Configuration

config.php returns the runtime configuration array. Empty environment values generally fall back to the listed default because the code uses getenv(...) ?: default.

Configuration files

File/path	Role
config.php	Authoritative PHP runtime settings and application DB credentials
database/schema.sql	Idempotent fresh-install application schema, not a runtime config parser
docker/report-server/context.xml	Generated Tomcat JNDI datasource resources; contains plaintext credentials
docker/report-server/docker-compose.yml	Report-server image, port, and bind mounts
.htaccess	Directory index, index blocking, and friendly report-view rewrite
deploy/apache-central-jasper.conf.example	Example same-host Central/Jasper reverse proxy
schedules/<id>_env.sh	Generated per-schedule systemd EnvironmentFile
systemd/jrs-schedule-<id>.{service,timer}	Generated schedule unit definitions

No .env loader, YAML/TOML application configuration, Composer configuration, or dynamic config reload is implemented. PHP requests load config.php at startup; restart long-lived PHP workers after changing their environment.

Application database

Setting	Current value	Environment support
Host	localhost	None
Port	5432	None
Database	jasper_reports	None
User	postgres	None
Password	Checked-in secret, intentionally omitted here	None

Replace and rotate the committed password. The legacy names JRS_DB_HOST, JRS_DB_PORT, JRS_DB_NAME, JRS_DB_USER, and JRS_DB_PASS occur in old documentation/installer text but current PHP never reads them.

Supported runtime environment

Variable	Exact default	Purpose
JRS_DB_SCHEMA	public	Application table schema; invalid identifiers fall back to public
JRS_REPORT_ENDPOINT	execute_report.php	Viewer-relative PHP report endpoint
JRS_JASPER_CONTEXT_PATH	<service>/docker/report-server/context.xml	Generated Tomcat context output
CENTRAL_DATABASE_URL	empty	Preferred Central PostgreSQL URL
JRS_AUTH_DATABASE_URL	empty	Central URL fallback
CENTRAL_DB_NAME	acugis_meta	Central DB on the application DB cluster
JRS_AUTH_SEARCH_PATH	empty	Comma-separated Central PostgreSQL search path
JRS_CENTRAL_USE_APP_DB	false	Force Central tables to the application DB
JRS_NO_APP_DB_FOR_CENTRAL	false	Disable automatic Central-meta/application-DB fallback
CENTRAL_LOGIN_URL	/login	HTML authentication redirect target
JRS_JASPER_INTERNAL_REPORT_URL	http://127.0.0.1:9099/report	Server-side Jasper render URL
JRS_JASPER_INTERNAL_IMAGE_URL	http://127.0.0.1:9099/acugis_report_image	Server-side Jasper image URL
JRS_JASPER_HOME	empty → service root	Installation root
JRS_JASPER_SCHEDULE_DIR	empty → <home>/schedules	Schedule EnvironmentFiles, logs, and output
JRS_JASPER_EMAIL_TMPL_DIR	empty → <home>/email_tmpl	.html, .htm, and .txt email templates
JRS_JASPER_SYSTEMCTL	/bin/systemctl	systemctl executable
JRS_JASPER_SYSTEMD_SYSTEM_DIR	/etc/systemd/system	systemd load path receiving symlinks
JRS_SMTP_HOST	empty	SMTP host; empty selects PHP mail()
JRS_SMTP_PORT	587	SMTP TCP port
JRS_SMTP_USER	empty	Optional SMTP AUTH LOGIN user
JRS_SMTP_PASS	empty	SMTP password
JRS_SMTP_FROM	empty	Sender; falls back to SMTP user, then jasper-reports@localhost
JRS_AUTH_DEBUG	false	Enables auth logs and /debug/session.php
JRS_AUTH_LOGIN_TRACE	false	Also enables auth diagnostic logs
JRS_RESOURCE_SYNC_VERBOSE	false	Logs resources that already exist

Apache SetEnv values are read from $_SERVER only by the Central/auth helper. Most config.php settings use getenv() directly, so verify how the selected PHP SAPI passes environment variables.

The auth DSN resolver also accepts REDIRECT_CENTRAL_DATABASE_URL and REDIRECT_JRS_AUTH_DATABASE_URL, both defaulting to empty. These support web-server-prefixed variables and are checked after the primary names.

Nonfunctional documented overrides

JRS_JASPER_SYSTEMD_USE_SUDO and JRS_JASPER_SYSTEMD_UNIT_DIR are mentioned in comments, but current configuration hardcodes:

• jasper_systemd_use_sudo = true
• jasper_systemd_unit_dir = /opt/qcarta-jasper-service/systemd

Those two environment overrides do not work. Scheduler commands therefore use sudo -n, write source unit files under /opt/qcarta-jasper-service/systemd, and symlink them into JRS_JASPER_SYSTEMD_SYSTEM_DIR.

