Documentation Index
Fetch the complete documentation index at: https://figranium.dev/docs/llms.txt
Use this file to discover all available pages before exploring further.
Figranium uses environment variables to configure key aspects of the server and automation environment. These variables are defined in src/server/constants.js.
Core Variables
| Variable | Default Value | Description |
|---|
PORT | 11345 | The port the backend server listens on. |
SESSION_SECRET | (Required) | A random string used to sign session cookies. |
NODE_ENV | production | Set to development for local dev mode. |
ALLOWED_IPS | * (Open) | Comma-separated list of allowed IP addresses or CIDR ranges. |
ALLOW_PRIVATE_NETWORKS | false | Set to true or 1 to allow access to local/private networks (SSRF risk). |
TRUST_PROXY | false | Set to true or 1 if running behind a reverse proxy (e.g., Nginx, AWS ALB). |
Execution
| Variable | Default Value | Description |
|---|
MAX_CONCURRENT_EXECUTIONS | (unlimited) | Maximum number of tasks that can run simultaneously. Excess requests are queued until a slot is available. |
0) for unlimited concurrency — this is the default and matches the behavior of earlier versions.
This is useful when running on resource-constrained hosts or when you want to prevent a burst of scheduled tasks from overwhelming the browser pool.
Rate Limiting
| Variable | Default Value | Description |
|---|
AUTH_RATE_LIMIT_MAX | 10 | Max failed login attempts per window (15 mins). |
DATA_RATE_LIMIT_MAX | 100 | Max data requests (captures, logs) per window (15 mins). |
VNC / Headful Debugging
| Variable | Default Value | Description |
|---|
NOVNC_PORT | 54311 | Port for the noVNC web interface. |
Feature Flags
| Variable | Default Value | Description |
|---|
SESSION_COOKIE_SECURE | false | Set to true if serving over HTTPS. |
Example .env File
PORT=11345
SESSION_SECRET=super_secret_key_12345
ALLOWED_IPS=127.0.0.1,192.168.1.0/24
ALLOW_PRIVATE_NETWORKS=false
TRUST_PROXY=true
AUTH_RATE_LIMIT_MAX=20
DATA_RATE_LIMIT_MAX=500
NOVNC_PORT=54311
SESSION_COOKIE_SECURE=true
MAX_CONCURRENT_EXECUTIONS=3
Notes
- Allow Private Networks: By default,
ALLOW_PRIVATE_NETWORKS is false, meaning Figranium blocks requests to private and internal network addresses. If you need to scrape services on your local network (e.g., during development), set this to true.
- Session Secret: If
SESSION_SECRET is not provided, figranium will generate a random one on startup (or read from data/session_secret.txt if available). However, for consistent sessions across restarts, set a static secret.
- Allowed IPs: If you expose figranium to the internet, always restrict access using
ALLOWED_IPS or authentication.
