Zodiac Tech CRM Docs

Environment variables

Every key in .env.example explained in grouped tables — what is secret, what is safe, and the production values to set.

super-admin developer Medium ⏱ 15 min Updated 2026-10-05

The .env file is the single source of per-server configuration. .env.example ships complete: the defaults already work on shared hosting (database sessions, file cache, database queue). This page documents every key and flags its sensitivity.

Who this is for

  • Super-admin / hosting admin — making a production install.
  • Developer — understanding what is configurable without reading the code.

Prerequisites: the app is uploaded (cPanel deployment walkthrough).

Sensitivity legend

Mark Meaning
Secret Never commit, never share, never paste in a ticket. Rotating it breaks active sessions/integrations
Internal Server-side value; not a credential, but not for public display
Safe Public-ish configuration; appears in the UI or generated URLs

Production baseline

APP_ENV=production
APP_DEBUG=false

APP_DEBUG=true in production leaks stack traces, file paths and SQL to any visitor who triggers an error. The shipped .env.example already defaults to false.

Application

Key Default Mark Notes
APP_NAME "LeadHub" Safe Fallback app name (branding can be set in Super Admin)
APP_ENV production Internal Keep production on live installs
APP_KEY (empty) Secret Generated by the installer or php artisan key:generate. Changing it breaks encrypted data
APP_DEBUG false Internal Never true in production
APP_URL http://localhost Safe The final URL including scheme (and subfolder if applicable)
APP_LOCALE / APP_FALLBACK_LOCALE en Safe UI language defaults
APP_MAINTENANCE_DRIVER file Internal Keep file on shared hosting
BCRYPT_ROUNDS 12 Internal Password hashing cost; leave as is

LeadHub-specific

Key Default Mark Notes
LEADHUB_VERSION 1.0.4 Internal Kept in sync by releases; used by the updater/cache healer
LEADHUB_API_VERSION v1 Safe API version segment (config('leadhub.api_version'))
LEADHUB_APP_NAME "LeadHub" Safe Branding fallback
LEADHUB_PRIMARY_COLOR / LEADHUB_ACCENT_COLOR theme colors Safe Branding fallbacks (#4f46e5, #06b6d4)
LEADHUB_UPDATE_SERVER updates URL Safe Where the in-app updater checks for releases

Logging

Key Default Notes
LOG_CHANNEL stack Internal
LOG_STACK single Internal
LOG_LEVEL error Internal — raise to debug temporarily when diagnosing

Database

Key Example Mark
DB_CONNECTION mysql Internal (only MySQL is supported)
DB_HOST 127.0.0.1 Internal
DB_PORT 3306 Internal
DB_DATABASE youruser_leadhub Secret-ish (schema name; never with password in a ticket)
DB_USERNAME youruser_leadhub Secret-ish
DB_PASSWORD your-strong-password Secret

Details: Database setup & migrations.

Session

Key Default Notes
SESSION_DRIVER database Works on shared hosting; redis only where offered
SESSION_LIFETIME 120 Minutes
SESSION_ENCRYPT false Optional
SESSION_PATH / Leave
SESSION_DOMAIN null Leave unless sharing cookies across subdomains
SESSION_SECURE_COOKIE (commented) Set true on HTTPS deployments
SESSION_HTTP_ONLY (commented) Set true (blocks JS cookie access)
SESSION_SAME_SITE (commented) lax; strict only if third-party OAuth callbacks don't need the cookie

Demo lockdown

Key Default Notes
LEADHUB_DEMO_MODE (commented, off) true only on public preview installs — blocks destructive/billing/credential actions. Leave off on real installs
LEADHUB_DEMO_PURCHASE_URL (commented) Shown on demo installs

Cache & settings

Key Default Notes
CACHE_STORE file Shared-hosting safe; redis optional
SETTINGS_CACHE_ENABLED (commented, true) Spatie settings cache; disable only to debug stale settings
SETTINGS_CACHE_MEMO (commented, true) Per-request memoization

