Configuration

Statalog is configured via environment variables in the .env file at the project root. After making changes, clear the config cache with php artisan config:clear and restart your queue workers with php artisan queue:restart.

Application

APP_NAME=Statalog
APP_ENV=production
APP_KEY=base64:...           # Generated by php artisan key:generate — do not change once set
APP_DEBUG=false              # Never set to true in production
APP_URL=https://your-domain.com
APP_TIMEZONE=UTC             # Server timezone; individual site timezones are set in the UI

APP_URL must be the exact public URL of your installation, including the protocol and without a trailing slash. It is used to construct URLs in emails, the tracking snippet, and API responses.

APP_TIMEZONE controls PHP's default timezone and affects the scheduler. It does not affect how pageviews are bucketed into days — that is controlled per-site in the UI.

MySQL database

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=statalog
DB_USERNAME=statalog
DB_PASSWORD=your-secure-password

MySQL 8.0+ or MariaDB 10.6+ is required. Ensure the database uses the utf8mb4 character set.

Redis

REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_PASSWORD=null          # Set if your Redis instance requires authentication
REDIS_DB=0

CACHE_DRIVER=redis
SESSION_DRIVER=redis
QUEUE_CONNECTION=redis       # Use redis for production — not sync or database

Redis is used for caching, session storage, and the job queue. Using QUEUE_CONNECTION=redis with Supervisor workers (see Installation) is strongly recommended for production. The sync driver processes jobs inline and will slow down page tracking requests.

ClickHouse

STATALOG_CLICKHOUSE_HOST=127.0.0.1
STATALOG_CLICKHOUSE_PORT=8123        # HTTP interface (default); use 8443 for HTTPS
STATALOG_CLICKHOUSE_DB=statalog
STATALOG_CLICKHOUSE_USER=statalog
STATALOG_CLICKHOUSE_PASSWORD=your-clickhouse-password

Port 8123 is ClickHouse's HTTP interface, which Statalog uses for queries. Ensure this port is not publicly accessible — bind it to 127.0.0.1 in your ClickHouse configuration. See ClickHouse setup for the full ClickHouse configuration guide.

API key

STATALOG_API_KEY=your-secret-key

This is the single REST API key for the Community edition. All API requests must present this key either as a Bearer token or as the api_key query parameter. Use a cryptographically random value of at least 32 characters. Generate one with:

openssl rand -hex 32

There is no UI to rotate this key — update it in .env, then run php artisan config:clear and restart your web server process. Any scripts using the old key must be updated immediately.

Edition

STATALOG_EDITION=community

This must be set to community for self-hosted installations. It disables Cloud-only features such as team invitations, managed billing, and the Google Search Console OAuth flow. Do not set this to cloud — it enables code paths that require Cloud infrastructure.

Accent colour

STATALOG_ACCENT=emerald

Controls the primary colour used throughout the dashboard UI. Available options:

emerald (default) | blue | indigo | violet | cyan | teal | amber | rose | ember

Changes take effect immediately after clearing the config cache.

Mail

MAIL_MAILER=smtp
MAIL_HOST=smtp.mailgun.org
MAIL_PORT=587
MAIL_USERNAME=postmaster@your-domain.com
MAIL_PASSWORD=your-smtp-password
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=noreply@your-domain.com
MAIL_FROM_NAME="Statalog"

Mail is used for password reset emails and, if you have configured them, email digest reports. Any SMTP provider works: Mailgun, Postmark, Amazon SES, SendGrid, or a local MTA.

For local testing, MAIL_MAILER=log writes emails to storage/logs/laravel.log instead of sending them.

Visitor hashing

STATALOG_VISITOR_SALT=optional-additional-entropy

An optional static salt that is combined with the auto-generated daily rotating salt when computing visitor hashes. If not set, Statalog auto-generates and stores a random salt in the database on first run. Setting this explicitly gives you control over the hashing process and means your visitor hashes are unique to your installation even if someone else runs the same version of Statalog.

Do not change this value after the installation is running — it would cause all existing visitor deduplication to break, resulting in inflated visitor counts.

Queue and session

SESSION_LIFETIME=120          # Minutes before an idle session expires
QUEUE_CONNECTION=redis         # Always use redis in production

The queue processes analytics ingestion, email sending, and data aggregation. If the queue worker is not running, pageviews may be lost or delayed. Monitor your Supervisor workers to ensure they stay healthy.

Logging

LOG_CHANNEL=stack
LOG_LEVEL=error               # Use 'error' in production; 'debug' is verbose

Production installations should log at the error level to avoid filling disk with routine request logs. Logs are written to storage/logs/. Rotate them with logrotate or a similar tool.