Configuration reference

Imaginook has two configuration surfaces:

1. The bootstrap surface — .env.example: app identity, database, secrets, on-disk paths, and production-hardening switches. Copy it to .env and fill it in.
2. Runtime tunables — config/imaginook.php: each key reads an env var with a sane default and is changeable at runtime via the admin Configuration manager (/admin/config, layering DB → env → default) without editing files.

Keep Imaginook tuning keys commented in .env so the coded defaults stay authoritative (the file is also copied to .env in CI).

Bootstrap keys (.env)

Group	Keys
Application	APP_NAME, APP_ENV, APP_KEY, APP_DEBUG, APP_URL, APP_LOCALE
Database (PostgreSQL)	DB_CONNECTION=pgsql, DB_HOST, DB_PORT, DB_DATABASE, DB_USERNAME, DB_PASSWORD, DB_SSLMODE
Sessions & cookies	SESSION_DRIVER, SESSION_ENCRYPT, SESSION_COOKIE, SESSION_SECURE_COOKIE, TRUSTED_PROXIES
Cache / queue / Redis	CACHE_STORE, QUEUE_CONNECTION, REDIS_HOST, REDIS_PORT, REDIS_PASSWORD
Mail	MAIL_MAILER (log locally, Mailgun in prod), MAILGUN_DOMAIN, MAILGUN_SECRET

Defaults are DB-backed (SESSION_DRIVER/CACHE_STORE/QUEUE_CONNECTION = database), so a minimal instance needs only PostgreSQL.

Production hardening

• APP_ENV=production, APP_DEBUG=false, LOG_LEVEL=warning.
• HTTPS session cookie: SESSION_COOKIE=__Host-imaginook_session, SESSION_SECURE_COOKIE=true (the __Host- prefix requires Secure + Path=/ + no Domain).
• TRUSTED_PROXIES — set your reverse-proxy / Cloudflare edge ranges so client IP + scheme resolve correctly (rate limiters and cookieless analytics depend on it). Never use *.

Secrets (never commit)

APP_KEY, DB_PASSWORD, MAILGUN_SECRET, TURNSTILE_SECRET, IP_HASH_PEPPER, WEBHOOK_SECRET, FEDERATION_SIGNING_KEY, BACKUP_ENCRYPTION_KEY, AWS_SECRET_ACCESS_KEY, SAFE_BROWSING_API_KEY, and any CSAM/ClamAV provider credentials. All are optional for a minimal local instance (features degrade gracefully).

Runtime tunables (config/imaginook.php)

Platform behaviour lives here — e.g. subdomain_tlds (the claimable domains), label rules (3–63 chars, LDH ASCII), reserved_names, freed_cooldown_days, and locale negotiation. Prefer the admin Configuration manager over editing the file.