Environment variable reference

Generated from committed .env.example, infra/go.env, and Compose interpolation. Secret examples are always masked; the real values must come from the deployment secret store.

Variable Required Default/example Sources Description
ACCESS_LOG_SAMPLE_RATE no 0.1 infra/go.env
infra/compose.observability.yml
infra/compose.prod.yml		 —
ACCESS_TOKEN_SECRET yes <secret> infra/.env.production.example
infra/go.env
services/auth/.env.example
services/gateway/.env.example
services/realtime/.env.example
services/auth/internal/config.go
services/gateway/internal/config.go
services/realtime/main.go
infra/compose.prod.yml		 Go configuration struct tag. set ACCESS_TOKEN_SECRET
ACCESS_TTL_MINUTES no 30 services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
ADMIN_BOOTSTRAP_PASSWORD no <secret> infra/.env.production.example
infra/compose.base.yml
infra/compose.prod.yml		 Random password is generated into this file by deploy.sh; printed once at first seed and changeable later through the normal reset flow.
ADMIN_EMAIL no admin@example.com / admin@example.local infra/.env.production.example
infra/compose.base.yml
infra/compose.prod.yml		 — bootstrap admin (first deploy) —————————————-
AGE_BACKUP_RECIPIENT no age1replace-with-production-recipient infra/.env.production.example
infra/compose.prod.yml		 —
APP_PUBLIC_URL yes https://example.com / http://127.0.0.1:5173 infra/.env.production.example
services/auth/.env.example
services/users/.env.example
services/auth/internal/config.go
services/users/internal/config.go
infra/compose.prod.yml		 Browser-facing auth URL. Switch to https:// after TLS is enabled. Go configuration struct tag. set APP_PUBLIC_URL
APP_VERSION no dev infra/go.env
infra/compose.prod.yml		 —
AUDIT_RETENTION_DAYS no 365 services/worker/main.go Go configuration struct tag.
BACKUP_INTERVAL_SECONDS no 86400 infra/compose.prod.yml —
BACKUP_RETENTION_DAYS no 14 infra/compose.prod.yml —
BCRYPT_COST no 10 / 0 services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
BCRYPT_TARGET_DURATION no 250ms services/auth/internal/config.go Go configuration struct tag.
BUILD_DATE no local / unknown infra/go.env
infra/compose.prod.yml		 —
CONSUMER_QUOTAS no {} services/gateway/.env.example
services/gateway/internal/config.go		 Go configuration struct tag.
COOKIE_SECURE no false services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
DATABASE_URL yes postgres://app:app@postgres:5432/app?sslmode=disable / postgres://app:app@127.0.0.1:5432/app?sslmode=disable / postgres://app:app@127.0.0.1:55432/app?sslmode=disable infra/go.env
services/auth/.env.example
services/rbac/.env.example
services/scheduler/.env.example
services/users/.env.example
services/worker/.env.example
services/auth/internal/config.go
services/rbac/main.go
services/scheduler/main.go
services/users/internal/config.go
services/worker/main.go		 Shared dev defaults for every Go service in infra/compose.base.yml. Go configuration struct tag.
DB_BOOT_RETRY_TIMEOUT no 30s infra/compose.prod.yml —
DB_CONN_MAX_IDLE_TIME no 5m infra/compose.prod.yml —
DB_CONN_MAX_LIFETIME no 30m infra/compose.prod.yml —
DB_IDLE_TX_TIMEOUT no 30s infra/compose.prod.yml —
DB_MAX_IDLE_CONNS no 8 infra/compose.prod.yml —
DB_MAX_OPEN_CONNS no 16 infra/compose.prod.yml —
DB_PREPARE_STMT no true infra/compose.prod.yml —
DB_STATEMENT_TIMEOUT no 15s infra/compose.prod.yml —
DEBUG_REQUEST_TOKEN no — infra/compose.prod.yml —
DLQ_MAX_DEPTH no 10000 services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
DLQ_REDIS_PASSWORD no — services/worker/main.go Go configuration struct tag.
DLQ_REDIS_USERNAME no — services/worker/main.go Go configuration struct tag.
DOMAIN no example.com infra/.env.production.example Public hostname clients use. Also becomes the nginx server_name.
EDGE_PORT no 80 infra/.env.production.example
infra/compose.prod.yml		 Host port for the plain HTTP edge listener.
GATEWAY_MIDDLEWARES no rate-limit,body-guard,proxy services/gateway/.env.example
services/gateway/internal/config.go		 Go configuration struct tag.
