Better-PaaS works out of the box with sensible defaults. When you're ready to tune it, configure it through environment variables.

Backend configuration

Set these in the backend environment (see backend/.env.example). The defaults are chosen so a fresh install just works.

Variable	Default	What it does
`ADMIN_TOKEN`	generated	The admin bearer token. Set this to pin or rotate it instead of using the auto-generated value.
`LISTEN_ADDR`	`:8080`	The address the API listens on. Use `127.0.0.1:8080` when running behind a reverse proxy.
`DASHBOARD_ORIGIN`	same hostname	Comma-separated list of allowed origins for CORS and WebSockets. Set this when the dashboard is served from a different hostname than the API.
`PAAS_UI_URL`	unset	Public dashboard URL (e.g. `https://paas.example.com`). Exposed in `/.well-known/better-paas.json` so the paas CLI can open the browser authorize page when users connect via the raw API URL.
`SHOW_ADMIN_TOKEN_ON_STARTUP`	`false`	Print the admin token on every backend startup. First run always prints it.
`BETTER_PAAS_SECRET_KEY`	generated	32-byte key (hex or base64) used to encrypt secrets at rest.
`TRUST_PROXY`	`false`	Honor `X-Forwarded-For` / `X-Real-IP`. Set to `true` when behind a proxy so rate-limiting uses the real client IP.
`ACME_EMAIL`	unset	Email for Let's Encrypt registration, used for custom-domain HTTPS.
`BACKUP_INTERVAL_HOURS`	`0`	If greater than 0, auto-snapshot `data/` every N hours (keeps the last 10).
`UPDATE_REPO`	from git remote	The `owner/repo` slug the in-app updater checks for new releases.

Setting backend variables

If you installed via the script, the backend runs as a systemd service. Add variables to the unit file:

/etc/systemd/system/better-paas-backend.service

[Service]
Environment=ACME_EMAIL[email protected]
Environment=BACKUP_INTERVAL_HOURS=6
Environment=TRUST_PROXY=true
Environment=DASHBOARD_ORIGIN=https://paas.example.com

Then reload and restart:

sudo systemctl daemon-reload
sudo systemctl restart better-paas-backend

Running manually instead? Use a .env file or export the variables before starting ./server.

Frontend configuration

The dashboard needs to know where the backend API lives. By default it assumes the same host on port 8080.

Variable	Default	What it does
`NEXT_PUBLIC_API_URL`	same host, port 8080	Explicit backend API base URL. Required when the API is on a different host than the dashboard (e.g. dashboard on `https://paas.example.com`, API on `http://203.0.113.10:8080`). Also used by `/.well-known/better-paas.json` for CLI URL discovery.
`NEXT_PUBLIC_PAAS_UI_URL`	current origin	Public dashboard URL in the well-known manifest. Override when the auto-detected origin is wrong.

Set them in frontend/.env (see frontend/.env.example):

frontend/.env - split dashboard and API

NEXT_PUBLIC_API_URL=http://203.0.113.10:8080
NEXT_PUBLIC_PAAS_UI_URL=https://paas.example.com

After changing frontend env vars, rebuild and redeploy the dashboard. Verify discovery works:

curl https://paas.example.com/.well-known/better-paas.json

Checking the running version

To see which version of Better-PaaS is running:

cd ~/better-paas/backend && ./server version

Next step

Updates

Keep Better-PaaS up to date with one click.

Configuration