# Secrets live in the gitignored .env; this committed file only lists which ones each developer must create.

# create-app already wrote a random ADMINFORTH_SECRET into .env on the machine that scaffolded the project.

# On a fresh clone, generate your own — see "First-time setup" in README.md (openssl rand -hex 32).

ADMINFORTH_SECRET=

# Add only sensitive local environment variables here; non-sensitive local variables should go to .env.local

# This file is gitignored. Each developer and each deployment needs its own ADMINFORTH_SECRET.

ADMINFORTH_SECRET={{{adminforthSecret}}}

# Add only non-sensitive local environment variables here so all team members can use them with minimal setup

# For sensitive local environment variables, use .env and explain to team members how to set them, ideally with a .env.example

NODE_ENV=development

DEBUG_LEVEL=info

AF_DEBUG_LEVEL=info

```

First-time setup on a fresh clone: `create-app` wrote a random `ADMINFORTH_SECRET` into `.env`, but that file is gitignored, so every developer and every deployment creates their own (see `.env.example`). The command below only creates `.env` when it does not exist yet:

```bash

# On Windows (PowerShell): node -e "require('fs').writeFileSync('.env', 'ADMINFORTH_SECRET=' + require('crypto').randomBytes(32).toString('hex') + '\n', { flag: 'wx' })"

[ -f .env ] || (umask 077; echo "ADMINFORTH_SECRET=$(openssl rand -hex 32)" > .env)

```

Start the server:

```bash

You have Dockerfile ready for production deployment. You can test the build with:

```bash

# Generate a signing key once and keep it in your secret store (never commit it).

# On Windows without openssl: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

export ADMINFORTH_SECRET="$(openssl rand -hex 32)"

docker build -t {{appName}}-image .

docker run -p 3500:3500 -e ADMINFORTH_SECRET="$ADMINFORTH_SECRET" {{#if sqliteFile}}-v $(pwd)/db:/code/db {{/if}}{{appName}}-image

```

To set non-sensitive environment variables in production, use `.env.prod` file.

import { fileURLToPath, pathToFileURL } from 'url';

import {ConnectionString} from 'connection-string';

import { exec } from 'child_process';

import crypto from 'crypto';

import Handlebars from 'handlebars';

import { promisify } from 'util';

};

export async function writeTemplateFiles(dirname, cwd, useNpm, includePrismaMigrations, options) {

const {

dbUrl, prismaDbUrl, appName, provider, existingDb, nodeMajor,

dbUrlProd, prismaDbUrlProd, sqliteFile

data: {},

},

{

// gitignored: holds the JWT signing key, unique per developer and per deployment

src: '.env.hbs',

dest: '.env',

data: { adminforthSecret: crypto.randomBytes(32).toString('hex') },

mode: 0o600,

},

{

// committed: tells the next developer which secrets to create locally

src: '.env.example.hbs',

dest: '.env.example',

data: {},

},

{

src: 'adminuser.ts.hbs',

...packageManagerTemplateData,

...task.data,

});

await fs.promises.writeFile(destPath, compiled, task.mode ? { mode: task.mode } : undefined);

if (task.mode) {

// writeFile's mode is masked by the umask and ignored on overwrite; enforce it unconditionally

await fs.promises.chmod(destPath, task.mode);

}

}

}

Put the following content to the `.env.local` file:

```bash title="./.env.local"

NODE_ENV=development

DATABASE_URL=sqlite://.db.sqlite

PRISMA_DATABASE_URL=file:.db.sqlite

Generate a signing key into the gitignored `.env` file, readable by you only (AdminForth logs a warning at startup if the secret is shorter than 16 characters; on Windows without openssl use `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`):

(umask 077; echo "ADMINFORTH_SECRET=$(openssl rand -hex 32)" > .env)

Make sure `.env` never reaches the repository or a Docker image:

echo ".env" >> .gitignore

echo ".env" >> .dockerignore

And run container with:

export ADMINFORTH_SECRET="$(openssl rand -hex 32)"

docker run -p 3500:3500 \

-e ADMINFORTH_SECRET="$ADMINFORTH_SECRET" \

-v $(pwd)/db:/code/db \

myadminapp

build: ./adminforth-app

environment:

- NODE_ENV=production

- ADMINFORTH_SECRET=${ADMINFORTH_SECRET:?generate one with openssl rand -hex 32} # ☝️ export it in the shell or put it in a gitignored .env next to this compose file; compose refuses to start when it is unset

labels:

- "traefik.enable=true"

- "traefik.http.routers.adminforth.tls=true"

}

if (adminforthSecret.length < 16) {

afLogger.warn(`ADMINFORTH_SECRET is too short (${adminforthSecret.length} characters). ` +

'It is the key that signs every auth cookie: a guessable value lets anyone forge a session for any user. ' +

'Generate one with: openssl rand -hex 32');

}

}

async getAllTables(): Promise<{ [dataSourceId: string]: string[] }> {