Configuration

Environment Files

Symfony loads environment files in this order (later files override earlier ones):

.env — committed defaults and documentation
.env.local — your local overrides (gitignored)
.env.{APP_ENV} — environment-specific defaults (e.g., .env.test)
.env.{APP_ENV}.local — environment-specific local overrides

Real environment variables (set in your shell or Docker) always win over .env files.

Never commit secrets. Put all real credentials in .env.local or set them as environment variables in your deployment platform.

Environment Variables

Core

Variable	Description	Example
`APP_ENV`	Symfony environment	`dev`, `test`, `prod`
`APP_SECRET`	Symfony secret (CSRF, signing)	Random 32+ char string
`DATABASE_URL`	PostgreSQL connection string	`postgresql://app:pass@database:5432/app?serverVersion=16&charset=utf8`
`MESSENGER_TRANSPORT_DSN`	Message transport	`sync://` (dev) or `redis://redis:6379/messages`
`DEFAULT_URI`	Base URL for console route generation	`http://localhost`
`JWT_PASSPHRASE`	Passphrase for JWT key pair	Random string
`CORS_ALLOW_ORIGIN`	Allowed CORS origins (regex)	`^https?://(localhost\|127\.0\.0\.1)(:[0-9]+)?$`

Email / Brevo

Variable	Description	Example
`EMAIL_SENDER_EMAIL`	From address for all emails	`noreply@yourdomain.com`
`EMAIL_SENDER_NAME`	From name for all emails	`Your App Name`
`MAILER_DSN`	Symfony Mailer transport	`smtp://mailer:1025` (dev)
`BREVO_API_KEY`	Brevo API key (production emails)	`xkeysib-...`

In development, emails go to Mailpit at http://localhost:8025. In production, emails are sent via the Brevo API.

Stripe

Variable	Description	Example
`STRIPE_SECRET_KEY`	Stripe API secret key	`sk_test_...` or `sk_live_...`
`STRIPE_WEBHOOK_SECRET`	Stripe webhook signing secret	`whsec_...`
`STRIPE_SUCCESS_URL`	Redirect after successful payment	`https://yourapp.com/payment/success`
`STRIPE_CANCEL_URL`	Redirect after cancelled payment	`https://yourapp.com/payment/cancel`

Firebase

Variable	Description	Example
`FIREBASE_PROJECT_ID`	Firebase project ID	`my-app-12345`

Frontend URLs

Variable	Description	Example
`EMAIL_VALIDATION_REDIRECT_URL`	Where users land after email validation	`https://yourapp.com/auth/email-verified`
`FRONTEND_RESET_PASSWORD_URL`	Frontend password reset form	`https://yourapp.com/auth/reset-password`

Dokploy (Deployment)

Variable	Description	Example
`DOKPLOY_URL`	Dokploy instance URL	`https://your-dokploy.com`
`DOKPLOY_TOKEN`	Dokploy API token	Your Dokploy auth token

Config Files

Stripe Plans {#stripe-plans}

Defined in config/packages/stripe.yaml.

Defines your plan tiers. Supports both one-time and recurring payment models:

parameters:
    stripe_plans:
        # One-time (lifetime) plans
        starter:
            name: 'Starter Plan'
            type: 'one_time'
            price_cents: 4900          # $49.00
        pro:
            name: 'Pro Plan'
            type: 'one_time'
            price_cents: 14900         # $149.00

        # OR recurring plans (uncomment to switch)
        # starter:
        #     name: 'Starter Plan'
        #     type: 'recurring'
        #     monthly_price_cents: 900   # $9.00/mo
        #     yearly_price_cents: 9000   # $90.00/yr
        # pro:
        #     name: 'Pro Plan'
        #     type: 'recurring'
        #     monthly_price_cents: 2900
        #     yearly_price_cents: 29000

After changing plan definitions, sync to Stripe:

docker compose exec php bin/console app:stripe:sync-plans

Brevo Email Templates {#brevo-email-templates}

Defined in config/packages/brevo.yaml.

Maps Brevo template IDs to email types:

parameters:
    brevo_api_key: '%env(BREVO_API_KEY)%'
    brevo_sender_email: '%env(EMAIL_SENDER_EMAIL)%'
    brevo_sender_name: '%env(EMAIL_SENDER_NAME)%'
    brevo_template_welcome: 1
    brevo_template_password_changed: 2
    brevo_template_password_reset: 3

Each template receives specific variables:

Template	ID	Variables
Welcome	1	`userName`, `validationLink`
Password Changed	2	`userName`
Password Reset	3	`userName`, `resetLink`

Create these templates in your Brevo dashboard and update the IDs accordingly.

Rate Limiting {#rate-limiting}

Defined in config/packages/rate_limiter.yaml.

Limiter	Limit	Window	Scope
`auth_signup_ip`	5	15 minutes	IP
`auth_signup_email`	3	15 minutes	Email
`auth_login_ip`	5	15 minutes	IP
`auth_login_email`	5	15 minutes	Email
`auth_logout`	10	1 minute	IP

JWT — `config/packages/lexik_jwt_authentication.yaml`

Setting	Value
Access token TTL	3600s (1 hour)
Refresh token TTL	2592000s (30 days)
Refresh token	Single-use (rotated on each refresh)

CORS — `config/packages/nelmio_cors.yaml`

Setting	Value
Allowed origins	Regex from `CORS_ALLOW_ORIGIN` env var
Allowed methods	GET, OPTIONS, POST, PUT, PATCH, DELETE
Allowed headers	Content-Type, Authorization
Max age	3600s