GIT_COMMIT no local / unknown infra/go.env
infra/compose.prod.yml		 —
GITHUB_CLIENT_ID yes — infra/.env.production.example
services/auth/.env.example
services/auth/internal/config.go
infra/compose.base.yml
infra/compose.prod.yml		 Go configuration struct tag.
GITHUB_CLIENT_SECRET yes — infra/.env.production.example
services/auth/.env.example
services/auth/internal/config.go
infra/compose.base.yml
infra/compose.prod.yml		 Go configuration struct tag.
GOGC no 100 infra/compose.prod.yml —
GOMEMLIMIT no 200MiB infra/compose.prod.yml —
GOOGLE_CLIENT_ID yes — infra/.env.production.example
services/auth/.env.example
services/auth/internal/config.go
infra/compose.base.yml
infra/compose.prod.yml		 Go configuration struct tag.
GOOGLE_CLIENT_SECRET yes — infra/.env.production.example
services/auth/.env.example
services/auth/internal/config.go
infra/compose.base.yml
infra/compose.prod.yml		 Go configuration struct tag.
GRAFANA_ADMIN_PASSWORD no <secret> infra/compose.observability.yml —
HIBP_API_URL no https://api.pwnedpasswords.com/range services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
HIBP_TIMEOUT no 3s services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
INTERNAL_SECRET yes <secret> infra/.env.production.example
infra/go.env
services/gateway/.env.example
services/rbac/.env.example
services/users/.env.example
services/worker/.env.example
services/auth/internal/config.go
services/gateway/internal/config.go
services/rbac/main.go
services/users/internal/config.go
services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag. set INTERNAL_SECRET
LAB_AUTH_PORT no 8081 infra/compose.base.yml —
LAB_GATEWAY_PORT no 8010 infra/compose.base.yml
infra/compose.lab.yml		 —
LAB_MAILPIT_PORT no 8025 infra/compose.lab.yml —
LAB_PG_PORT no 55432 infra/compose.base.yml —
LAB_PGWEB_PORT no 8087 infra/compose.lab.yml —
LAB_RBAC_PORT no 8083 infra/compose.base.yml —
LAB_REALTIME_PORT no 8085 infra/compose.base.yml —
LAB_REDIS_PORT no 56380 infra/compose.base.yml —
LAB_REDISINSIGHT_PORT no 5540 infra/compose.lab.yml —
LAB_SCHEDULER_PORT no 8086 infra/compose.base.yml —
LAB_USERS_PORT no 8082 infra/compose.base.yml —
LAB_WEB_ADMIN_ROLES_PORT no 5176 infra/compose.base.yml —
LAB_WEB_ADMIN_USERS_PORT no 5175 infra/compose.base.yml —
LAB_WEB_AUTH_PORT no 5174 infra/compose.base.yml —
LAB_WEB_PORT no 5173 infra/compose.base.yml —
LAB_WORKER_PORT no 8084 infra/compose.base.yml —
LOG_LEVEL no info infra/go.env
services/_template/.env.example
services/auth/.env.example
services/gateway/.env.example
services/rbac/.env.example
services/realtime/.env.example
services/scheduler/.env.example
services/users/.env.example
services/worker/.env.example
services/_template/main.go
services/auth/internal/config.go
services/gateway/internal/config.go
services/rbac/main.go
services/realtime/main.go
services/scheduler/main.go
services/users/internal/config.go
services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
LOGIN_ACCOUNT_PER_MINUTE no 10 services/auth/internal/config.go Go configuration struct tag.
LOGIN_LOCK_MINUTES no 15 services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
LOGIN_MAX_ATTEMPTS no 5 services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
MAIL_FALLBACK_HOST no — services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
MAIL_FALLBACK_PASS no — services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
MAIL_FALLBACK_PORT no 587 services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
MAIL_FALLBACK_USER no — services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
MAIL_FROM no noreply@example.local / noreply@example.com services/worker/.env.example
internal/platform/mailer.go
services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
MAIL_FROM_NAME no Platform services/worker/.env.example
internal/platform/mailer.go
services/worker/main.go		 Go configuration struct tag.
MAILER_DRIVER no console services/worker/.env.example
internal/platform/mailer.go
services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
MAX_ACTIVE_SESSIONS no 10 services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
MAX_PER_ROOM no 50 services/realtime/.env.example
services/realtime/main.go		 Go configuration struct tag.
