Documentation
Configuring by hand.
Almost everything is set in the admin. The rest — secrets, domain, database — lives in a single file, the .env, which updates never touch. Here are both, setting by setting.
In the admin: the Settings menu
Whatever changes the site's look or behaviour is set online, with no terminal and no restart.
- General — logo, favicon, admin language, site languages, and the « Clear cache » button.
- Identity and social networks — name, contact details, links to your networks.
- Fonts, Theme, Global CSS — typography, colour palette, and as a last resort a few shared CSS rules.
- Media library — images, automatically produced in five widths.
- Social logins — Google, Apple, Facebook for customer sign-in.
- Google API — the key for PageSpeed measurements.
- Email server — SMTP server, port, username, password (encrypted in the database).
- Sent emails, Cookies, Legal pages — message texts, the consent banner, legal notice, terms of use and terms of sale.
- AI agents — the accounts and tokens that let Claude drive the site.
- Update JEIKO — the installed version and one-click updates.
Stripe is set in Store › Payment methods, Google Calendar in Appointments › Google connection, course video hosting in Courses › Video hosting.
The .env file
It is the only place where one site differs from another. settings.py is identical everywhere and replaced on every update: a setting written in it would vanish at the first click on « Update ». The installer generates the .env and protects it: readable by the site's own account only.
/var/www/mysite/mysite/.env # next to settings.py, mode 0600
| Variable | Default | Role |
|---|---|---|
SECRET_KEY | generated | Django's secret key; also derives the key that encrypts secrets in the database. |
SECRET_KEY_FALLBACKS | empty | Previous keys, comma-separated, during a rotation. |
JEIKO_SALT_KEY | derived from SECRET_KEY | Salt for secret encryption. |
DEBUG | False | Never True in production. |
JEIKO_SITE_NAME | folder name | Technical name of the site. |
DOMAIN_NAME | empty | Domain served, without https://. |
JEIKO_SSL | False | HTTPS: redirect, HSTS, secure cookies. Set to True only once the certificate is in place. |
DB_NAME, DB_USER, DB_PASS | — | The site's PostgreSQL database. |
GUNICORN_SOCKET | — | Application service socket, set by the installer. |
JEIKO_LANGUAGE | fr-fr | The site's original language. |
JEIKO_TIMEZONE | Europe/Paris | Time zone: appointments, emails, logs. |
JEIKO_SANITIZE_HTML | True | Strips scripts and dangerous attributes from entered HTML. Only set to False if every editor is trusted. |
JEIKO_TRUST_X_FORWARDED_FOR | True | Reads the visitor's address passed on by Nginx. False if Gunicorn is exposed directly. |
JEIKO_AGENTS_APPELS_PAR_HEURE | 600 | Calls per hour per agent token (each agent can have its own). |
JEIKO_AGENTS_ECHECS_PAR_IP | 20 | Invalid tokens tolerated per address in fifteen minutes. |
JEIKO_UPDATE_REQUIRES_SUPERUSER | True | Restricts updates to superusers. |
JEIKO_UNVERIFIED_ACCOUNT_TTL_DAYS | 30 | Never-confirmed accounts: deleted after this delay. |
JEIKO_USER_SESSIONS_RETENTION_DAYS | 30 | Retention of session history. |
JEIKO_SECURITY_EVENTS_RETENTION_DAYS | 365 | Retention of the security log. |
Applying a change
The .env is only read when the service starts. After editing it, restart the service:
sudo nano /var/www/mysite/mysite/.env
sudo systemctl restart gunicorn-mysite
sudo systemctl status gunicorn-mysite # should say « active (running) »
Changing the SECRET_KEY
It protects sessions and encrypts the secrets stored in the database — Stripe keys, SMTP password, provider credentials. Changing it carelessly makes those secrets unreadable.
SECRET_KEY="new-key"
SECRET_KEY_FALLBACKS="old-key"
# restart, re-save the screens concerned (Stripe, Email server…),
# then remove the old key and restart again
If a duration value is unreadable, the site still starts: purges fall back to their default.