Configuration

Environment variables and panel settings.

Environment variables

Set in /opt/zefira/.env (installer-managed, mode 600) or exported before start:

Variable	Default	Purpose
`ZEFIRA_ADMIN_USERNAME`	`admin`	First-run admin (lowercased, validated)
`ZEFIRA_ADMIN_PASSWORD`	random	First-run password (random if empty)
`ZEFIRA_DOMAIN`	—	Public domain baked into configs & links
`ZEFIRA_PORT`	`8000`	Panel listen port (systemd unit)
`ZEFIRA_SUB_PORT`	`443`	Port in VLESS/VMess/Trojan/SS links
`ZEFIRA_HY2_PORT`	`8443`	Port in Hysteria2 links
`ZEFIRA_WG_PORT`	`51820`	WireGuard endpoint port
`ZEFIRA_DNS`	`1.1.1.1`	DNS in WireGuard configs
`ZEFIRA_OVPN_PORT` / `ZEFIRA_OVPN_PROTO`	`1194` / `udp`	OpenVPN endpoint
`DATABASE_URL`	SQLite	`mysql+pymysql://…` or `postgresql+psycopg2://…`
`SUBSCRIPTION_PATH`	`/sub`	Subscription URL prefix
`ZEFIRA_SESSION_TTL`	`28800`	Login session lifetime (seconds, 8h)
`ZEFIRA_TRUSTED_PROXIES`	empty	CIDRs allowed to send `X-Forwarded-For`
`TG_BOT_TOKEN` / `TG_CHAT_ID`	empty	Telegram notifications

Panel settings

Settings → Server / Hosts edits domain, ports, DNS, WireGuard public key, REALITY SNI list, obfuscation and CDN options live (no restart). Settings → Tunnel sets the public URL and trusted proxies — the latter decides whose X-Forwarded-For is believed for rate limiting and audit logs.

HTTPS / SSL

During install (step 7): Nginx reverse proxy + Let's Encrypt with auto-renew cron.
From the panel (Settings → SSL): issue or renew a certificate for domain or sub.domain — standalone HTTP-01 on port 80, expiry shown in the panel.

Behind Nginx the panel honors X-Forwarded-Proto from localhost/trusted proxies, so cookies get the Secure flag and HSTS is emitted.

Data locations

Path	Content
`/opt/zefira/.env`	Secrets (600)
`/opt/zefira/instance/zefira.db`	SQLite database (600)
`/opt/zefira/instance/secret.key`	JWT + encryption master key (600) — lose it and encrypted secrets become unreadable
`/opt/zefira/instance/ca.key` / `ca.crt`	OpenVPN certificate authority