Configuration

RapidREST configuration is built directly on nconf, set up in src/config.ts. There's no separate RapidREST-specific config format. You're looking at plain nconf, with one thing worth calling out up front.

The one gotcha

nconf uses colons (:) as its hierarchy separator, not dots. config.get("auth.secret") returns undefined. Always use config.get("auth:secret").

A real config file

// src/config.ts
import nconf from 'nconf';

const conf = nconf
  .argv()
  .env({separator: '__', parseValues: true});

conf.defaults({
  service_name: 'my-api',
  auth: {
    strategy: 'auth.JWTStrategy',
    secret: 'change-me-in-production',
    options: {
      expiresIn: '1 hour',
      audience: 'my-api.example.com',
      issuer: 'api.example.com',
    },
  },
  class_loader: {
    ignore: [/server\..*/, /config\..*/],
  },
  cors: {origins: ['http://localhost:3000']},
  datastores: {
    mongo: {type: 'mongodb', host: 'localhost', database: 'my_api'},
  },
  logger: {level: 'info'},
  rbac: {enabled: true},
  trusted_roles: ['admin'],
});

export default conf;

Because .env() is configured with separator: '__', you can override any nested key via environment variables using double underscores in place of colons. For example AUTH__SECRET=prod-secret overrides auth:secret.

Reading config values

Anywhere in your own code:

config.get('datastores');
config.get('rbac:enabled');
config.get('auth:socketTimeout');

Inside a class managed by the dependency injection container, use @Config instead of importing the config object directly. See Dependency Injection:

@Config('trusted_roles', ['admin'])
protected trustedRoles: string[] = ['admin'];

Common top-level keys

Key	Purpose
datastores	MongoDB/PostgreSQL/SQLite/Redis connection definitions, keyed by datastore name (referenced from @DataStore('name'))
auth	Default auth strategy, JWT secret/options
rbac:enabled	Turns the RBAC/ACL permission system on or off globally
trusted_roles	Roles that bypass ACL permission checks entirely
class_loader:ignore	Regexes for files to exclude from auto-discovery
port / listen_host / ssl / max_body_size	Server bind address and TLS — see HTTP Engine
session	Server-side session config — see Sessions
cors	CORS allow-list (cors.origins) — see Cookies & CORS
headers	Extra response headers applied to every request — see Cookies & CORS
logger:level	Winston log level

You'll see most of these referenced again in Models & Persistence and Auth & RBAC as they come up.