DB_PROVIDER | postgres serves server-side queries in-process over DATABASE_URL | (optional, commented out) Provider per area. Unset means today's stack: supabase (DB, auth, storage, realtime), pg_cron (scheduler), resend (email), env (secrets). These override the providers.<area> rows in the instance_settings table. |
DB_PROVIDER | supabase | (optional, commented out) (same RLS, same results as PostgREST) instead of through Supabase's REST API; it is read from the environment only. It needs DATABASE_URL (a role that can SET ROLE anon/authenticated/service_role, e.g. postgres; PgBouncer transaction mode is fine) and, to verify HS256 session tokens without a round trip to Supabase Auth, SUPABASE_JWT_SECRET. Pool size: DATABASE_POOL_MAX (default 10). |
AUTH_PROVIDER | supabase | (optional, commented out) (same RLS, same results as PostgREST) instead of through Supabase's REST API; it is read from the environment only. It needs DATABASE_URL (a role that can SET ROLE anon/authenticated/service_role, e.g. postgres; PgBouncer transaction mode is fine) and, to verify HS256 session tokens without a round trip to Supabase Auth, SUPABASE_JWT_SECRET. Pool size: DATABASE_POOL_MAX (default 10). |
STORAGE_PROVIDER | supabase | (optional, commented out) (same RLS, same results as PostgREST) instead of through Supabase's REST API; it is read from the environment only. It needs DATABASE_URL (a role that can SET ROLE anon/authenticated/service_role, e.g. postgres; PgBouncer transaction mode is fine) and, to verify HS256 session tokens without a round trip to Supabase Auth, SUPABASE_JWT_SECRET. Pool size: DATABASE_POOL_MAX (default 10). |
REALTIME_PROVIDER | supabase | (optional, commented out) (same RLS, same results as PostgREST) instead of through Supabase's REST API; it is read from the environment only. It needs DATABASE_URL (a role that can SET ROLE anon/authenticated/service_role, e.g. postgres; PgBouncer transaction mode is fine) and, to verify HS256 session tokens without a round trip to Supabase Auth, SUPABASE_JWT_SECRET. Pool size: DATABASE_POOL_MAX (default 10). |
SCHEDULER_PROVIDER | pg_cron | (optional, commented out) (same RLS, same results as PostgREST) instead of through Supabase's REST API; it is read from the environment only. It needs DATABASE_URL (a role that can SET ROLE anon/authenticated/service_role, e.g. postgres; PgBouncer transaction mode is fine) and, to verify HS256 session tokens without a round trip to Supabase Auth, SUPABASE_JWT_SECRET. Pool size: DATABASE_POOL_MAX (default 10). |
EMAIL_PROVIDER | resend | (optional, commented out) (same RLS, same results as PostgREST) instead of through Supabase's REST API; it is read from the environment only. It needs DATABASE_URL (a role that can SET ROLE anon/authenticated/service_role, e.g. postgres; PgBouncer transaction mode is fine) and, to verify HS256 session tokens without a round trip to Supabase Auth, SUPABASE_JWT_SECRET. Pool size: DATABASE_POOL_MAX (default 10). |
SECRETS_PROVIDER | env | (optional, commented out) (same RLS, same results as PostgREST) instead of through Supabase's REST API; it is read from the environment only. It needs DATABASE_URL (a role that can SET ROLE anon/authenticated/service_role, e.g. postgres; PgBouncer transaction mode is fine) and, to verify HS256 session tokens without a round trip to Supabase Auth, SUPABASE_JWT_SECRET. Pool size: DATABASE_POOL_MAX (default 10). |
CACHE_PROVIDER | memory | (optional, commented out) (same RLS, same results as PostgREST) instead of through Supabase's REST API; it is read from the environment only. It needs DATABASE_URL (a role that can SET ROLE anon/authenticated/service_role, e.g. postgres; PgBouncer transaction mode is fine) and, to verify HS256 session tokens without a round trip to Supabase Auth, SUPABASE_JWT_SECRET. Pool size: DATABASE_POOL_MAX (default 10). |
