Shelf should be configured for asset tracking accuracy and QR workflow reliability. Proper configuration is essential for optimal performance and security.
Shelf relies on Supabase for authentication and database services. The following environment variables are required:
# Supabase Configuration
DATABASE_URL=postgres://postgres:[YOUR-PASSWORD]@[YOUR-PROJECT-ID].supabase.co:6543/postgres
DIRECT_URL=postgres://postgres:[YOUR-PASSWORD]@[YOUR-PROJECT-ID].supabase.co:5432/postgres
SUPABASE_ANON_PUBLIC=[YOUR-ANON-PUBLIC-KEY]
SUPABASE_SERVICE_ROLE=[YOUR-SERVICE-ROLE-KEY]
SUPABASE_URL=https://[YOUR-PROJECT-ID].supabase.co
# Application Configuration
SERVER_URL=https://shelf.yourdomain.com
SESSION_SECRET=generate-a-very-secure-random-string-here
INVITE_TOKEN_SECRET=generate-another-very-secure-random-string-here
# Optional Features
MAPTILER_TOKEN=[YOUR-MAPTILER-TOKEN-FOR-GPS-FEATURES]
SMTP_HOST=smtp.yourdomain.com
SMTP_PORT=587
SMTP_USER=noreply@yourdomain.com
SMTP_FROM="Shelf Notifications <noreply@yourdomain.com>"
SMTP_PWD=[YOUR-SMTP-PASSWORD]
SMTP_SECURE=false # Set to true for port 465, false for ports 587/25
- Restrict asset status and ownership change permissions based on user roles
- Define check-in checkout rules and audit requirements
- Protect label generation and export endpoints with appropriate permissions
- Configure secure session policies and timeouts
- Set up proper caching mechanisms for media files
- Configure CDN for static assets if available
- Optimize database connection pooling
- Monitor mobile scanning and sync latency
- Configure SMTP settings for email notifications
- Set up webhook endpoints for external integrations
- Define notification preferences for different user roles
- Configure reminder schedules for overdue assets
- Sequential IDs: Enable sequential asset IDs for better organization
- QR Code Customization: Configure QR code appearance and content
- Barcode Support: Enable EAN-13 and other barcode formats
- Asset Valuation: Set up currency and valuation tracking
¶ Workspace and User Management
- Role-Based Access Control: Define permissions for different user roles
- Workspace Isolation: Configure data separation between workspaces
- Single Sign-On (SSO): Integrate with Google/Microsoft accounts
- User Provisioning: Automate user creation and deactivation
- API Rate Limits: Configure API throttling to prevent abuse
- External Storage: Connect to cloud storage providers for media files
- Backup Destinations: Set up automated backup locations
- Monitoring Endpoints: Configure health check URLs
¶ Backup and Recovery
- Supabase database (using Supabase backup features)
- Uploaded files and media assets (
/public/media directory)
- Configuration files and environment variables
- SSL certificates and security keys
- Regularly test restoration of database backups
- Verify user login functionality after restoration
- Test core business transactions (asset check-in/check-out)
- Validate report and export functionality
¶ Monitoring and Maintenance
# Production-specific settings
NODE_ENV=production
LOG_LEVEL=info
MAX_REQUEST_SIZE=10mb
ENABLE_TELEMETRY=false # Set to true to help improve Shelf
TRUST_PROXY_HEADERS=true # Set to true if behind a reverse proxy
- Use a load balancer for multiple instances
- Implement Redis for session storage if scaling horizontally
- Consider CDN for static assets in global deployments
- Plan for database scaling based on asset volume
Any questions?
Feel free to contact us. Find all contact information on our contact page.