SCAD Maps.Log inRequest a demo

Instance configuration

The settings an operator can change per instance, with defaults, and what each one affects.

Each SCAD Maps instance is configured through environment settings that the operator sets when the instance is deployed. Nothing here is visible to event staff, and nearly every setting has a sensible default, so a working instance needs only the few required values. This page lists what an operator can change, the default, and what each setting affects. Settings are read when the server starts, so a change applies after a restart.

Required#

SettingPurpose
DATABASE_URLConnection string of the PostgreSQL database.
JWT_ACCESS_SECRETSigns short-lived access tokens. Use a long random value and keep it private.
JWT_REFRESH_SECRETSigns long-lived refresh tokens. Must differ from the access secret.
CORS_ORIGINThe public address of the instance. Browsers from other origins are refused.

Optionally, REDIS_URL points to a Redis server. It carries the live-connection fan-out and the short-lived location store; without it the live layer runs without a shared adapter, which is fine for a single server.

First administrator#

SettingDefaultPurpose
ADMIN_EMAIL, ADMIN_USERNAME, ADMIN_PASSWORDunsetCreates or refreshes the bootstrap administrator at each start. Username and access level are synced every time.
ADMIN_FORCE_PASSWORD_RESEToffSet to 1 for a single start to overwrite the stored password with ADMIN_PASSWORD. Remove it afterwards.

Sign-in and sessions#

SettingDefaultPurpose
JWT_ACCESS_EXPIRES_IN15mLifetime of an access token. The app refreshes it in the background.
JWT_REFRESH_EXPIRES_IN7dHow long a device stays signed in without using the app.
SELF_SIGNUP_ENABLEDoffAllows people to request an account from a QR code or link. Requests wait for approval; see Invites and access requests.
LOGIN_IDENTIFIER_RATE_MAX8Sign-in attempts allowed per username or email within the window.
LOGIN_IP_RATE_MAX300Sign-in attempts allowed per network address within the window.
LOGIN_RATE_WINDOW_SECONDS900Length of that window.
COOKIE_SECUREonCookies require HTTPS. Set to 0 only for local testing over plain HTTP.
TRUST_PROXY1Number of reverse proxies in front of the server, used to read the visitor's real address.

Single sign-on#

SettingPurpose
OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_REDIRECT_URITurn on single sign-on with an OpenID Connect provider. See Single sign-on.
INSTANCE_NAMEIdentifies the instance when matching provider groups to access levels.
OIDC_ONLYSet to true to send visitors straight to the provider.
SSO_REVOKE_SECRETShared secret that lets the organiser's portal end a person's sessions immediately. Without it, the 24-hour session cap applies.

Interface#

SettingDefaultPurpose
UI_MODE_DEFAULTclassicSet to desk to make the newer Field Desk layout the default for devices that have not chosen. A device's own choice always wins. See Settings and account.

Live location#

SettingDefaultPurpose
LOCATION_BATCH_MS500How often position updates are grouped and sent. Lower is more live and costs more traffic.
LOCATION_BATCH_MAX2000Most positions sent in one group; an oversized group is spread over the next rounds.
LOCATION_TTL_SECONDS600How long a position is remembered after the last update.
LOCATION_GEOHASH_PRECISION6Size of the map cells used to decide who receives whose position.
LOCATION_GLOBALoffSet to 1 to share every position with every signed-in non-guest, regardless of the viewport.

Uploads and retention#

SettingDefaultPurpose
UPLOAD_MAX_BYTES2 MBLargest photo.
UPLOAD_MAX_DOC_BYTES10 MBLargest document.
UPLOAD_MAX_AUDIO_BYTES1 MBLargest voice note.
UPLOAD_USER_QUOTA_BYTES50 MBStorage budget per person.
UPLOAD_INSTANCE_CAP_BYTES300 MBOverall storage cap for the instance.
UPLOAD_MAX_PER_ENTITY6Files on one note or task. Chat messages allow 4 (UPLOAD_CHAT_MAX_PER_ENTITY).
UPLOAD_WEBP_QUALITY82Quality used when every photo is re-encoded to WebP on upload.
VOICE_RETENTION_MS7 daysHow long the audio of a voice note is kept.
ACTIVITY_RETENTION_DAYS90How long the activity history is kept.
EXPORT_MAX_WINDOW_MS2 yearsLongest date range one data export may cover.
EXPORT_MAX_PHOTOS2000Most photos bundled into one export.

Rate limits#

SettingDefaultPurpose
RATE_LIMIT_MAX600Requests per network address per window for the API. Map tiles and images are exempt.
RATE_LIMIT_WINDOW_MINUTES1Length of that window.
USER_WRITE_RATE_MAX60Creates, edits and deletes per person per minute. Admins are exempt.
CHAT_WRITE_RATE_MAX40Chat messages per person per window.
UPLOAD_RATE_MAX40Uploads per person per window (300 seconds by default).

Incident escalation and reminders#

SettingDefaultPurpose
MAX_ESCALATION_LEVEL3Highest tier an overdue incident is escalated to.
ESCALATION_SWEEP_MS30 secondsHow often overdue items are checked.
DUE_REMINDER_LEAD_MIN60How many minutes before its due time a task triggers a reminder push. Reminders only work when web push is configured.

Push notifications#

SettingPurpose
VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY, VAPID_SUBJECTTurn on web push. Without them notifications are simply inactive. Generate the key pair once and keep it. VAPID_SUBJECT is a contact address written as mailto:.
FCM_SERVICE_ACCOUNTFirebase service account (a file path or the JSON itself) for push to the native Android app.
MAIL_RELAY_URL, MAIL_RELAY_SECRETWhere password-reset, invitation and approval emails are sent through; PUBLIC_URL, the instance's public address, is needed too. Without a relay those emails are not sent.

Optional features#

SettingDefaultFeature
WEATHER_RADAR_ENABLEDoffRain radar. RADAR_SOURCE chooses knmi (default) or meteoplaza; RADAR_MENU_SOURCES lists which sources get a switch. KNMI_WMS_API_KEY raises the rate limit of the open KNMI service. See Rain radar.
EYON_INTEGRATION_ENABLEDoffMachinery GPS tracking. MACHINE_POLL_MS sets how often the provider is asked (15 seconds). See Machinery tracking.
MONDAY_INTEGRATION_ENABLEDoffShows the monday.com tab from the start; it also appears by itself once a connection exists. MONDAY_SYNC_ENABLED is a global pause switch. MONDAY_TOKEN_ENC_KEY is a 64-character hex key that encrypts the stored token. MONDAY_FILE_MAX_MB caps synced files (25). See monday.com.
DROPBOX_PANORAMAS_ENABLEDoff360 photos from Dropbox. DROPBOX_PANORAMA_MAX_MB sets the largest viewable photo (160). DROPBOX_TOKEN_ENC_KEY is an optional dedicated encryption key. See 360 photos.
POWERZONES_ENABLEDoffImport and display of power-distribution zones as a special kind of area.

Where map data lives#

Venue tiles, images, 3D models and layer overrides sit in folders that are mounted into the server: the tile folder, the image and upload folder, and the models folder. They are separate from the database, so a backup has to cover both. The steps for adding a venue are in Venue maps.

Something missing or unclear? Email info@anivizzion.nl.