Built-in defaults
Atrium ships with the following security controls enabled out of the box:Production recommendations
Run behind an HTTPS reverse proxy
Place Atrium behind a TLS-terminating reverse proxy such as Caddy, nginx, or Traefik. This ensures all traffic between clients and your server is encrypted and allows you to keepSECURE_COOKIES=true (the default).
Use a strong BETTER_AUTH_SECRET
BETTER_AUTH_SECRET is used to sign authentication tokens. If this value is compromised, an attacker can forge valid sessions.
- Generate it with
openssl rand -base64 32— this produces a cryptographically random 44-character string. - Never reuse a secret across environments.
- Store it like a password: in a secrets manager, not in a public repository.
Use an external database in production
The built-in PostgreSQL database is convenient for getting started, but for production deployments consider using a managed PostgreSQL service or a dedicated database container with a strong password set viaPOSTGRES_PASSWORD.
Use S3/MinIO for file storage in production
Local file storage (STORAGE_PROVIDER=local) ties uploads to the container’s volume. For production, use an S3-compatible backend (s3, minio, or r2) so uploads are independent of the container lifecycle and can be backed up separately.
Rate limiting
The global rate limit defaults to 100 requests/min per client. Signup requests are limited separately to 5 requests/min to slow brute-force account creation. Both limits are configurable via environment variables:SECURE_COOKIES
Set
SECURE_COOKIES=false only when Atrium is accessed over plain HTTP with no TLS anywhere in the request path. Remove this override as soon as you add a reverse proxy with HTTPS.