Configuration

Two layers of config: .env for server-side secrets (DB / APP_KEY / driver defaults) and the admin panel for everything else (branding, theme, AI provider, billing, notifications). Anything an end-customer should never edit lives in .env; everything else lives in DB.

.env file reference

Generated by the installer. Edit with care — every change requires php artisan config:clear (or web-server restart) to take effect.

App

APP_NAME="KodMail"
APP_ENV=production            # local | staging | production
APP_KEY=base64:...            # generated by `php artisan key:generate` — NEVER share
APP_DEBUG=false               # MUST be false in production
APP_URL=https://app.example.com
APP_LOCALE=en
APP_TIMEZONE=UTC

APP_KEY Losing this key permanently breaks decryption of every stored password (mail relay, gateway, OAuth, 2FA secret). Back it up the moment the installer generates it. Rotating it means re-entering every credential.

Database

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=kodmail
DB_USERNAME=kodmail
DB_PASSWORD=replace-me

Session + cache

SESSION_DRIVER=file           # file | database | redis
SESSION_LIFETIME=10080        # minutes; 7 days for SaaS feel
SESSION_EXPIRE_ON_CLOSE=false
SESSION_SECURE_COOKIE=true    # HTTPS only

CACHE_STORE=database          # file | database | redis
QUEUE_CONNECTION=database     # database | redis

Mail (system fallback)

MAIL_MAILER=log               # default; admin overrides per-event in DB
MAIL_FROM_ADDRESS="[email protected]"
MAIL_FROM_NAME="${APP_NAME}"

You don't need real SMTP in .env All transactional + campaign mail flows through admin-managed NotificationMailer rows + DeliveryServer rows. .env's MAIL_MAILER=log is just the fallback when no DB mailer is configured.

Admin panel settings

Browse Admin → Settings in the side rail. The page has 6 sub-tabs:

Tab	What it controls	Setting group
Branding	Site name, tagline, logo, favicon, copyright, theme palette	`branding.*`
UI	Toast position, in-app notification preferences	`ui.*`
AI provider	OpenAI / Anthropic / DeepSeek key, default model, customer-override toggle	`ai.*`
Billing & access	Currency, trial days default, grace period, billing on/off	`billing.*`
Auth & landing	Self-signup, Google OAuth, public landing visibility	`auth.*` + `landing.enabled`
System	Update channel, version (read-only), timezone	`system.*`

Settings sidebar + Branding tab · documentation/screenshots/settings-branding.png

Admin → Settings · vertical rail nav matches Linear / Vercel.

Branding + theme palette

Under Admin → Settings → Branding:

Site name — shows in the header, browser title, transactional email subject lines.
Tagline — drives the landing page hero H1.
Logo + Favicon — pick from your asset library or upload via the Gallery button (image picker modal).
Theme palette — palette of CSS-variable colours applied site-wide via a theme-<slug> class on <html>. Available: slate-coral, indigo, emerald, rose, etc.
Copyright — footer line on landing + login pages.

AI Copilot

Under Admin → Settings → AI provider:

Pick provider: OpenAI, Anthropic, or DeepSeek.
Paste API key (encrypted at rest).
Default model: gpt-4o-mini (OpenAI), claude-haiku-4-5 (Anthropic), deepseek-chat (DeepSeek).
Toggle "Allow customer override" if customers should be able to bring their own key.
Optional: set monthly USD cap to prevent runaway spend.

Billing toggles

Under Admin → Settings → Billing & access:

billing.enabled — global on/off. When OFF, customers see no plans + can use the platform freely.
billing.currency — default platform currency. Plans can override.
billing.trial_days_default — used by the hero "Start N-day trial" button on the landing page.
billing.grace_period_days — how long an unpaid subscription stays in read-only before final lock.
billing.require_payment — block sending until at least one payment recorded.

Per-gateway credentials live separately at Admin → Payment methods — see Billing.

Localisation

11 locales ship by default. Manage at Admin → Translations:

Live grid view of every translation key, source string, locale value.
Scan source command picks up new __() / t() calls.
Import / Export JSON for offline translation workflows.
Each locale has enabled/hidden toggle + default flag.

Asset library

Centralised file storage at Admin → Asset library:

Images, PDFs, CSVs, ZIPs up to 5 MB each (config in AssetController).
Customer + admin assets in one place — scope filter on the page.
Used by the AssetUrlInput picker across every image-URL field (logo, favicon, landing hero, template headers, etc.).