Environment Variables

Baan uses environment variables for secrets and platform credentials that vary between environments (local, staging, production). Application settings such as site title, language, theme, users, and model assignments live in the database. For self-hosted setups, put secrets in a .env file in the project root. For Vercel, set them in Project → Settings → Environment Variables.

Env File Conventions

Baan follows standard Next.js env file loading. Use each file for its intended purpose:

File	Purpose	Priority
`.env`	Production / shared settings — place on your server or in Docker	Base
`.env.local`	Local development overrides — only values that differ from `.env`	Highest (overrides `.env`)
`.env.test`	Test environment — used by Vitest / Playwright, not auto-loaded by Next.js	Test only

All .env* files are git-ignored except .env.example and .env.test.example.

A minimal .env for local development is empty — Baan uses SQLite (data/app.db) by default and the setup wizard handles the rest, including storage provider selection.

Application Settings — Not Env Vars

The admin URL path, user accounts, site title, theme, language, build strategy, AI model assignments, and other application-level settings are stored in the database, not in env files.

Both self-hosted and Vercel deployments use the same setup wizard at /baan-admin/setup to write these values into the settings and users tables. Nothing related to the admin path or users belongs in .env.

This file documents only the secrets and platform credentials that must live outside the database — storage credentials, AI API keys, and the database connection itself.

Database

Variable	Required	Default	Description
`DATABASE_URL`	Vercel only	`file:data/app.db`	libSQL connection URL. For Turso: `libsql://your-db.turso.io`. For local SQLite: `file:data/app.db` (default, no need to set).
`DATABASE_AUTH_TOKEN`	Vercel only	—	Auth token for Turso cloud databases. Not needed for local SQLite.

Self-hosted Baan uses SQLite at data/app.db by default — no database setup required. The database file is created and migrated automatically on first startup.

To use a different path or a Turso cloud database, set DATABASE_URL explicitly:

# Custom SQLite path
DATABASE_URL=file:data/myapp.db

# Turso cloud (required for Vercel)
DATABASE_URL=libsql://your-db.turso.io

Vercel requires Turso because the file system is read-only.

Storage

The storage provider type (local, GCS, S3, or R2) is configured via the setup wizard and stored in the database — no environment variable needed. Only the credentials for your chosen provider are required.

Local

No environment variables needed. Files are stored in the content/ directory. Not available on Vercel.

Google Cloud Storage

GOOGLE_CLOUD_PROJECT_ID=your-project-id
GCS_BUCKET_NAME=your-bucket-name
GOOGLE_CLOUD_CREDENTIALS_BASE64=base64-encoded-service-account-json

Variable	Description
`GOOGLE_CLOUD_PROJECT_ID`	GCP project ID (visible in the GCP console header)
`GCS_BUCKET_NAME`	Name of the GCS bucket
`GOOGLE_CLOUD_CREDENTIALS_BASE64`	Base64-encoded service account JSON key. Generate with: `base64 -i service-account.json \| tr -d '\n'`

Amazon S3

AWS_REGION=ap-northeast-1
AWS_S3_BUCKET_NAME=your-bucket-name
AWS_ACCESS_KEY_ID=your-access-key
AWS_SECRET_ACCESS_KEY=your-secret-key

Variable	Description
`AWS_REGION`	Region where the bucket lives (e.g. `us-east-1`, `ap-northeast-1`)
`AWS_S3_BUCKET_NAME`	Name of the S3 bucket
`AWS_ACCESS_KEY_ID`	IAM user access key with S3 permissions
`AWS_SECRET_ACCESS_KEY`	IAM user secret key

Cloudflare R2

CF_ACCOUNT_ID=your-cloudflare-account-id
CF_R2_BUCKET_NAME=your-bucket-name
CF_R2_ACCESS_KEY_ID=your-api-token-key-id
CF_R2_SECRET_ACCESS_KEY=your-api-token-secret

Variable	Description
`CF_ACCOUNT_ID`	Cloudflare account ID (shown in the right sidebar of the Cloudflare dashboard)
`CF_R2_BUCKET_NAME`	Name of the R2 bucket
`CF_R2_ACCESS_KEY_ID`	R2 API token key ID
`CF_R2_SECRET_ACCESS_KEY`	R2 API token secret

AI Providers

AI API keys are read from environment variables. In self-hosted setups, put them in .env or the process environment. In Vercel, set them in Project Settings. Admin → Settings → AI lets you select the active provider and per-feature model assignments; it does not persist API keys to the database.

Variable	Description
`ANTHROPIC_API_KEY`	Anthropic API key for Claude models (`sk-ant-...`)
`OPENAI_API_KEY`	OpenAI API key (`sk-...`)
`GEMINI_API_KEY`	Google AI Studio API key (`AI...`)

All three are optional — only set the keys for providers you intend to use.

Runtime

Variable	Set by	Description
`NODE_ENV`	You / platform	`development` or `production`. Affects logging verbosity and error display.
`PORT`	You / platform	Port the server listens on. Default: `3000`.
`VERCEL`	Vercel automatically	Set to `1` by Vercel. Baan uses this to detect serverless behavior; storage and database providers still require setup/credentials. Do not set manually.

Full Example `.env`

A complete example for a self-hosted Docker deployment using S3:

# Storage (provider is configured via Admin → Setup — only credentials needed here)
AWS_REGION=ap-northeast-1
AWS_S3_BUCKET_NAME=my-blog-content
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=...

# AI (optional — can also be set from admin panel)
ANTHROPIC_API_KEY=sk-ant-...

# Runtime
NODE_ENV=production
PORT=3000

For Vercel, also add:

DATABASE_URL=libsql://my-blog.turso.io
DATABASE_AUTH_TOKEN=...

The admin path and user accounts are written to Turso by the setup wizard on first deploy — they do not belong in env vars.

`.env.example`

The repository includes a .env.example with all variables and inline comments:

cp .env.example .env

Edit .env and fill in the values for your environment before running npm run dev or docker compose up.