Configuration reference

Common settings

PAPLIBA_DEPLOYMENT_MODE

Local, SelfHosted, or Cloud. Hosted modes require identity and database configuration.

PAPLIBA_DATA_DIRECTORY

Private persistent directory for workspace files, sessions, and encryption keys.

PAPLIBA_ALLOW_AI

Set false to disable the optional Local AI assistant. Hosted modes block local AI execution.

PAPLIBA_ALLOW_EXTERNAL_RATES

External currency-rate requests are disabled unless set to true.

Hosted settings

PAPLIBA_PUBLIC_ORIGIN

Exact public HTTPS origin without a path.

PAPLIBA_ALLOWED_TENANTS

Semicolon-separated admitted Entra tenant GUIDs; SelfHosted admits one tenant.

PAPLIBA_ENTRA_CLIENT_ID / PAPLIBA_ENTRA_CLIENT_SECRET

Confidential Entra application credentials. Store secrets outside source control.

PAPLIBA_DATABASE

PostgreSQL connection string for the restricted runtime role. Use TLS for remote databases.

PAPLIBA_KEY_CERTIFICATE / PAPLIBA_KEY_CERTIFICATE_BASE64

Private PFX file or base64 value used to protect persisted encryption keys.

PAPLIBA_KEY_CERTIFICATE_PASSWORD

Password for the private PFX if required.

PAPLIBA_TRUSTED_PROXY_NETWORKS

Exact trusted proxy CIDRs. Keep the backend private and do not trust every address.

Apply configuration safely

Use the release’s .env example and hosted-installation.md for the complete deployment procedure. Keep secrets out of the web frontend, Git history, screenshots, and logs. Restart the application after changing configuration. Back up the database, application data, and private certificate before an upgrade.

There is no automatic migration of a Local SQLite workspace into a hosted PostgreSQL account. Use a separate data location when evaluating a new installation.