Configuration

Updated

Reel reads almost nothing from its own environment. Its settings live in two places: the per-application settings you edit in Reel's Applications screen, and the environment values of each recorded application.

The Reel deployment

Scalpels sets up everything the deployment needs. Laravel Cloud injects the connection settings for the database, the private bucket and the managed queue, and Cloud manages APP_KEY. There are no Reel-specific values to fill in.

Do not add DB_*, AWS_*, SQS_*, DB_CONNECTION, CACHE_STORE, QUEUE_CONNECTION or FILESYSTEM_DISK to the Cloud environment yourself. A value you set shadows the one Cloud injects and breaks the resource.

Application settings

Open Applications and select an application. Its settings page has four parts.

Connection

The Application ID and the Enrollment endpoint. reel:install asks for the application ID.

Capture policy

Setting	What it does
Name	The label shown in Reel.
Allowed origins	One HTTP or HTTPS origin per line, up to 20, with no path, query string or fragment. Reel rejects any upload whose origin is not on this list.
Masking severity	`Inputs baseline (mandatory)` or `All text (stronger)`. Enforced by Reel as each chunk arrives.
Additional mask selectors	Selectors, one per line: an optional tag name followed by any number of `#id` and `.class` tokens. Enforced by Reel as each chunk arrives.
Additional block selectors	Same form as mask selectors. Enforced by Reel as each chunk arrives.
Excluded paths	Paths beginning with `/`, one per line, with `*` as a wildcard. No chunk recorded on a matching path is stored.
Sampling percent	0 to 100. Decided once per session from the session id, so a session is recorded in full or not at all.

Select Save capture policy to apply changes. Reel enforces these settings on its own servers, before anything is written to storage, so nothing a monitored browser does can defeat them; see Privacy and capture. Input and contenteditable values are always masked whatever these settings say.

Disable ingest

The button at the top of the page switches enrollment and ingest off or on for the application. While disabled, Reel rejects new uploads with application_disabled and existing sessions are kept. Use it as the kill switch in an incident, and also stop calling Reel.start() in the application if capture must stop in the browser straight away.

Signing credentials

Each enrolled application holds a private key; Reel keeps only the matching public key. A credential shows as Pending enrollment, Active or Revoked.

Issue credential creates a new credential and shows a one-time enrollment code that expires in 15 minutes.
Rotate on an active credential creates a successor and shows a new code. Run php artisan reel:install with it in the application. Reel accepts uploads signed by any active key, so you can check new sessions arrive before revoking the old credential.
Reissue pending code appears on a rotated credential whose successor has not enrolled, in case that code was lost.
Revoke retires a credential. Revoking does not delete any recordings.

A first credential that is still pending cannot be reissued. If its code expired, revoke it and issue a new one.

The recorded application's environment

php artisan reel:install writes the first four of these to the application's local .env. Copy them to the deployed application's environment yourself.

Variable	What it does
`REEL_URL`	Base URL of your Reel deployment.
`REEL_APPLICATION_ID`	The application ID in Reel.
`REEL_PRIVATE_KEY`	The signing key. A secret: store it as one and never commit it.
`REEL_CONTEXT_EXPORT`	`off`, `session_id` or `session_id_and_url`. Defaults to `off`.
`REEL_RELEASE_ID`	Optional. A release or deploy identifier recorded with each session, up to 255 characters. You can filter sessions by it.
`REEL_HOST_MODE`	Optional. Forces the client on or off. Without it, the client is on only when `REEL_URL` and `REEL_PRIVATE_KEY` are both set.

With REEL_CONTEXT_EXPORT set to session_id, requests that the client ties to a recording carry the Reel session ID in Laravel Context under reel. With session_id_and_url they also carry a link to the session in Reel. Anything that reports Laravel Context, such as a Nightwatch transport, then includes it. When a request could belong to several active sessions, the Context says so instead of guessing, and the link points at a filtered list of the candidates.

Fixed limits

Most of these are constants in Reel's config files, so changing them means editing and committing the files in your fork. The per-application session caps are stored on each application with these defaults and have no control in the settings screen.

Limit	Value
New sessions per application per day	1,000
Concurrent sessions per application	100
Session length	30 minutes per session grant
Session closes after no uploads for	15 minutes, then 2 more minutes for late uploads
Largest upload request	384 KB
Largest compressed chunk	256 KB
Largest chunk after decompression	2 MB
Chunks per session	360
Compressed data per session	64 MB
Largest replay the player opens	64 MB compressed, 128 MB decompressed
Ordinary retention	30 days after the session ends
Cooling period after unprotecting	72 hours
Safety delay before deleting orphaned objects	24 hours