Configuration Reference

Look up every setting pfSense Actions reads, its default, when it takes effect, and how it's validated.

How Settings Apply

• Every start — PORT, DATA_DIRECTORY, ADMIN_WEBAUTHN_RP_NAME, LOG_LEVEL, and LOG_TIME take effect each time the service starts.
• Only when nothing is saved — The deprecated PFSENSE_* values are bootstrap values. They fill the controller database only while nothing of their kind is saved yet, and the service still validates them at every start.
• Empty values — An empty string counts as unset, and every variable can be left empty.

API Environment Variables

These go in apps/api/.env for a source run. For Docker, add them under environment in compose.yml.

• pfSense Actions works out its public address from each request, so there's no setting for it. Passkeys are tied to the hostname they were added on, as described in HTTPS Reverse Proxy.

Deprecated Variables

These still work, but the console replaces them, so it's recommended to leave them unset.

• PFSENSE_* — When they're set and no connection is saved yet, or its password or private key was removed, pfSense Actions imports them as the connection on its next start, without testing them. Change the connection on the pfSense Connection page instead.
• Warnings — Every start logs a WARN line while any of them is set, saying whether it was imported or ignored.
• Removal — A later major version may stop reading them.

Set PFSENSE_SSH_IP, PFSENSE_USERNAME, and PFSENSE_PASSWORD or PFSENSE_PRIVATE_KEY together, or leave all of them empty, because partial values stop the service from starting.

Compose and Container Variables

The root .env file sets these values for compose.yml, and every one is optional.

• The container sets DATA_DIRECTORY to /data, PORT to 22603, and NODE_ENV to production.
• The root .env also has NODE_ENV, LOG_LEVEL, and LOG_TIME from its sample, but Compose doesn't pass them into the container.
• The Compose file turns on IPv6 for the container's network, so the rate limits and the sign-in limit count each IPv6 client by its own address. Docker Engine 27 or later picks the IPv6 subnet on its own, and on a host without IPv6, you can delete the networks block. IPv6 addresses are often reachable from the internet, so it's recommended to check that your router or host firewall blocks inbound connections to the port.

Encryption Key

pfSense Actions keeps its encryption key in keys/installation.key in the data folder, which is /data/keys/installation.key in the container, and generates it there on the first start.

Backup and Recovery covers a missing key file and one that doesn't match.

npm Scripts

Limits