> ## Documentation Index
> Fetch the complete documentation index at: https://p-bitm-2269ecee.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment variables

> Reference generated runtime environment variables and their sources.

`server/.env` is generated by the CLI. Prefer changing `config.yaml` and
rerunning `setup` over hand-editing generated values. The generated file
contains the core settings; optional runtime overrides use application defaults
when absent.

## Core runtime

| Variable              | Purpose                                                 | Default/source       |
| --------------------- | ------------------------------------------------------- | -------------------- |
| `ENVIRONMENT`         | Selects development or production behavior              | `config.yaml`        |
| `IP`                  | Host address used for development campaign URLs         | auto-detected        |
| `HOST_STORAGE_PATH`   | Absolute host storage path                              | generated            |
| `STORAGE_PATH`        | Storage path inside containers                          | `/storage`           |
| `DB_PATH`             | SQLite file inside storage                              | `/storage/p-bitm.db` |
| `PBITM_UID`           | Non-root numeric UID used by storage-writing containers | selected by CLI      |
| `PBITM_GID`           | Non-root numeric GID used by storage-writing containers | selected by CLI      |
| `ADMIN_USERNAME`      | Initial administrator username                          | `config.yaml`        |
| `ADMIN_PASSWORD`      | Initial administrator password                          | generated            |
| `ADMIN_EMAIL`         | Initial administrator email                             | `config.yaml`        |
| `INTERNAL_API_KEY`    | Root secret for internal campaign credentials           | generated            |
| `DATA_ENCRYPTION_KEY` | Encryption key for stored secrets                       | generated            |

## Session admission

| Variable                             | Default | Purpose                           |
| ------------------------------------ | ------: | --------------------------------- |
| `SESSION_TOKEN_TTL_SECONDS`          |   `300` | Public admission token lifetime   |
| `WS_HANDSHAKE_TIMEOUT_SECONDS`       |    `10` | WebSocket handshake deadline      |
| `WS_SESSION_STARTUP_TIMEOUT_SECONDS` |    `45` | Session startup deadline          |
| `MAX_ACTIVE_SESSIONS`                |    `20` | Per-campaign active-session limit |
| `WS_RATE_LIMIT_WINDOW_SECONDS`       |    `60` | Admission rate window             |
| `WS_RATE_LIMIT_MAX_ATTEMPTS`         |    `10` | Attempts per client/window        |
| `WS_GLOBAL_RATE_LIMIT_MAX_ATTEMPTS`  |   `200` | Global attempts/window            |

## Administration and runtime limits

| Variable                            |     Default | Purpose                            |
| ----------------------------------- | ----------: | ---------------------------------- |
| `ADMIN_SESSION_TTL_HOURS`           |        `12` | Admin session lifetime             |
| `ADMIN_MAX_SESSIONS_PER_USER`       |         `5` | Concurrent sessions per user       |
| `VICTIM_READY_TIMEOUT_SECONDS`      |        `35` | Browser readiness deadline         |
| `GLOBAL_MAX_ACTIVE_VICTIM_SESSIONS` |        `20` | Host-wide browser limit            |
| `RUNTIME_ORPHAN_GRACE_MINUTES`      |        `30` | Orphan cleanup grace period        |
| `STREAM_ACCESS_TTL_SECONDS`         |     `86400` | Signed live-stream access lifetime |
| `MAX_UPLOAD_BYTES`                  |  `10485760` | Default file-upload limit          |
| `MAX_EXPORT_BYTES`                  | `536870912` | Export limit                       |
| `TRUSTED_DASHBOARD_PROXY_HOSTS`     |  `frontend` | Trusted admin proxy hosts          |

## Images and Docker

`DOCKER_NETWORK`, `CAMPAIGN_IMAGE`, and `EGRESS_IMAGE` are generated from the
operator configuration. `VNC_IMAGE` and `SELKIES_IMAGE` are optional runtime
overrides. `DOCKER_HOST` is set by Compose to the restricted admin socket
proxy.

## Seed data

Both supplied Compose files set:

```text theme={"system"}
SEED_DATA=true
```

This remains the project default.