Configuration

Most settings can be configured from the frontend. A few must be set in the .env file.

For interactive setup:

bash gen-env.sh

Or manually copy .env-sample to .env and edit.

Secure Cookies

Bayanat uses secure cookies by default (requires HTTPS). For development:

SECURE_COOKIES=False

DANGER

Do not disable secure cookies in production.

Secret Key

SECRET_KEY keeps sessions secure. Generate a strong key:

python3 -c "import secrets; print(secrets.token_hex(32))"

WARNING

Changing the secret key logs out all users.

PostgreSQL

Required for Docker deployment. Optional for native installs on the same host.

• POSTGRES_DB: Database name (default: bayanat)
• POSTGRES_HOST: Host (empty for local, postgres for Docker)
• POSTGRES_PASSWORD: Password (not required for local)
• POSTGRES_USER: Username (not required for local)

Redis

Required for Docker deployment.

• REDIS_HOST: Host (empty for local, redis for Docker)
• REDIS_PASSWORD: Password, if set

Password Salt

SECURITY_PASSWORD_SALT must be generated and kept secret:

python3 -c "import secrets; print(secrets.token_hex(32))"

DANGER

Changing the password salt invalidates all user passwords.

Two-Factor Authentication

Generate a TOTP secret for SECURITY_TOTP_SECRETS:

python3 -c "import secrets; print(secrets.token_hex(32))"

See Flask Security docs.

DANGER

Changing this secret invalidates all 2FA configurations.

Storage

Local

Media files stored in enferno/media/.

Amazon S3

Configure the S3 bucket with correct policies, block public access, and set up CORS.

Search

Interactive searches run under a database statement timeout. When a search exceeds it, the query is cancelled and re-run by a background worker instead of failing, and the user is notified when the results are ready. See Search for what this looks like in the interface.

Variable	Default	Purpose
SEARCH_TIMEOUT	30	Seconds an interactive search may run before it is handed to the background. 0 disables the behaviour and searches run unbounded.
BACKGROUND_SEARCH_TIME_LIMIT	600	Seconds the background re-run may take before it is abandoned.

Background searches require a running Celery worker. Without one, users receive the "continuing in the background" message but never get results.

WARNING

Lowering SEARCH_TIMEOUT far below the default sends ordinary searches to the background, including the initial page load of a list view. Raise it instead if legitimate searches are being deferred.

Data Import

Enable path scanning with ETL_ALLOWED_PATH.

WARNING

Only enable path scanning when needed.

Backups

See Backups for configuration.

Offline Maps

For offline or privacy-focused deployments, run your own tile server using openstreetmap-tile-server. Update the Maps API Endpoint in system settings.