# Configuration

## Environment File

NixPanel stores its configuration at `/opt/nixpanel/.env`. This file is created automatically during installation but can be edited at any time.

```bash
nano /opt/nixpanel/.env
```

After editing, restart the panel:

```bash
systemctl restart nixpanel
```

---

## Environment Variables

| Variable | Description | Default |
|---|---|---|
| `RUST_LOG` | Log level (`info`, `debug`, `warn`, `error`) | `nixpanel=info,tower_http=warn` |
| `PORT` | Internal panel port | `4000` |
| `JWT_SECRET` | Secret key for session tokens (auto-generated) | — |
| `DATABASE_URL` | MariaDB connection string (auto-configured) | — |
| `SERVER_HOST` | Hostname or IP of this server | Set during install |
| `LICENSING_SERVER_URL` | URL of the NixPanel licensing server | `https://license.nixpanel.io` |
| `LICENSE_KEY_PATH` | Path to the stored license key file | `/opt/nixpanel/.license_key` |

---

## Apache

NixPanel's panels are served via Apache reverse proxy on non-standard ports so they don't interfere with hosted websites on port 80/443.

| Port | Panel |
|---|---|
| `2087` | NixServer (admin / WHM-style) |
| `2083` | NixClient (user / cPanel-style) |

Apache config: `/etc/apache2/sites-available/nixpanel.conf`

Reload Apache after changes:

```bash
apache2ctl configtest && systemctl reload apache2
```

---

## SSL

Add HTTPS to your panel ports:

```bash
certbot --apache
```

Or manually specify domains:

```bash
certbot --apache -d panel.yourdomain.com
```

---

## PHP Versions

NixPanel installs both PHP 8.2 and PHP 8.3 via the `ondrej/php` PPA. You can set the default PHP version per domain in the NixClient user panel, or globally via:

```bash
update-alternatives --config php
```

---

## MariaDB

Panel database credentials are stored in `/opt/nixpanel/.env`. The database is only accessible from `127.0.0.1` — it is not exposed externally.

To access the MariaDB console:

```bash
mysql -u nixpanel -p nixpanel
```

The password is in `/opt/nixpanel/.env` under `DATABASE_URL`.

---

## Logs

| Log | Path |
|---|---|
| Panel | `/var/log/nixpanel/panel.log` |
| Panel errors | `/var/log/nixpanel/panel-error.log` |
| Apache access | `/var/log/nixpanel/nixserver-access.log` |
| Apache errors | `/var/log/nixpanel/nixserver-error.log` |

Stream logs live:

```bash
journalctl -u nixpanel -f
tail -f /var/log/nixpanel/panel.log
```

---

## Firewall

If you use `ufw`, allow the panel ports:

```bash
ufw allow 2083/tcp   # NixClient
ufw allow 2087/tcp   # NixServer
ufw allow 80/tcp     # HTTP
ufw allow 443/tcp    # HTTPS
ufw allow 25/tcp     # SMTP
ufw allow 143/tcp    # IMAP
ufw allow 993/tcp    # IMAPS
ufw allow 110/tcp    # POP3
ufw allow 995/tcp    # POP3S
ufw allow 53         # DNS
```

For production, restrict ports 2083 and 2087 to trusted IPs only:

```bash
ufw allow from YOUR_IP to any port 2083
ufw allow from YOUR_IP to any port 2087
ufw deny 2083
ufw deny 2087
```