Configuration¶

Environment Variables¶

Many kora settings can be customized using environment variables. You can define these variables in your environment (for example, in a .env file) to modify kora’s core behavior.

Example of an environment configuration file:

ALLOWED_HOSTS='localhost 127.0.0.1'
CSRF_TRUSTED_ORIGINS='http://localhost:8000 http://127.0.0.1:8000'

NGINX_PORT=8000
NGINX_HOST=localhost

DB_HOST=db
DB_USER=kora
DB_NAME=kora
DB_PORT=5432
DB_PASSWORD=kora_changeme_insecure

SECRET_KEY='kora_insecure_u&(t17%=gm5$kg#1mm562q#3(8mrrlb0!2bg75(z5k(!62l+bf'

You can edit the .env file in the kora directory to alter some settings. There can be different types of setting:

Booleans. For boolean variables (true/false or yes/no), the following values will enable the setting: true, yes, 1, oR on. Any other value will be treated as false, and disable the feature. For example:

MY_SETTING='true'

Lists. Lists are used to supply multiple values to a single setting and should be specified as space-separated values. For example:

MY_OTHER_SETTING='value1 value2 value3'

Strings. Used for plain text values. Strings should generally be enclosed in single quotes to preserve spaces and special characters. For example:

STRING_SETTING='My Application'

Numbers. Generally, these values are specified without quotes for clarity, but quoting is allowed. For example:

NUMBER_SETTING=8080
ANOTHER_NUMBER_SETTING=0.75

Environment variable values should generally be quoted using single quotes (see examples) to prevent interpretation by the shell, especially when values contain spaces, wildcards, or special characters.

When to use quotes:

Lists: Values are space-separated within the quotes.
Booleans: Quotes are optional but recommended for clarity.
Strings with special characters: Such as *, &, ?, etc.

When in doubt, use quotes.

Note

The following code snippets show the default values.

Django¶

DEV¶: Boolean. Indicates whether the application is running in development mode. When set to false (the default), the application runs in production mode, which disables debugging features and enables performance improvements. Use true only during development or troubleshooting.

DEV='false'

SECRET_KEY¶: String (mandatory). A secret key used by Django for security purposes such as sessions and password resets. This key should be unique and kept private to protect your application. See SECRET_KEY.

SECRET_KEY='foo'

ALLOWED_HOSTS¶: List (mandatory). Specifies the host/domain names that Django considers valid for serving the application. Requests with a Host header not matching an entry in this list will be blocked. Failing to set ALLOWED_HOSTS properly may result in “Bad Request (400)” errors when accessing the application. It is automatically generated during the initial setup. See ALLOWED_HOSTS.

ALLOWED_HOSTS='web'
# Example configuration for a local network deployment
ALLOWED_HOSTS='web localhost 192.168.1.50'

CSRF_TRUSTED_ORIGINS¶: List of URLs. These are trusted addresses allowed to submit forms or requests to Django. See Cross Site Request Forgery protection.

CSRF_TRUSTED_ORIGINS='http://localhost:8002/* http://web'

# Example configuration for a typical LAN install might look like this:
CSRF_TRUSTED_ORIGINS='http://localhost:8002/* http://web http://192.168.1.50:8002'

Postgres¶

DB_PASSWORD¶: String. Password for the PostgreSQL database administrator. It is automatically generated during the initial setup.

DB_PASSWORD='super-secure'

DB_NAME¶: String. The name of the database used by kora. Defaults to kora when not set.

DB_HOST='db'

DB_HOST¶: String. The name of the database host or service.

DB_HOST='db'

DB_PORT¶: Number. The port on which the PostgreSQL database is listening inside the container.

DB_PORT=5432

Site Visibility¶

PUBLIC¶

Boolean. Setting this to true allows the following sections to be accessible without logging in:

Register > Species, Varieties, and Protections
Describe > Descriptions, Protocols, and Entities

PUBLIC='false'

Auditing Interaction¶

(Provided by the third-party django-easy-audit module). The following environment variables enable logging of CRUD operations, user access, and page views.

DJANGO_EASY_AUDIT_WATCH_AUTH_EVENTS¶: Boolean. Determines whether to log user authentication events such as logins, logouts, and failed login attempts.

DJANGO_EASY_AUDIT_WATCH_AUTH_EVENTS='false'

DJANGO_EASY_AUDIT_WATCH_REQUEST_EVENTS¶: Boolean. Determines whether to log URL requests made by users, i.e., which pages they visit.

DJANGO_EASY_AUDIT_WATCH_REQUEST_EVENTS='false'

DJANGO_EASY_AUDIT_WATCH_MODEL_EVENTS¶: Boolean. Determines whether to log when objects are created, updated, or deleted.

DJANGO_EASY_AUDIT_WATCH_MODEL_EVENTS='true'

DJANGO_EASY_AUDIT_UNREGISTERED_CLASSES_EXTRA¶: List. Specifies models whose CRUD operations should not be logged.

DJANGO_EASY_AUDIT_UNREGISTERED_CLASSES_EXTRA='auth.group'

nginx settings¶

NGINX_PORT¶: Number. The port on your computer where the web server listens for incoming requests.

NGINX_PORT=8000

Note

The provided defaults are recommended for most users and setups. Docker Compose creates a private network allowing containers to communicate using these defaults without exposing services unnecessarily.

Security¶

AUTHLOG_ENABLED¶: Boolean. Wether failed authentication logging is enabled.

AUTHLOG_ENABLED=1

AUTHLOG_FILE_PATH¶: String. The absolute path to the failed authentication logging file.

AUTHLOG_FILE_PATH= "/var/log/kora/auth.log"