Queue & broadcasting

Key Default Notes
QUEUE_CONNECTION database Recommended on shared hosting (see Cron & queue workers). sync runs inline (no cron needed, slower)
BROADCAST_CONNECTION log log = realtime off (safe default). pusher works on shared hosting; reverb is VPS-only
PUSHER_APP_ID/KEY/SECRET/HOST/PORT/SCHEME/APP_CLUSTER (commented) Secret if used
REVERB_APP_ID/KEY/SECRET/HOST/PORT/SCHEME (commented) VPS-only; Secret
VITE_PUSHER_* (commented) Build-time mirrors

Redis (optional)

Key Default Notes
REDIS_CLIENT predis Only if your host offers Redis
REDIS_HOST / REDIS_PORT 127.0.0.1 / 6379 Internal
REDIS_PASSWORD null Secret if set

Mail / SMTP

Key Example Mark
MAIL_MAILER smtp Internal
MAIL_SCHEME null Internal (tls/ssl only when required)
MAIL_HOST mail.yourdomain.com Internal
MAIL_PORT 587 Internal
MAIL_USERNAME noreply@yourdomain.com Secret-ish
MAIL_PASSWORD your-smtp-password Secret
MAIL_FROM_ADDRESS noreply@yourdomain.com Safe
MAIL_FROM_NAME ${APP_NAME} Safe

Without working SMTP: no invitations, digests or automated e-mails. Test from Settings after configuring — see Email & SMTP.

Filesystem

Key Default Notes
FILESYSTEM_DISK local Keep local; uploads are served via the public/storage symlink
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_DEFAULT_REGION / AWS_BUCKET / AWS_ENDPOINT / AWS_USE_PATH_STYLE_ENDPOINT (commented) Optional S3-compatible storage; keys are Secret

Security

Key Default Notes
SECURITY_ENFORCE_2FA false Set true to require 2FA for platform staff
SECURITY_MAX_LOGIN_ATTEMPTS 5 Lockout threshold
SECURITY_LOCKOUT_MINUTES 15 Lockout duration

Billing (legacy Stripe)

Key Default Notes
BILLING_ENABLED false Legacy SaaS billing switch
STRIPE_KEY / STRIPE_SECRET / STRIPE_WEBHOOK_SECRET (commented) Secret. Commercial billing (Razorpay/Cashfree) is configured in the SA panel, not here

External providers (all optional)

Key Mark Used for
META_APP_ID / META_APP_SECRET Internal / Secret Meta lead ads (platform-level; can also be set in SA → Meta Developer)
META_WEBHOOK_VERIFY_TOKEN Secret Legacy verify token fallback
META_GRAPH_VERSION Safe Graph API version pinned to avoid silent retirements (default v22.0)
TIKTOK_APP_ID / TIKTOK_APP_SECRET Internal / Secret TikTok lead source
LINKEDIN_CLIENT_ID / LINKEDIN_CLIENT_SECRET Internal / Secret LinkedIn lead source
GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET Internal / Secret Google Calendar sync — redirect URI https://your-domain/admin/calendar/oauth/callback
MICROSOFT_CLIENT_ID / MICROSOFT_CLIENT_SECRET Internal / Secret Outlook Calendar sync (same redirect URI)
OPERATOR_COUNTRY Safe ISO country for tax/VAT logic
TELEGRAM_BOT_TOKEN Secret Telegram channel
TWILIO_SID / TWILIO_TOKEN / TWILIO_FROM Secret Voice calls / SMS
VONAGE_API_KEY / VONAGE_API_SECRET Secret SMS provider
RECAPTCHA_SITE_KEY / RECAPTCHA_SECRET_KEY Safe / Secret Form anti-spam

Web push (VAPID)

Key Mark Notes
VAPID_PUBLIC_KEY Safe Generate at vapidkeys.com or Settings → Notifications
VAPID_PRIVATE_KEY Secret
VAPID_SUBJECT Safe mailto: contact

