Configuration

Figranium uses environment variables to configure key aspects of the server and automation environment. These variables are defined in src/server/constants.js.

Core Variables

Variable	Default Value	Description
`PORT`	`11345`	The port the backend server listens on.
`SESSION_SECRET`	(Required)	A random string used to sign session cookies.
`NODE_ENV`	`production`	Set to `development` for local dev mode.
`ALLOWED_IPS`	`*` (Open)	Comma-separated list of allowed IP addresses or CIDR ranges.
`ALLOW_PRIVATE_NETWORKS`	`false`	Set to `true` or `1` to allow access to local/private networks (SSRF risk).
`TRUST_PROXY`	`false`	Set to `true` or `1` if running behind a reverse proxy (e.g., Nginx, AWS ALB). Automatically enabled when `RENDER=true`.

Execution

Variable	Default Value	Description
`MAX_CONCURRENT_EXECUTIONS`	(unlimited)	Maximum number of tasks that can run simultaneously. Excess requests are queued until a slot is available.

When set, Figranium queues incoming execution requests that exceed the limit and processes them in order as slots free up. Leave unset (or set to 0) for unlimited concurrency — this is the default and matches the behavior of earlier versions. This is useful when running on resource-constrained hosts or when you want to prevent a burst of scheduled tasks from overwhelming the browser pool.

Rate Limiting

Variable	Default Value	Description
`AUTH_RATE_LIMIT_MAX`	`10`	Max failed login attempts per window (15 mins).
`DATA_RATE_LIMIT_MAX`	`100`	Max data requests (captures, logs) per window (15 mins).

VNC / Headful Debugging

Variable	Default Value	Description
`NOVNC_PORT`	`54311`	Port for the noVNC web interface.

Feature Flags

Variable	Default Value	Description
`SESSION_COOKIE_SECURE`	`false`	Set to `true` if serving over HTTPS.

Example `.env` File

PORT=11345
SESSION_SECRET=super_secret_key_12345
ALLOWED_IPS=127.0.0.1,192.168.1.0/24
ALLOW_PRIVATE_NETWORKS=false
TRUST_PROXY=true
AUTH_RATE_LIMIT_MAX=20
DATA_RATE_LIMIT_MAX=500
NOVNC_PORT=54311
SESSION_COOKIE_SECURE=true
MAX_CONCURRENT_EXECUTIONS=3

Notes

Allow Private Networks: By default, ALLOW_PRIVATE_NETWORKS is false, meaning Figranium blocks requests to private and internal network addresses. If you need to scrape services on your local network (e.g., during development), set this to true.
Session Secret: If SESSION_SECRET is not provided, figranium will generate a random one on startup (or read from data/session_secret.txt if available). However, for consistent sessions across restarts, set a static secret.
Allowed IPs: If you expose figranium to the internet, always restrict access using ALLOWED_IPS or authentication.

Intro

Installation

Basics

Features

Agent Logic

Integrations

API

Ops

Changelog

Core Variables

Execution

Rate Limiting

VNC / Headful Debugging

Feature Flags

Example `.env` File

Notes

​Core Variables

​Execution

​Rate Limiting

​VNC / Headful Debugging

​Feature Flags

​Example .env File

​Notes

Core Variables

Execution

Rate Limiting

VNC / Headful Debugging

Feature Flags

Example `.env` File

Notes