> ## Documentation Index
> Fetch the complete documentation index at: https://figranium.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

Figranium uses environment variables to configure key aspects of the server and automation environment. These variables are defined in `src/server/constants.js`.

## **Core Variables**

| **Variable**             | **Default Value** | **Description**                                                                                                          |
| :----------------------- | :---------------- | :----------------------------------------------------------------------------------------------------------------------- |
| `PORT`                   | `11345`           | The port the backend server listens on.                                                                                  |
| `SESSION_SECRET`         | *(Required)*      | A random string used to sign session cookies.                                                                            |
| `NODE_ENV`               | `production`      | Set to `development` for local dev mode.                                                                                 |
| `ALLOWED_IPS`            | `*` (Open)        | Comma-separated list of allowed IP addresses or CIDR ranges.                                                             |
| `ALLOW_PRIVATE_NETWORKS` | `false`           | Set to `true` or `1` to allow access to local/private networks (SSRF risk).                                              |
| `TRUST_PROXY`            | `false`           | Set to `true` or `1` if running behind a reverse proxy (e.g., Nginx, AWS ALB). Automatically enabled when `RENDER=true`. |

## **Execution**

| **Variable**                | **Default Value** | **Description**                                                                                            |
| :-------------------------- | :---------------- | :--------------------------------------------------------------------------------------------------------- |
| `MAX_CONCURRENT_EXECUTIONS` | *(unlimited)*     | Maximum number of tasks that can run simultaneously. Excess requests are queued until a slot is available. |

When set, Figranium queues incoming execution requests that exceed the limit and processes them in order as slots free up. Leave unset (or set to `0`) for unlimited concurrency — this is the default and matches the behavior of earlier versions.

This is useful when running on resource-constrained hosts or when you want to prevent a burst of scheduled tasks from overwhelming the browser pool.

## **Rate Limiting**

| **Variable**          | **Default Value** | **Description**                                          |
| :-------------------- | :---------------- | :------------------------------------------------------- |
| `AUTH_RATE_LIMIT_MAX` | `10`              | Max failed login attempts per window (15 mins).          |
| `DATA_RATE_LIMIT_MAX` | `100`             | Max data requests (captures, logs) per window (15 mins). |

## **VNC / Headful Debugging**

| **Variable** | **Default Value** | **Description**                   |
| :----------- | :---------------- | :-------------------------------- |
| `NOVNC_PORT` | `54311`           | Port for the noVNC web interface. |

## **Feature Flags**

| **Variable**            | **Default Value** | **Description**                      |
| :---------------------- | :---------------- | :----------------------------------- |
| `SESSION_COOKIE_SECURE` | `false`           | Set to `true` if serving over HTTPS. |

## **Example** `.env` **File**

```text theme={null}
PORT=11345
SESSION_SECRET=super_secret_key_12345
ALLOWED_IPS=127.0.0.1,192.168.1.0/24
ALLOW_PRIVATE_NETWORKS=false
TRUST_PROXY=true
AUTH_RATE_LIMIT_MAX=20
DATA_RATE_LIMIT_MAX=500
NOVNC_PORT=54311
SESSION_COOKIE_SECURE=true
MAX_CONCURRENT_EXECUTIONS=3
```

## **Notes**

* **Allow Private Networks**: By default, `ALLOW_PRIVATE_NETWORKS` is `false`, meaning Figranium blocks requests to private and internal network addresses. If you need to scrape services on your local network (e.g., during development), set this to `true`.
* **Session Secret**: If `SESSION_SECRET` is not provided, figranium will generate a random one on startup (or read from `data/session_secret.txt` if available). However, for consistent sessions across restarts, set a static secret.
* **Allowed IPs**: If you expose figranium to the internet, **always restrict access** using `ALLOWED_IPS` or authentication.