Installer environment

Variable	Default	Scope
JRS_INSTALL_DIR	/var/www/html/jasper-report-services	installer.sh destination only

Non-runtime reference tree

schedule-reference/ is copied legacy QCarta code with missing incl/, class/, and dist/ dependencies; the active service does not include it. It mentions REPORT_BUILDER_PDF_BASE_URL (no default; constant or environment) and REPORT_PDF_TOKEN, plus unrelated JRI_* settings supplied by files absent from this service. These are not current Jasper service configuration variables.

Generated schedule EnvironmentFiles

Saving a schedule writes <schedule-dir>/<id>_env.sh (mode 0640). systemd reads it as an EnvironmentFile; it is not executed as a shell script.

Variable	Source/default
JRS_SCHEDULE_ID	Schedule ID
JRS_REPORT_NAME	Database report_name
JRS_DATASOURCE	Database datasource_name
JRS_FORMAT	Database value, code fallback pdf
JRS_FILENAME	Database value, fallback empty
JRS_EMAIL	Database value, fallback empty
JRS_EMAIL_SUBJECT	Database value, fallback empty
JRS_EMAIL_BODY	Database value, fallback empty
JRS_EMAIL_TEMPLATE	Database value, fallback empty
JRS_NOEMAIL	1 or 0
JRS_URL_OPT_PARAMS	Database value, fallback empty
JRS_JASPER_HOME	Resolved home

For scheduled runs, non-empty process values for the first eleven runtime keys above override the file/database snapshot. Empty values do not override. JRS_JASPER_HOME is not in the runner's later field-overlay list, but systemd loads it into the process before config.php, so it configures the home for normal timer execution. Direct CLI execution only sees it when it is already in the process environment.

Central authentication and authorization

The service hashes the acugis_session cookie with SHA-256 and queries Central tables including dashboard_sessions, dashboard_users, auth_groups, auth_group_members, resources, and resource_permissions. These are external to database/schema.sql.

Resolution order is:

1. Primary or REDIRECT_ Central URL variables.
2. Configured Central URL.
3. Application DB when JRS_CENTRAL_USE_APP_DB is true.
4. CENTRAL_DB_NAME on the application DB cluster.
5. Application DB, unless JRS_NO_APP_DB_FOR_CENTRAL is true.

If no DSN resolves, authentication checks are disabled and jrs_require_login() installs a local-development administrator identity. Treat explicit Central configuration as mandatory for production.

SMTP limitation

The built-in SMTP client uses plain TCP and optional AUTH LOGIN. It does not issue STARTTLS and has no certificate validation controls. Port 587 is only a numeric default, not evidence of encrypted transport. Use a trusted local relay or change the implementation before sending credentials over an untrusted network.

Example

Apache/PHP environment for a same-host Central deployment:

SetEnv CENTRAL_DATABASE_URL "postgresql://jasper_auth:REDACTED@127.0.0.1:5432/acugis_meta?sslmode=require"
SetEnv CENTRAL_LOGIN_URL "/login"
SetEnv JRS_DB_SCHEMA "public"
SetEnv JRS_JASPER_INTERNAL_REPORT_URL "http://127.0.0.1:9099/report"
SetEnv JRS_JASPER_INTERNAL_IMAGE_URL "http://127.0.0.1:9099/acugis_report_image"
SetEnv JRS_JASPER_HOME "/opt/qcarta-jasper-service"
SetEnv JRS_JASPER_SCHEDULE_DIR "/var/lib/qcarta-jasper/schedules"

Application DB values still must be changed in config.php; the source exposes no supported environment override for them.

Recommended production settings

• Configure an explicit Central DSN with PostgreSQL TLS (sslmode=require or stricter) and verify the expected Central schema/search path.
• Keep internal Jasper URLs on loopback or a private network; do not expose port 9099 directly.
• Use absolute paths for home, schedule, template, context, and systemd directories.
• Keep JRS_AUTH_DEBUG, JRS_AUTH_LOGIN_TRACE, and JRS_RESOURCE_SYNC_VERBOSE disabled except during bounded diagnosis.
• Use a local trusted mail relay or PHP mail transport; the built-in SMTP client cannot negotiate TLS.
• Limit the PHP/systemd service account to required writable paths and narrowly scope any passwordless sudo policy.

Secrets management

The application DB password, report-datasource passwords, Central DSN, SMTP password, generated context.xml, and schedule recipient/content files are sensitive. Current code stores application/report datasource credentials in plaintext and writes datasource passwords into Tomcat XML.

• Remove credential-bearing generated files from public serving and backups that lack encryption.
• Replace and rotate all credentials already committed in this repository; examples here deliberately use REDACTED.
• Prefer a root-readable PHP-FPM/Apache environment file or external secret injection for supported environment values.
• Restrict config.php, context.xml, and schedule EnvironmentFiles to the minimum required users.
• Do not log DSNs, cookies, SMTP credentials, or report parameters; auth debug logs a token-hash prefix and should remain off in production.
• Because application DB environment overrides are not implemented, adopting an external secret manager for that password requires an application change.