Environment variables and configuration

Veap packages read configuration through different mechanisms. Some use the kernel's ConfigService; others also read process.env directly. Do not assume that every variable follows one universal precedence rule.

Database#

The inspected DatabaseServiceProvider resolves the connection in this order:

1. databaseUrl supplied to the provider constructor.
2. DATABASE_URL from ConfigService.
3. process.env.DATABASE_URL.
4. process.env.DATABASE_FILE.
5. Fallback to dev.sqlite.

For a custom Knex config, pass { config: ... } as the provider's second constructor argument:

import { Application } from "@veap/kernel";
import { DatabaseServiceProvider } from "@veap/database";

const app = Application.configure()
  .use((container) =>
    new DatabaseServiceProvider(container, {
      config: {
        client: "better-sqlite3",
        connection: { filename: "./dev.sqlite" },
        useNullAsDefault: true,
      },
    }),
  )
  .create();

Authentication#

The inspected auth provider reads AUTH_BCRYPT_ROUNDS and AUTH_PASSWORD_MIN_LENGTH from ConfigService when it is available. Review the auth guide for encryption-key requirements and the package's crypto implementation before deploying.

Mail#

The mail provider recognizes MAIL_TRANSPORT, MAIL_SERVICE, MAIL_HOST, MAIL_PORT, MAIL_SECURE, MAIL_IGNORE_TLS, MAIL_USERNAME, MAIL_PASSWORD, GOOGLE_SMTP_APP_USERNAME, GOOGLE_SMTP_APP_PASSWORD, MAIL_FROM_ADDRESS, and MAIL_FROM_NAME. With no transport or SMTP host/credentials configured, the inspected implementation falls back to console delivery. Set and verify the transport explicitly in production.

Storage#

The local provider reads FILE_STORAGE_FOLDER from ConfigService or process.env, defaulting to public/uploads. The local driver writes to the application filesystem, so check write permissions and persistence on your hosting platform.

Internationalization#

The server configuration loader reads VEAPCONFIG_INTL_DEFAULT, VEAPCONFIG_INTL_LOCALES, VEAPCONFIG_INTL_COOKIE, and VEAPCONFIG_INTL_TIMEZONE, plus NEXT_PUBLIC_INTL_* alternatives and a timezone fallback. The NEXT_PUBLIC_ prefix makes values client-visible; never put secrets in public variables.

Settings#

SETTINGS_AUTO_MIGRATE controls automatic settings migration unless overridden by SettingsServiceProvider config. Its default is enabled when a database is initialized.

Operational guidance#

• Put credentials in deployment secrets, not source control.
• Validate required values at startup in your own application.
• Avoid relying on package fallbacks in production.
• Document which environment is allowed to run migrations.
• Test configuration in a clean process; Veap's container and several services use process-global state.