Configuration

Change a setting with installer variables or the .env file, and control the update check.

Supaffi is configured with environment variables passed to the installer. The installer writes them to /opt/supaffi/.env and reuses them on every later run, so you set each one once.

Change a setting

Run the installer again from the install folder, with the variable on bash:

Terminal

cd /opt/supaffi && sudo SUPAFFI_UPDATE_CHECK=off SUPAFFI_KEEP_VERSION=yes bash install.sh

A variable you pass wins, then the value already in .env, then the default. The version is the exception: without SUPAFFI_VERSION or SUPAFFI_KEEP_VERSION=yes, every run moves to the newest release, which makes it an update.

Installer variables

SUPAFFI_DOMAINhostname

Serves the owner dashboard on a domain, with an ordinary certificate. Optional: the server address keeps working. Point an A record at the server first; installing before DNS has propagated is fine, the certificate is retried.

A bare hostname such as supaffi.yourserver.com: no scheme, path, port or wildcard. No product can use this domain for its affiliate portal. Behind your own proxy, route it to the app like any product hostname.

SUPAFFI_HOST_IPIPv4 address or hostnamedefault detected

The server's public address. The dashboard is served on it, and the DNS step shows it as the value of the A record. Detected on first install. IPv6 is not supported yet.

SUPAFFI_DASHBOARD_PORT1024 to 65535default 3443

The port the owner dashboard listens on. If another service holds it, the installer stops and suggests another port. Allow the new port in your hosting provider's firewall.

SUPAFFI_PROXY_MODEbundled or externaldefault decided on first install

bundled: Supaffi's own proxy takes ports 80 and 443 and handles HTTPS for every product hostname. external: nothing binds 80 or 443, and your proxy forwards to SUPAFFI_APP_BIND. Decided once, on the first install, and only changed when you pass this variable. See Reverse proxy and HTTPS.

SUPAFFI_APP_BINDaddress:portdefault 127.0.0.1:3000

Where the app's port lands on the host. Your own reverse proxy forwards here.

Keep it on loopback unless you know why you need more. Docker's firewall rules take precedence over ufw and firewalld, so 0.0.0.0 is reachable from the internet even on a host you believe is firewalled.

SUPAFFI_UPDATE_CHECKoffdefault on

Set to off to stop the dashboard checking GitHub for new releases. See Update check.

SUPAFFI_BUILD_FROM_SOURCEyes or nodefault no

yes builds the app image on the server instead of pulling the published one. Needs about 2 GB of RAM and several minutes. Remembered on later runs; pass no to go back to published images.

SUPAFFI_VERSIONx.y.zdefault newest release

Installs that exact version. See Install a specific version.

SUPAFFI_KEEP_VERSIONyes

Reconfigures without moving to a newer release. Use it whenever you rerun the installer only to change a setting.

SUPAFFI_ALLOW_DOWNGRADEyes

Allows installing a version older than the one running. The installer refuses without it. See Downgrade.

SUPAFFI_INSTALL_DOCKERyes

Installs Docker without asking when it is missing. Needed when the installer runs without a terminal, such as from a provisioning script.

SUPAFFI_SKIP_BACKUPyes

Skips the database backup the installer takes before an update. Only for when the backup itself fails and you have another copy.

SUPAFFI_DISCARD_LOCAL_CHANGESyes

Lets an update overwrite files you edited in /opt/supaffi. Without it, the installer lists them and stops. Your .env and files you added, such as docker-compose.override.yml, are never touched.

SUPAFFI_DIRpathdefault /opt/supaffi

Where Supaffi is installed.

SUPAFFI_REPOgit URLdefault https://github.com/ugolbck/supaffi.git

The repository the release is cloned from.

The .env file

/opt/supaffi/.env holds the variables above and the keys below. It is readable by root only. Docker Compose reads it, so every command stays a plain docker compose from /opt/supaffi.

MASTER_ENCRYPTION_KEYgenerated: Encrypts every product's Stripe key and webhook signing secret in the database. Generated once, never regenerated. Without it, the stored Stripe keys cannot be read. Keep a copy apart from your database backups, see The encryption key.
AUTH_SECRETgenerated: Signs owner login sessions. Generated once.
POSTGRES_PASSWORDgenerated: The database password, set when the database is first created. Do not change it.
AUTH_TRUST_HOSTtrue: Required. One instance answers on many product domains, so there is no single address to pin.
COMPOSE_PROFILESwritten by the installer: Which services run: dashboard-tls,bundled-proxy in bundled mode, dashboard-tls in external mode. Change it with SUPAFFI_PROXY_MODE, not by hand.
COMPOSE_FILEwritten by the installer: Present only on source builds: docker-compose.yml:docker-compose.build.yml, plus docker-compose.override.yml when that file exists.
SUPAFFI_PROXY_HOSThostnamedefault caddy: Optional. Where the HTTPS check on the DNS step asks for a product's certificate. Behind your own proxy, leave it unset; the check then fetches the hostname over the internet.
DATABASE_URLdevelopment only: Used when running Supaffi outside Docker for development. An install builds it from POSTGRES_PASSWORD.

Update check

The dashboard checks GitHub's public releases page to learn whether a newer version exists. The request is anonymous and sends nothing about your instance. A successful answer is reused for 6 hours, a failed one for 30 minutes.

A newer release puts a dot on your account avatar: red for a security release, blue otherwise. See Update notices.
Account, section This instance, shows the running version and whether the update check is on.
To turn it off, rerun the installer with SUPAFFI_UPDATE_CHECK=off. You then learn about releases, including security fixes, only from GitHub.