All server configuration is done with environment variables: it works the same with Docker, systemd,
Kubernetes or any platform. Establishment settings (prices, map, public page, Stripe keys, notifications) are
not here: they are managed from the panel and live in the database.
At startup Arenile validates every variable and, if something is wrong, stops with a message naming the variable
and the expected format: better not to start than to start misconfigured.
Public URL, for example https://prenota.mio-lido.it. Required in production. Used in email links, in the widget code, in payment return URLs and in the webhook URL. Must be an absolute http(s) URL.
ARENILE_SECRET_KEY
—
Encryption key for secrets (Stripe keys, webhook secrets, TOTP): 32 bytes in base64, generated with openssl rand -base64 32. Required. Accepts several comma-separated keys for rotation.
ARENILE_DATA_DIR
/data
Data folder: SQLite database (arenile.db), uploaded files, automatic certificates.
DATABASE_URL
empty
Empty = SQLite. With postgres:// or postgresql:// it uses PostgreSQL. Special characters in the password must be encoded (@ becomes %40).
Applies database migrations when serve starts. With false, run arenile migrate up before starting.
ARENILE_DEV
false
Development mode (like arenile serve --dev): ARENILE_BASE_URL optional, secret key generated and saved in ARENILE_DATA_DIR/dev-secret.key, non-Secure cookies over http. Never in production.
SMTP server, for example smtp://user:password@smtp.example.com:587 (STARTTLS) or smtps://...:465 (implicit TLS). Off localhost STARTTLS is mandatory (emails carry magic links and personal data): for a relay on a trusted network without TLS add ?tls=none.
ARENILE_MAIL_FROM
noreply@<host of ARENILE_BASE_URL>
Sender, for example Lido Esempio <bookings@mio-lido.it>. Must be a valid address.
ARENILE_MAIL_DIR
empty
Without SMTP: folder where every email is written as an .eml file (development and end-to-end tests). Empty and no SMTP: emails are only noted in the log, with the recipient masked.
ARENILE_STRIPE_API_URL
empty
Tests only: address of a Stripe API double (stripe-mock or the fake Stripe of the end-to-end tests). Empty = https://api.stripe.com. The server accepts it only on a loopback host or with ARENILE_DEV=true (and only https off loopback) and warns in the log at startup: the establishments’ secret keys would be sent to that address.
How long a spot is held while the customer completes an online booking (Go duration format: 10m, 15m, 1h). During payment the hold is extended up to a maximum of 30 minutes.
ARENILE_PUBLIC_READS_PER_MINUTE
60
Reads per minute per IP address on the public API (spec 17.2). Raise it when many customers book from the same network (hotel or beach Wi-Fi) and Arenile is not behind a proxy listed in ARENILE_TRUSTED_PROXIES.
ARENILE_PUBLIC_CREATIONS_PER_MINUTE
10
Bookings started (and new-link requests) per minute per IP address. The later steps of the same booking count as reads.
ARENILE_REFUND_MAX_ATTEMPTS
10
Attempts to send an automatic refund (cancellation from the customer’s link or from the panel) to the payment provider, waiting from 1 minute up to 12 hours between them. When they run out the refund becomes “Failed”, the manager gets a notification and can retry it from the booking. 1 to 100.
ARENILE_WEBHOOK_ATTEMPT_RETENTION_DAYS
30
Days the full history of webhook delivery attempts is kept (every attempt, not only the last one).
Comma-separated domains for automatic TLS certificates (Let’s Encrypt). Arenile listens directly on 80 and 443. Leave empty if you use a reverse proxy.
ARENILE_TRUSTED_PROXIES
empty
Comma-separated CIDRs of trusted reverse proxies (e.g. 127.0.0.1/32,172.18.0.0/16), from which the real client IP is read. Required behind a proxy, otherwise per-IP limits hit everyone at once.
ARENILE_REQUIRE_TOTP_FOR_OWNERS
false
Makes two-step verification mandatory for owner users.
debug, info, warn or error. Logs are JSON and never contain emails, phone numbers, tokens or secrets in clear.
ARENILE_TELEMETRY
false
No telemetry by default.
ARENILE_UPDATE_CHECK
true
New version notice in the panel: once a day it reads the public file of the latest version from the Coste360 server. The request carries only the version, edition and operating system (and, like any request, the IP address); it is not telemetry. false = no network call. See Upgrades.
ARENILE_UPDATE_URL
https://updates.coste360.it/arenile/latest.json
File read by the new version check, for example an internal mirror.
Email of the first owner, created when serve starts only if the database has no users.
ARENILE_BOOTSTRAP_OWNER_NAME
empty
Name of the first owner.
ARENILE_BOOTSTRAP_OWNER_ORG
empty
Organization name.
ARENILE_ADMIN_PASSWORD
empty
Password of the first owner (at least 10 characters), or for arenile admin create and arenile seed demo without an interactive prompt.
The three ARENILE_BOOTSTRAP_OWNER_* variables must be set together with ARENILE_ADMIN_PASSWORD; on later
restarts they are ignored and after the first sign-in you can remove the password.
These variables are read by the files in deploy/, not by the binary:
Variable
Default
Description
ARENILE_VERSION
latest
Tag of the ghcr.io/coste360/arenile image (pin an exact version in production).
ARENILE_PUBLISH_PORT
8080
Port published on the host (e.g. 127.0.0.1:8080 to expose it to the reverse proxy only).
POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB
arenile, —, arenile
Credentials of the PostgreSQL service in docker-compose.postgres.yml. The password goes into DATABASE_URL unencoded: use URL-safe characters only (openssl rand -hex 24).