KMS_PROVIDER | env | (optional, commented out) (same RLS, same results as PostgREST) instead of through Supabase's REST API; it is read from the environment only. It needs DATABASE_URL (a role that can SET ROLE anon/authenticated/service_role, e.g. postgres; PgBouncer transaction mode is fine) and, to verify HS256 session tokens without a round trip to Supabase Auth, SUPABASE_JWT_SECRET. Pool size: DATABASE_POOL_MAX (default 10). |
DATABASE_URL | | (optional, commented out) Direct Postgres connection string, for providers that talk to the database without Supabase (not used by the defaults). |
SUPABASE_JWT_SECRET | | (optional, commented out) Direct Postgres connection string, for providers that talk to the database without Supabase (not used by the defaults). |
DATABASE_POOL_MAX | 10 | (optional, commented out) Direct Postgres connection string, for providers that talk to the database without Supabase (not used by the defaults). |
DB_MAX_ROWS | 1000 | (optional, commented out) Row cap per read, as Supabase's API "max rows" setting (0 = none). |
DATABASE_AUTH | password | (optional, commented out) How the app authenticates its Postgres connections: password (default, the URL's password), azure (Microsoft Entra ID token for Azure Database for PostgreSQL, via managed identity / DefaultAzureCredential), gcp (IAM access token for Cloud SQL / AlloyDB, via Application Default Credentials) or aws (RDS / Aurora / RDS Proxy IAM database auth: a 15-minute token from the task role / instance profile / IRSA; the URL's user is granted rds_iam). Token modes need TLS (sslmode=require) or the Cloud SQL Auth Proxy; aws turns TLS on itself and verifies the server with DATABASE_SSL_CA_FILE, else the RDS CA bundle shipped in the image (certs/rds-global-bundle.pem). DATABASE_AWS_REGION defaults to the region in the RDS host name, then AWS_REGION. |
DATABASE_AWS_REGION | | (optional, commented out) How the app authenticates its Postgres connections: password (default, the URL's password), azure (Microsoft Entra ID token for Azure Database for PostgreSQL, via managed identity / DefaultAzureCredential), gcp (IAM access token for Cloud SQL / AlloyDB, via Application Default Credentials) or aws (RDS / Aurora / RDS Proxy IAM database auth: a 15-minute token from the task role / instance profile / IRSA; the URL's user is granted rds_iam). Token modes need TLS (sslmode=require) or the Cloud SQL Auth Proxy; aws turns TLS on itself and verifies the server with DATABASE_SSL_CA_FILE, else the RDS CA bundle shipped in the image (certs/rds-global-bundle.pem). DATABASE_AWS_REGION defaults to the region in the RDS host name, then AWS_REGION. |
DATABASE_SSL_CA_FILE | | (optional, commented out) How the app authenticates its Postgres connections: password (default, the URL's password), azure (Microsoft Entra ID token for Azure Database for PostgreSQL, via managed identity / DefaultAzureCredential), gcp (IAM access token for Cloud SQL / AlloyDB, via Application Default Credentials) or aws (RDS / Aurora / RDS Proxy IAM database auth: a 15-minute token from the task role / instance profile / IRSA; the URL's user is granted rds_iam). Token modes need TLS (sslmode=require) or the Cloud SQL Auth Proxy; aws turns TLS on itself and verifies the server with DATABASE_SSL_CA_FILE, else the RDS CA bundle shipped in the image (certs/rds-global-bundle.pem). DATABASE_AWS_REGION defaults to the region in the RDS host name, then AWS_REGION. |
MIGRATION_DATABASE_URL | | (optional, commented out) Migrations on any PostgreSQL: usertasks-admin db migrate (npm run admin -- db migrate; node admin.cjs db migrate in the Docker image). It uses MIGRATION_DATABASE_URL, else DATABASE_URL (a direct / session-mode connection, not PgBouncer transaction mode), and the files in MIGRATIONS_DIR (default ./supabase/migrations). |