MIGRATION_WARN_AFTER no 30s infra/compose.prod.yml —
NGINX_GZIP_LEVEL no 5 infra/compose.prod.yml —
OTEL_EXPORTER_OTLP_ENDPOINT no — infra/compose.prod.yml —
OTEL_TRACE_SAMPLE_RATIO no 1 infra/go.env
infra/compose.observability.yml
infra/compose.prod.yml		 —
PASSWORD_HASH_ALGORITHM no <secret> services/auth/.env.example
services/auth/internal/config.go
infra/compose.prod.yml		 Go configuration struct tag.
PASSWORD_HISTORY_COUNT no <secret> services/auth/.env.example
services/auth/internal/config.go
infra/compose.prod.yml		 Go configuration struct tag.
PG_ARCHIVE_TIMEOUT no 300s infra/compose.prod.yml —
PG_MAINTENANCE_WORK_MEM no 64MB infra/compose.prod.yml —
PG_SHARED_BUFFERS no 256MB infra/compose.prod.yml —
PG_WORK_MEM no 8MB infra/compose.prod.yml —
PLATFORM_TEST_SECRET yes — internal/platform/platform_test.go Go configuration struct tag.
PORT no 8080 / 8000 / 8086 services/_template/.env.example
services/auth/.env.example
services/gateway/.env.example
services/rbac/.env.example
services/realtime/.env.example
services/scheduler/.env.example
services/users/.env.example
services/worker/.env.example
services/_template/main.go
services/auth/internal/config.go
services/gateway/internal/config.go
services/rbac/main.go
services/realtime/main.go
services/scheduler/main.go
services/users/internal/config.go
services/worker/main.go		 Go configuration struct tag.
POSTGRES_PASSWORD yes <secret> infra/.env.production.example
infra/compose.observability.yml
infra/compose.prod.yml		 — secrets (deploy.sh generates these with openssl rand -hex 32) ——- set POSTGRES_PASSWORD
PUBLIC_WS_URL yes wss://example.com/ws / ws://127.0.0.1:8000/ws infra/.env.production.example
services/realtime/.env.example
services/realtime/main.go
infra/compose.prod.yml		 URL the realtime-info endpoint hands to browsers for websocket connections. nosemgrep: javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket – documentation Use wss:// behind TLS, ws:// otherwise. Path is fixed: /ws Go configuration struct tag. set PUBLIC_WS_URL e.g. wss://domain/ws
RATE_GLOBAL_PER_MINUTE no 120 / 300 / 1200 services/auth/.env.example
services/gateway/.env.example
services/auth/internal/config.go
services/gateway/internal/config.go
infra/compose.lab.yml
infra/compose.prod.yml		 Go configuration struct tag.
RATE_STRICT_PER_MINUTE no 10 services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
RBAC_INTERNAL_URL no — services/auth/internal/config.go Go configuration struct tag.
REALTIME_UPSTREAM no — services/gateway/internal/config.go Go configuration struct tag.
REDIS_ADDR no redis:6379 / 127.0.0.1:6379 / 127.0.0.1:56380 infra/go.env
services/auth/.env.example
services/gateway/.env.example
services/rbac/.env.example
services/realtime/.env.example
services/scheduler/.env.example
services/users/.env.example
services/worker/.env.example
services/auth/internal/config.go
services/gateway/internal/config.go
services/rbac/main.go
services/realtime/main.go
services/scheduler/main.go
services/users/internal/config.go
services/worker/main.go		 Go configuration struct tag.
REDIS_AUTH_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 set REDIS_AUTH_PASSWORD
REDIS_BACKUP_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 Replication-only credential used by the Redis RDB backup sidecar. set REDIS_BACKUP_PASSWORD
REDIS_DLQ_ADMIN_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 Keep this credential offline; application containers never receive it. set REDIS_DLQ_ADMIN_PASSWORD
REDIS_EXPORTER_PASSWORD no — infra/compose.observability.yml —
REDIS_EXPORTER_USER no — infra/compose.observability.yml —
REDIS_GATEWAY_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 set REDIS_GATEWAY_PASSWORD
REDIS_OBSERVER_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 set REDIS_OBSERVER_PASSWORD
REDIS_PASSWORD no — services/auth/internal/config.go
services/gateway/internal/config.go
services/rbac/main.go
services/realtime/main.go
services/scheduler/main.go
services/users/internal/config.go
services/worker/main.go		 Go configuration struct tag.
REDIS_RBAC_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 set REDIS_RBAC_PASSWORD
REDIS_REALTIME_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 set REDIS_REALTIME_PASSWORD
REDIS_SCHEDULER_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 set REDIS_SCHEDULER_PASSWORD
REDIS_USERNAME no — services/auth/internal/config.go
services/gateway/internal/config.go
services/rbac/main.go
services/realtime/main.go
services/scheduler/main.go
services/users/internal/config.go
services/worker/main.go		 Go configuration struct tag.
