
DB_CONNECTION |
sqlite |
Local development uses SQLite. |
DB_HOST |
127.0.0.1 (commented out) |
|
DB_PORT |
3306 (commented out) |
|
DB_DATABASE |
laravel (commented out) |
|
DB_USERNAME |
root (commented out) |
|
DB_PASSWORD |
(empty, commented out) |
|
ORACLE_USERNAME |
(empty, commented out) |
Leave empty if the app does not use Oracle; nothing connects until set. On a server, set it in the app's environment settings, never in a file in git. |
ORACLE_PASSWORD |
(empty, commented out) |
As ORACLE_USERNAME; on a server, set it in the app's environment settings, never in a file in git. |
ORACLE_TNS |
(empty, commented out) |
An Easy Connect string (host:port/service) or a full descriptor; set this or the host, port and service trio. |
ORACLE_HOST |
(empty, commented out) |
Set with ORACLE_PORT and ORACLE_SERVICE_NAME as the alternative to ORACLE_TNS. |
ORACLE_PORT |
(empty, commented out) |
Part of the host, port and service alternative to ORACLE_TNS. |
ORACLE_SERVICE_NAME |
(empty, commented out) |
Part of the host, port and service alternative to ORACLE_TNS. |
SESSION_DRIVER |
database |
A shared store, even for one replica (W15). |
SESSION_LIFETIME |
120 |
|
SESSION_ENCRYPT |
false |
|
SESSION_PATH |
/ |
|
SESSION_DOMAIN |
null |
|
TRUSTED_PROXIES |
172.18.0.1 |
Which proxies Laravel trusts for X-Forwarded-Proto and the client address. Unset keeps 172.18.0.1 (Citadel's proxy); set but empty trusts none; * trusts every proxy; or a comma-separated list of IPs and CIDR ranges. Off Citadel, set your own proxy here and put the same list in HELMET_PROXIES. |
HELMET_PROXIES |
172.18.0.1 |
The address HA-Proxy connects from; the same list as trustProxies in bootstrap/app.php. Empty trusts nothing. A platform preset fills the list instead; when both are set, HELMET_PROXIES wins, and an unknown preset name throws at boot. |
HELMET_PRESET |
citadel (commented out) |
Picks a platform preset; HELMET ships two, citadel and docker. An unknown preset name throws at boot. When both it and HELMET_PROXIES are set, HELMET_PROXIES wins. |
SESAME_DRIVER |
fake |
SESAME owns sign-in. fake signs in locally without an identity provider and refuses to boot outside development environments; production sets SESAME_DRIVER=cas plus SESAME_CAS_BASE_URL. |
SESAME_FAKE_USERNAME |
jdoe |
|
SESAME_CAS_BASE_URL |
(empty, commented out) |
Set with SESAME_DRIVER=cas in production. |
SESAME_CAS_SERVICE_URL |
(empty, commented out) |
|
BROADCAST_CONNECTION |
log |
|
FILESYSTEM_DISK |
local |
|
QUEUE_CONNECTION |
database |
Run the queue worker where the platform allows one (W18). |
CACHE_STORE |
database |
A shared cache, even for one replica (W15). |
CACHE_PREFIX |
(empty, commented out) |
|
MEMCACHED_HOST |
127.0.0.1 |
|
REDIS_CLIENT |
phpredis |
|
REDIS_HOST |
127.0.0.1 |
|
REDIS_PASSWORD |
null |
|
REDIS_PORT |
6379 |
|
MAIL_MAILER |
log |
|
MAIL_SCHEME |
null |
|
MAIL_HOST |
127.0.0.1 |
|
MAIL_PORT |
2525 |
|
MAIL_USERNAME |
null |
|
MAIL_PASSWORD |
null |
|
MAIL_FROM_ADDRESS |
hello@example.com |
|
MAIL_FROM_NAME |
${APP_NAME} |
|
AWS_ACCESS_KEY_ID |
(empty) |
|
AWS_SECRET_ACCESS_KEY |
(empty) |
|
AWS_DEFAULT_REGION |
us-east-1 |
|
AWS_BUCKET |
(empty) |
|
AWS_USE_PATH_STYLE_ENDPOINT |
false |
|
VITE_APP_NAME |
${APP_NAME} |
Follows APP_NAME through ${APP_NAME}. |
Trusted proxies and HELMET_PRESET#
HELMET owns the trusted proxies (W17, Enforced by HELMET 0.2): it trusts only the preset or listed proxies and drops X-Forwarded-Port. Pick a platform preset with HELMET_PRESET; HELMET 0.2 ships two, citadel and docker, and an unknown preset name throws at boot. On other platforms, list the front proxy's address in HELMET_PROXIES (it wins over HELMET_PRESET), and never trust a whole private range. Do not paste trustProxies(at: '*') from tutorials: an app that trusts all proxies lets a client forge X-Forwarded-* and the host used in callbacks. Laravel's own proxy list has its own variable; set TRUSTED_PROXIES to the same address (unset means Citadel's 172.18.0.1). In WELD today, trusted proxies are a literal list in bootstrap/app.php.