> ## Documentation Index > Fetch the complete documentation index at: https://docs.footycollect.sunr4y.dev/llms.txt > Use this file to discover all available pages before exploring further. # Environment Variables > Complete reference for all FootyCollect configuration options ## Overview FootyCollect uses environment variables for configuration. For local development, create a `.env` file in the project root or use the `.envs/.local/` directory structure for Docker. Copy `deploy/env.example` to `.env` as a starting point, then customize the values for your environment. ## Django Core Settings Core Django configuration options. Django secret key for cryptographic signing. Generate a secure random string. **Production**: Use a strong random key (50+ characters) **Development**: Any string is fine ```bash theme={null} # Generate with Python python -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())" ``` Enable Django debug mode. **Production**: Must be `False` **Development**: `True` Never enable DEBUG in production! It exposes sensitive information. Comma-separated list of allowed hostnames. **Production**: Your domain(s) ```bash theme={null} DJANGO_ALLOWED_HOSTS=footycollect.com,www.footycollect.com ``` **Development**: Local addresses ```bash theme={null} DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0 ``` URL path for Django admin interface. For security, consider using a non-standard path in production: ```bash theme={null} DJANGO_ADMIN_URL=my-secret-admin-path/ ``` ## Database PostgreSQL database configuration. PostgreSQL connection string in URL format. Format: `postgresql://USER:PASSWORD@HOST:PORT/DATABASE` **Production**: ```bash theme={null} DATABASE_URL=postgresql://footycollect:secure_password@localhost:5432/footycollect_db ``` **Docker**: ```bash theme={null} DATABASE_URL=postgresql://footycollect:local_password@postgres:5432/footycollect ``` Database connection pooling lifetime in seconds. Recommended: `60` for production ## Redis Redis cache and Celery message broker configuration. Redis connection string. Format: `redis://HOST:PORT/DB` **Production**: ```bash theme={null} REDIS_URL=redis://localhost:6379/0 ``` **Docker**: ```bash theme={null} REDIS_URL=redis://redis:6379/0 ``` ## API Rate Limiting Django REST Framework throttle configuration for `/api/` endpoints. Rate limit for authenticated users. Format: `requests/period` (e.g., `100/hour`, `1000/day`) ```bash theme={null} DJANGO_DRF_USER_THROTTLE_RATE=100/hour ``` Rate limit for anonymous users. ```bash theme={null} DJANGO_DRF_ANON_THROTTLE_RATE=20/hour ``` ## Security Headers HTTPS and security header configuration for production. Redirect all HTTP requests to HTTPS. **Production**: `True` **Development**: `False` Include subdomains in HSTS (HTTP Strict Transport Security) policy. **Production**: `True` Enable HSTS preload. **Production**: `True` (submit to hstspreload.org) Prevent MIME type sniffing. **Production**: `True` SameSite cookie policy for session cookies. Options: `Strict`, `Lax`, `None` Recommended: `Lax` SameSite cookie policy for CSRF cookies. Recommended: `Lax` Referrer-Policy header value. Recommended: `strict-origin-when-cross-origin` Permissions-Policy header for controlling browser features. Default disables geolocation, microphone, camera, and payment APIs: ```bash theme={null} DJANGO_PERMISSIONS_POLICY=geolocation=(), microphone=(), camera=(), payment=() ``` ## Content Security Policy (CSP) Content-Security-Policy configuration to prevent XSS attacks. Enable Content Security Policy. **Production**: `True` **Development**: Can be `False` for easier debugging Allowed sources for images. Use comma-separated values with quoted keywords. Default includes Gravatar and Football Kit Archive: ```bash