Environment Variables
Each service has its own .env.local file. The one-click installer generates these
automatically; you only edit them for advanced configuration.
medusa-backend (/opt/carphacom/current/medusa-backend/.env)
| Variable | Required | Notes |
|---|---|---|
| DATABASE_URL | yes | postgres://medusa:<pass>@localhost:5432/medusa_store |
| REDIS_URL | yes | redis://:<pass>@localhost:6379 |
| JWT_SECRET | yes | 64-char random hex; rotates require re-login |
| COOKIE_SECRET | yes | 64-char random hex |
| STORE_CORS | yes | Comma-separated list, e.g. https://shop.example.com |
| ADMIN_CORS | yes | Same as above for admin |
| AUTH_CORS | yes | Same |
| MEDUSA_BACKEND_URL | yes | Public URL of the backend (https://shop.example.com) |
| WORKER_MODE | optional | shared (default), worker, or server for split deployments |
| CARPHACOM_INSTANCE_ID | yes | Generated at install; do not change |
| CARPHACOM_MARKETPLACE_URL | optional | Override marketplace URL (default https://carphacom.com) |
| SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS | optional | For transactional email |
admin-panel (/opt/carphacom/current/admin-panel/.env.local)
| Variable | Required | Notes |
|---|---|---|
| MEDUSA_BACKEND_URL | yes | http://127.0.0.1:9000 (local, not public) |
| NEXT_PUBLIC_MEDUSA_BACKEND_URL | yes | Public URL of backend |
| DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD | yes | Postgres for custom admin auth tables |
| CARPHACOM_FEDERATION_URL | optional | For tenants federating from a central marketplace |
| CARPHACOM_FEDERATION_PK | optional | Publishable key for federation reads |
nextjs-storefront (/opt/carphacom/current/nextjs-storefront/.env.local)
| Variable | Required | Notes |
|---|---|---|
| NEXT_PUBLIC_MEDUSA_BACKEND_URL | yes | Public backend URL |
| MEDUSA_BACKEND_URL | yes | http://127.0.0.1:9000 for SSR |
| NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY | yes | pk_... from /admin/publishable-api-keys |
| NEXT_PUBLIC_BASE_URL | yes | Public storefront URL |
| NEXT_PUBLIC_DEFAULT_REGION | yes | Lowercase ISO country (e.g. ro) |
| REVALIDATE_SECRET | yes | Random 48-char hex; required to trigger ISR revalidation |
| DATABASE_URL, DATABASE_PASSWORD | yes | For storefront to read CMS plugin/theme data |
Applying changes
After editing any .env.local you must:
pm2 restart all --update-env
pm2 save
--update-env is critical — without it PM2 keeps the old environment.
Generating secrets
openssl rand -hex 32 # for 64-char hex secrets
openssl rand -hex 24 # for 48-char hex secrets
Multi-tenant federation
For tenant instances pointing to a central marketplace:
CARPHACOM_FEDERATION_URL=https://carphacom.com
CARPHACOM_FEDERATION_PK=pk_<the central instance's publishable key>
Without these, the marketplace tab in admin shows local plugins only.