LuaApplication
Run with Node 18+ using npm start. Route page and API requests to this Node service; it serves nested routes such as /dashboard/keys and /docs/api directly. Do not replace file denials with a generic HTML fallback.
Environment
| Variable | Purpose |
|---|---|
| SUPABASE_URL | Your database project URL. |
| SUPABASE_SERVICE_ROLE_KEY | Server-only database credential. Never publish it. |
| PUBLIC_BASE_URL | HTTPS origin clients use, e.g. https://luasecure.xyz. |
| PORT | Listening port; default 8080. |
| TRUST_PROXY | Set to 1 only behind a proxy that overwrites X-Forwarded-For. |
| TURNSTILE_SECRET_KEY | Optional browser gate; configure the matching public site key. |
| DISCORD_* | Optional Discord OAuth + bot settings — see Connect Discord. |
Database & frontend
For a new database apply supabase/schema.sql. Existing installs apply the files in supabase/migrations, including 20261005_loader_tickets.sql. Configure web/config.js with the public Supabase URL and anon key.
Protected loader
By default the server uses the committed protected/loader.obfuscated.lua and its pinned digest. To replace it, set both OBFUSCATED_LOADER_PATH and LOADER_SHA256. Changing one without the other makes loader downloads fail.
Verify a release
- Run
npm test. - Check
/healthzresponds. - Refresh a nested dashboard and docs URL.
- Confirm browser file access and invalid licenses return 403.
- Use a dedicated test license to verify both auth phases, then test in the intended runtime.