Proxies, tenancy & hardening

Key Default Notes
TRUSTED_PROXIES (commented, empty) Trust X-Forwarded-* only from these upstream proxies. Set to Cloudflare ranges / LB IPs when behind one, else lockout and audit IPs see the proxy
CENTRAL_DOMAIN yourdomain.com Multi-tenancy domain
SA_IP_ALLOWLIST (commented, empty) Optional IP/CIDR allowlist for the platform panels
SA_IP_ALLOWLIST_STRICT (commented, false) true = also check the raw TCP peer (only with no proxy in front)

AI / campaign limits & misc

Key Default Notes
LH_ASSISTANT_DAILY_CAP 100 AI assistant questions per workspace per day (0 disables)
LH_CAMPAIGN_MAX_DAILY_BUDGET 10000 Campaign-builder budget ceiling (INR)
LH_CAMPAIGN_MAX_PER_DAY 5 Draft campaigns per workspace per day
META_ADS_MOCK false Demo-only mock; never true in production
VITE_APP_NAME ${APP_NAME} Build-time label

Additional LH_* overrides (not in .env.example)

These are read by config/leadhub.php if present — useful for tuning retention and safety caps without code changes:

Key Default Meaning
LH_API_TENANT_RL_MULTIPLIER 5 Workspace rate-limit ceiling = per-key limit × this
LH_AUDIT_RETENTION_DAYS 180 Audit log retention
LH_LOGIN_ATTEMPT_RETENTION_DAYS 30 Login-attempt retention
LH_BILLING_EVENT_RETENTION_DAYS 90 Processed billing webhook ledger retention
LH_EXPORT_MAX_BYTES ~2 GB Export file size ceiling
LH_AI_SDR_TENANT_DAILY_CAP 200 AI SDR actions per workspace per day
LH_CHATBOT_DAILY_CAP_DEFAULT / LH_CHATBOT_DAILY_CAP_MAX 500 / 5000 Chatbot message caps
LH_HEALTH_UNCONTACTED_HOURS, LH_HEALTH_STALE_DAYS, LH_HEALTH_MISSED_GRACE_MINUTES, LH_HEALTH_MISSED_LOOKBACK_DAYS 2, 7, 30, 7 Lead-health / missed-call thresholds
LH_HIGH_VALUE_DEAL_THRESHOLD 25000 "High value" deal marker
LH_RESPONSE_SLA_TARGET_MINUTES, LH_RESPONSE_SLA_WINDOW_DAYS 5, 30 Response-time SLA targets
LEADHUB_REGISTRATION_ENABLED — Public self-registration toggle (platform level)
LEADHUB_DOMAIN — Alternate domain override
ONESIGNAL_APP_ID / ONESIGNAL_REST_API_KEY — OneSignal push (optional; Secret key)

Applying changes

After editing .env, clear compiled config:

php artisan optimize:clear

Without terminal access: the platform's cache healer clears stale compiled config after updates; for immediate effect, any config-affecting screen save will also re-read settings.

Never expose .env The shipped .htaccess blocks dotfiles (.env, .git) at every layer, but never copy .env into a public folder or attach it to a ticket. If a secret was ever pasted somewhere public, rotate it (APP_KEY rotation invalidates encrypted columns — restore from backup instead of rotating casually).

Common mistakes

  • APP_DEBUG=true left on after debugging.
  • Changing APP_KEY on a live install — encrypted provider credentials and sessions break.
  • Setting SESSION_SECURE_COOKIE=true before HTTPS is working (login becomes impossible).
  • Forgetting TRUSTED_PROXIES behind Cloudflare, breaking login lockout/IP allowlists.
  • Putting the hosting account database password somewhere other than .env.

Troubleshooting

Symptom Check
Changes in .env do nothing Stale config cache → php artisan optimize:clear
"No application encryption key" APP_KEY empty → php artisan key:generate (first install only)
E-mails queue but never send MAIL_* wrong and/or cron/worker not running
Login impossible after HTTPS switch SESSION_SECURE_COOKIE/APP_URL mismatch

Was this page helpful?