theme={null} DJANGO_CSP_IMG_SRC='self', data:, blob:, https://www.gravatar.com, https://cdn.footballkitarchive.com, https://www.footballkitarchive.com, https://YOUR-BUCKET.s3.amazonaws.com ``` Update with your actual S3/R2 bucket domain if using cloud storage. Default source policy (fallback for other directives). ```bash theme={null} DJANGO_CSP_DEFAULT_SRC='self' ``` Allowed sources for JavaScript. Default includes CDN for UI libraries: ```bash theme={null} DJANGO_CSP_SCRIPT_SRC='self', 'unsafe-inline', 'unsafe-eval', https://cdnjs.cloudflare.com ``` Allowed sources for CSS. ```bash theme={null} DJANGO_CSP_STYLE_SRC='self', 'unsafe-inline', https://cdnjs.cloudflare.com, https://fonts.googleapis.com ``` Allowed sources for fonts. ```bash theme={null} DJANGO_CSP_FONT_SRC='self', https://cdnjs.cloudflare.com, https://fonts.gstatic.com ``` Allowed sources for AJAX, WebSockets, and EventSource. ```bash theme={null} DJANGO_CSP_CONNECT_SRC='self' ``` Allowed sources that can embed this site in frames. ```bash theme={null} DJANGO_CSP_FRAME_ANCESTORS='self' ``` Allowed form submission targets. ```bash theme={null} DJANGO_CSP_FORM_ACTION='self' ``` ## Email Configuration Email sending via SendGrid. SendGrid API key for sending emails. Get from: [https://app.sendgrid.com/settings/api\_keys](https://app.sendgrid.com/settings/api_keys) ```bash theme={null} SENDGRID_API_KEY=SG.xxxxxxxxxxxxxxxxxxxxx ``` SendGrid API endpoint URL. Default "from" address for emails. ```bash theme={null} DJANGO_DEFAULT_FROM_EMAIL=footycollect ``` "From" address for server error emails. ```bash theme={null} DJANGO_SERVER_EMAIL=footycollect ``` Prefix added to email subjects. ## Error Tracking (Sentry) Sentry integration for error monitoring and performance tracking. Sentry Data Source Name (DSN) for error reporting. Get from your Sentry project settings. ```bash theme={null} SENTRY_DSN=https://xxxxxxxxxxxxx@sentry.io/1234567 ``` Environment name for Sentry (production, staging, development). Percentage of transactions to sample for performance monitoring (0.0-1.0). `0.0` = disabled, `1.0` = 100% of requests Recommended: `0.1` (10%) for production to limit costs ## Storage Backend Media file storage configuration (AWS S3 or Cloudflare R2). Storage backend for media files. Options: * `local` - Local filesystem (development) * `aws` - Amazon S3 * `r2` - Cloudflare R2 ```bash theme={null} STORAGE_BACKEND=aws ``` ### AWS S3 Storage Configuration when `STORAGE_BACKEND=aws`. AWS IAM access key ID. AWS IAM secret access key. S3 bucket name for media files. ```bash theme={null} DJANGO_AWS_STORAGE_BUCKET_NAME=footycollect-media ``` AWS region for S3 bucket. Custom domain for S3 bucket (optional, for CloudFront CDN). ```bash theme={null} DJANGO_AWS_S3_CUSTOM_DOMAIN=cdn.your-domain.com ``` ### Cloudflare R2 Storage Configuration when `STORAGE_BACKEND=r2`. Cloudflare R2 access key ID. Cloudflare R2 secret access key. R2 bucket name. ```bash theme={null} CLOUDFLARE_BUCKET_NAME=footycollect-media ``` R2 endpoint URL. Format: `https://.r2.cloudflarestorage.com` ```bash theme={null} CLOUDFLARE_R2_ENDPOINT_URL=https://abc123.r2.cloudflarestorage.com ``` R2 region (usually `auto`). Custom domain for R2 bucket (optional). ```bash theme={null} CLOUDFLARE_R2_CUSTOM_DOMAIN=media.your-domain.com ``` ## External Image Downloads Configuration for downloading images from external sources (e.g., Football Kit Archive). Comma-separated list of allowed hostnames for external image downloads (SSRF protection). ```bash theme={null} DJANGO_ALLOWED_EXTERNAL_IMAGE_HOSTS=cdn.footballkitarchive.com,www.footballkitarchive.com ``` Only add trusted domains to prevent Server-Side Request Forgery (SSRF) attacks. ## FKAPI Integration Football Kit Archive API configuration. IP address or hostname of the FKAPI server. Required for Football Kit Archive integration. ```bash theme={null} FKA_API_IP=192.168.1.100 # or FKA_API_IP=fkapi.your-domain.com ``` See [FKAPI GitHub](https://github.com/sunr4y/fkapi) for setup instructions. API key for authenticating with FKAPI. ```bash theme={null} API_KEY=your-fkapi-authentication-key ``` ## Rotating Proxy Optional proxy configuration for external image downloads to avoid rate limiting. Proxy server URL. Supports HTTP, HTTPS, and SOCKS5 protocols: ```bash theme={null} ROTATING_PROXY_URL=http://proxy.example.com:8080 # or ROTATING_PROXY_URL=socks5://proxy.example.com:1080 ``` Proxy authentication username (if required). Proxy authentication password (if required). ## Compression Static file compression configuration. Enable django-compressor for CSS/JS minification. **Production**: `True` **Development**: Can be `False` for faster builds ## Example Configurations ### Development (.env) ```bash theme={null} # Django Settings DJANGO_SECRET_KEY=local-dev-key-not-for-production DJANGO_DEBUG=True DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1 # Database DATABASE_URL=postgresql://footycollect:devpassword@localhost:5432/footycollect_dev # Redis REDIS_URL=redis://localhost:6379/0 # Security (relaxed for local dev) DJANGO_SECURE_SSL_REDIRECT=False DJANGO_CSP_ENABLED=False # Storage STORAGE_BACKEND=local # Compression COMPRESS_ENABLED=False ``` ### Production (.env) ```bash theme={null} # Django Settings DJANGO_SECRET_KEY= DJANGO_DEBUG=False DJANGO_ALLOWED_HOSTS=footycollect.com,www.footycollect.com DJANGO_ADMIN_URL=secret-admin-path/ # Database DATABASE_URL=postgresql://footycollect:secure_db_pass@localhost:5432/footycollect_prod CONN_MAX_AGE=60 # Redis REDIS_URL=redis://localhost:6379/0 # API Rate Limiting DJANGO_DRF_USER_THROTTLE_RATE=100/hour DJANGO_DRF_ANON_THROTTLE_RATE=20/hour # Security DJANGO_SECURE_SSL_REDIRECT=True DJANGO_SECURE_HSTS_INCLUDE_SUBDOMAINS=True DJANGO_SECURE_HSTS_PRELOAD=True DJANGO_SECURE_CONTENT_TYPE_NOSNIFF=True DJANGO_SESSION_COOKIE_SAMESITE=Lax DJANGO_CSRF_COOKIE_SAMESITE=Lax # CSP DJANGO_CSP_ENABLED=True DJANGO_CSP_IMG_SRC='self', data:, blob:, https://www.gravatar.com, https://cdn.footballkitarchive.com, https://footycollect-media.s3.amazonaws.com # Email (SendGrid) SENDGRID_API_KEY=SG.xxxxxxxxxxxxxxxxxxxxxxx DJANGO_DEFAULT_FROM_EMAIL=FootyCollect DJANGO_SERVER_EMAIL=FootyCollect # Sentry SENTRY_DSN=https://xxxxxxx@sentry.io/1234567 SENTRY_ENVIRONMENT=production SENTRY_TRACES_SAMPLE_RATE=0.1 # Storage (AWS S3) STORAGE_BACKEND=aws DJANGO_AWS_ACCESS_KEY_ID=AKIAXXXXXXXXXXXXXXXX DJANGO_AWS_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx DJANGO_AWS_STORAGE_BUCKET_NAME=footycollect-media DJANGO_AWS_S3_REGION_NAME=us-east-1 # External Images DJANGO_ALLOWED_EXTERNAL_IMAGE_HOSTS=cdn.footballkitarchive.com,www.footballkitarchive.com # FKAPI FKA_API_IP=192.168.1.100 API_KEY=your-fkapi-key # Compression COMPRESS_ENABLED=True ``` ### Docker Development (.envs/.local/) **.envs/.local/.django**: ```bash theme={null} DJANGO_SETTINGS_MODULE=config.settings.local DJANGO_SECRET_KEY=docker-local-secret-key DJANGO_DEBUG=True DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0 REDIS_URL=redis://redis:6379/0 CELERY_BROKER_URL=redis://redis:6379/0 EMAIL_BACKEND=django.core.mail.backends.smtp.EmailBackend EMAIL_HOST=mailpit EMAIL_PORT=1025 ``` **.envs/.local/.postgres**: ```bash theme={null} POSTGRES_HOST=postgres POSTGRES_PORT=5432 POSTGRES_DB=footycollect POSTGRES_USER=footycollect POSTGRES_PASSWORD=local_dev_password DATABASE_URL=postgresql://footycollect:local_dev_password@postgres:5432/footycollect ``` ## Validation Run Django's production deployment checks: ```bash theme={null} python manage.py check --deploy ``` This validates: * Security settings * Required environment variables * Database connectivity * Static file configuration ## Next Steps Manual local installation guide Docker Compose development environment Production deployment guide Learn about the architecture