MIGRATIONS_DIR | | (optional, commented out) Migrations on any PostgreSQL: usertasks-admin db migrate (npm run admin -- db migrate; node admin.cjs db migrate in the Docker image). It uses MIGRATION_DATABASE_URL, else DATABASE_URL (a direct / session-mode connection, not PgBouncer transaction mode), and the files in MIGRATIONS_DIR (default ./supabase/migrations). |
REALTIME_PROVIDER | sse pushes live updates (task lists, queue, notification | (optional, commented out) Migrations on any PostgreSQL: usertasks-admin db migrate (npm run admin -- db migrate; node admin.cjs db migrate in the Docker image). It uses MIGRATION_DATABASE_URL, else DATABASE_URL (a direct / session-mode connection, not PgBouncer transaction mode), and the files in MIGRATIONS_DIR (default ./supabase/migrations). |
REALTIME_DATABASE_URL | | (optional, commented out) bell, live logs) over Server-Sent Events from the app instead of Supabase Realtime. Each app instance LISTENs on Postgres (migration 20261105000000_realtime_notify.sql) over a session-mode connection: REALTIME_DATABASE_URL, else DATABASE_URL, else SUPABASE_DB_URL (the project's direct or session-pooler string; not the 6543 transaction pooler). With none set it polls the tables every 2 s instead. |
SUPABASE_DB_URL | | (optional, commented out) bell, live logs) over Server-Sent Events from the app instead of Supabase Realtime. Each app instance LISTENs on Postgres (migration 20261105000000_realtime_notify.sql) over a session-mode connection: REALTIME_DATABASE_URL, else DATABASE_URL, else SUPABASE_DB_URL (the project's direct or session-pooler string; not the 6543 transaction pooler). With none set it polls the tables every 2 s instead. |
STORAGE_PROVIDER | local|s3|azure_blob|gcs stores uploads (logos, fonts, | (optional, commented out) bell, live logs) over Server-Sent Events from the app instead of Supabase Realtime. Each app instance LISTENs on Postgres (migration 20261105000000_realtime_notify.sql) over a session-mode connection: REALTIME_DATABASE_URL, else DATABASE_URL, else SUPABASE_DB_URL (the project's direct or session-pooler string; not the 6543 transaction pooler). With none set it polls the tables every 2 s instead. |
STORAGE_BUCKET_MAP | | (optional, commented out) data-table files, workflow documents) outside Supabase Storage; the app then serves them at /files/<bucket>/<key> unless STORAGE_PUBLIC_BASE_URL points at the store or a CDN. Secrets (keys, connection strings, service-account JSON) can instead be stored encrypted as storage.<option> instance settings. Buckets: task-files, logos, brand-fonts. STORAGE_BUCKET_MAP is JSON ({"logos": "acme-logos"}), STORAGE_BUCKET puts everything in one bucket under <bucket>/<key>, STORAGE_BUCKET_PREFIX prefixes each bucket name. |
STORAGE_BUCKET | | (optional, commented out) data-table files, workflow documents) outside Supabase Storage; the app then serves them at /files/<bucket>/<key> unless STORAGE_PUBLIC_BASE_URL points at the store or a CDN. Secrets (keys, connection strings, service-account JSON) can instead be stored encrypted as storage.<option> instance settings. Buckets: task-files, logos, brand-fonts. STORAGE_BUCKET_MAP is JSON ({"logos": "acme-logos"}), STORAGE_BUCKET puts everything in one bucket under <bucket>/<key>, STORAGE_BUCKET_PREFIX prefixes each bucket name. |
STORAGE_BUCKET_PREFIX | | (optional, commented out) data-table files, workflow documents) outside Supabase Storage; the app then serves them at /files/<bucket>/<key> unless STORAGE_PUBLIC_BASE_URL points at the store or a CDN. Secrets (keys, connection strings, service-account JSON) can instead be stored encrypted as storage.<option> instance settings. Buckets: task-files, logos, brand-fonts. STORAGE_BUCKET_MAP is JSON ({"logos": "acme-logos"}), STORAGE_BUCKET puts everything in one bucket under <bucket>/<key>, STORAGE_BUCKET_PREFIX prefixes each bucket name. |
