Environment variables - P-BitM

server/.env is generated by the CLI. Prefer changing config.yaml and rerunning setup over hand-editing generated values. The generated file contains the core settings; optional runtime overrides use application defaults when absent.

Core runtime

Variable	Purpose	Default/source
`ENVIRONMENT`	Selects development or production behavior	`config.yaml`
`IP`	Host address used for development campaign URLs	auto-detected
`HOST_STORAGE_PATH`	Absolute host storage path	generated
`STORAGE_PATH`	Storage path inside containers	`/storage`
`DB_PATH`	SQLite file inside storage	`/storage/p-bitm.db`
`PBITM_UID`	Non-root numeric UID used by storage-writing containers	selected by CLI
`PBITM_GID`	Non-root numeric GID used by storage-writing containers	selected by CLI
`ADMIN_USERNAME`	Initial administrator username	`config.yaml`
`ADMIN_PASSWORD`	Initial administrator password	generated
`ADMIN_EMAIL`	Initial administrator email	`config.yaml`
`INTERNAL_API_KEY`	Root secret for internal campaign credentials	generated
`DATA_ENCRYPTION_KEY`	Encryption key for stored secrets	generated

Session admission

Variable	Default	Purpose
`SESSION_TOKEN_TTL_SECONDS`	`300`	Public admission token lifetime
`WS_HANDSHAKE_TIMEOUT_SECONDS`	`10`	WebSocket handshake deadline
`WS_SESSION_STARTUP_TIMEOUT_SECONDS`	`45`	Session startup deadline
`MAX_ACTIVE_SESSIONS`	`20`	Per-campaign active-session limit
`WS_RATE_LIMIT_WINDOW_SECONDS`	`60`	Admission rate window
`WS_RATE_LIMIT_MAX_ATTEMPTS`	`10`	Attempts per client/window
`WS_GLOBAL_RATE_LIMIT_MAX_ATTEMPTS`	`200`	Global attempts/window

Administration and runtime limits

Variable	Default	Purpose
`ADMIN_SESSION_TTL_HOURS`	`12`	Admin session lifetime
`ADMIN_MAX_SESSIONS_PER_USER`	`5`	Concurrent sessions per user
`VICTIM_READY_TIMEOUT_SECONDS`	`35`	Browser readiness deadline
`GLOBAL_MAX_ACTIVE_VICTIM_SESSIONS`	`20`	Host-wide browser limit
`RUNTIME_ORPHAN_GRACE_MINUTES`	`30`	Orphan cleanup grace period
`STREAM_ACCESS_TTL_SECONDS`	`86400`	Signed live-stream access lifetime
`MAX_UPLOAD_BYTES`	`10485760`	Default file-upload limit
`MAX_EXPORT_BYTES`	`536870912`	Export limit
`TRUSTED_DASHBOARD_PROXY_HOSTS`	`frontend`	Trusted admin proxy hosts

Images and Docker

DOCKER_NETWORK, CAMPAIGN_IMAGE, and EGRESS_IMAGE are generated from the operator configuration. VNC_IMAGE and SELKIES_IMAGE are optional runtime overrides. DOCKER_HOST is set by Compose to the restricted admin socket proxy.

Seed data

Both supplied Compose files set:

SEED_DATA=true

This remains the project default.

Last modified on August 28, 2026