REDIS_USERS_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 set REDIS_USERS_PASSWORD
REDIS_WORKER_PASSWORD yes <secret> infra/.env.production.example
infra/compose.prod.yml		 set REDIS_WORKER_PASSWORD
REFRESH_GRACE_WINDOW no 10s services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
REFRESH_TTL_DAYS no 7 services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
RESET_TTL_MINUTES no 15 services/auth/.env.example
services/auth/internal/config.go		 Go configuration struct tag.
ROOMS no lobby,general services/realtime/.env.example
services/realtime/main.go		 Go configuration struct tag.
SCHEDULED_JOBS no [] services/scheduler/.env.example
services/scheduler/main.go
infra/compose.base.yml
infra/compose.prod.yml		 Go configuration struct tag.
SESSION_CRYPTO_KEYS yes change-me-active,change-me-previous infra/.env.production.example
services/auth/.env.example
services/auth/internal/config.go
infra/compose.prod.yml		 Go configuration struct tag. set SESSION_CRYPTO_KEYS
SHUTDOWN_TIMEOUT no 20s infra/compose.prod.yml —
SLOW_QUERY_SAMPLE_RATE no 1 infra/go.env
infra/compose.observability.yml
infra/compose.prod.yml		 —
SLOW_QUERY_THRESHOLD no 500ms services/_template/.env.example
services/auth/.env.example
services/users/.env.example
services/_template/main.go
services/auth/internal/config.go
services/rbac/main.go
services/scheduler/main.go
services/users/internal/config.go
services/worker/main.go		 Go configuration struct tag.
SLOW_REQUEST_THRESHOLD_MS no 500 services/gateway/.env.example
services/gateway/internal/config.go		 Go configuration struct tag.
SMTP_HOST yes — services/worker/.env.example
internal/platform/mailer.go
services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
SMTP_PASS yes — services/worker/.env.example
internal/platform/mailer.go
services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
SMTP_PORT no 587 services/worker/.env.example
internal/platform/mailer.go
services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
SMTP_USER yes — services/worker/.env.example
internal/platform/mailer.go
services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
STACK_ENV no prod infra/.env.production.example
infra/compose.prod.yml		 Copy to infra/.env.production (gitignored) and fill in. deploy.sh generates this file with random secrets on first run if it does not exist. Stack identity — isolates project name, containers and state per env.
STREAM_ENCRYPTION_KEYS yes — infra/.env.production.example
services/auth/.env.example
infra/compose.prod.yml		 Optional: enables AES-GCM encryption for Redis Stream payloads.
STREAM_MAXLEN no 100000 infra/compose.prod.yml —
STREAM_SIGNING_KEYS yes change-me-active,change-me-previous infra/.env.production.example
services/auth/.env.example
infra/compose.prod.yml		 set STREAM_SIGNING_KEYS
TRUSTED_DOMAINS yes https://example.com,http://example.com / http://127.0.0.1:5173,http://127.0.0.1:5174 infra/.env.production.example
services/gateway/.env.example
services/gateway/internal/config.go
infra/compose.prod.yml		 Origins allowed by the gateway CORS layer (same-origin deployment makes this nearly moot, but keep it aligned with how users reach the site). Go configuration struct tag. set TRUSTED_DOMAINS
TRUSTED_PROXY_CIDRS no — services/gateway/internal/config.go Go configuration struct tag.
UPSTREAMS no {"auth":"http://127.0.0.1:8081","users":"http://127.0.0.1:8082","rbac":"http://127.0.0.1:8083","worker":"http://127.0.0.1:8084"} services/gateway/.env.example —
WEBHOOK_ALLOWED_HOSTS no — infra/compose.prod.yml —
WEBSOCKET_ROUTES no {"/ws":"http://127.0.0.1:8085"} / {} services/gateway/.env.example
services/gateway/internal/config.go		 Go configuration struct tag.
WORKER_CONCURRENCY no 4 services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
WORKER_HANDLERS no email,audit,webhook services/worker/.env.example
services/worker/main.go		 Go configuration struct tag.
WORKER_MIN_IDLE no 30s services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
WORKER_XREAD_COUNT no 100 services/worker/main.go
infra/compose.prod.yml		 Go configuration struct tag.
WS_HEARTBEAT_INTERVAL no 30s services/realtime/main.go
infra/compose.prod.yml		 Go configuration struct tag.