STORAGE_PUBLIC_BASE_URL | https://{bucket}.s3.eu-west-1.amazonaws.com | (optional, commented out) data-table files, workflow documents) outside Supabase Storage; the app then serves them at /files/<bucket>/<key> unless STORAGE_PUBLIC_BASE_URL points at the store or a CDN. Secrets (keys, connection strings, service-account JSON) can instead be stored encrypted as storage.<option> instance settings. Buckets: task-files, logos, brand-fonts. STORAGE_BUCKET_MAP is JSON ({"logos": "acme-logos"}), STORAGE_BUCKET puts everything in one bucket under <bucket>/<key>, STORAGE_BUCKET_PREFIX prefixes each bucket name. |
STORAGE_LOCAL_ROOT | /var/lib/usertasks/storage | (optional, commented out) local: a directory (local disk, NFS or SMB mount) the app can write to. |
S3_ENDPOINT | http://minio:9000 | (optional, commented out) s3: AWS S3 or any S3-compatible store (MinIO, Ceph RGW, R2, …). Without keys the AWS SDK's default chain is used (env, IAM role, IRSA). |
S3_REGION | us-east-1 | (optional, commented out) s3: AWS S3 or any S3-compatible store (MinIO, Ceph RGW, R2, …). Without keys the AWS SDK's default chain is used (env, IAM role, IRSA). |
S3_ACCESS_KEY_ID | | (optional, commented out) s3: AWS S3 or any S3-compatible store (MinIO, Ceph RGW, R2, …). Without keys the AWS SDK's default chain is used (env, IAM role, IRSA). |
S3_SECRET_ACCESS_KEY | | (optional, commented out) s3: AWS S3 or any S3-compatible store (MinIO, Ceph RGW, R2, …). Without keys the AWS SDK's default chain is used (env, IAM role, IRSA). |
S3_FORCE_PATH_STYLE | true | (optional, commented out) s3: AWS S3 or any S3-compatible store (MinIO, Ceph RGW, R2, …). Without keys the AWS SDK's default chain is used (env, IAM role, IRSA). |
AZURE_STORAGE_CONNECTION_STRING | | (optional, commented out) azure_blob: a connection string, or the account name with a key or SAS token; the account name alone uses Microsoft Entra ID (managed identity / workload identity) via DefaultAzureCredential. |
AZURE_STORAGE_ACCOUNT | | (optional, commented out) azure_blob: a connection string, or the account name with a key or SAS token; the account name alone uses Microsoft Entra ID (managed identity / workload identity) via DefaultAzureCredential. |
AZURE_STORAGE_KEY | | (optional, commented out) azure_blob: a connection string, or the account name with a key or SAS token; the account name alone uses Microsoft Entra ID (managed identity / workload identity) via DefaultAzureCredential. |
AZURE_STORAGE_SAS_TOKEN | | (optional, commented out) azure_blob: a connection string, or the account name with a key or SAS token; the account name alone uses Microsoft Entra ID (managed identity / workload identity) via DefaultAzureCredential. |
AZURE_STORAGE_BLOB_ENDPOINT | | (optional, commented out) azure_blob: a connection string, or the account name with a key or SAS token; the account name alone uses Microsoft Entra ID (managed identity / workload identity) via DefaultAzureCredential. |
GCS_PROJECT_ID | | (optional, commented out) gcs: a service-account key (JSON), or Application Default Credentials (workload identity, attached service account, GOOGLE_APPLICATION_CREDENTIALS). |
GCS_CREDENTIALS_JSON | | (optional, commented out) gcs: a service-account key (JSON), or Application Default Credentials (workload identity, attached service account, GOOGLE_APPLICATION_CREDENTIALS). |
GCS_API_ENDPOINT | | (optional, commented out) gcs: a service-account key (JSON), or Application Default Credentials (workload identity, attached service account, GOOGLE_APPLICATION_CREDENTIALS). |
SCHEDULER_PROVIDER | worker runs the scheduled jobs inside the app (or in a | (optional, commented out) gcs: a service-account key (JSON), or Application Default Credentials (workload identity, attached service account, GOOGLE_APPLICATION_CREDENTIALS). |
SCHEDULER_PROVIDER | external: an outside scheduler calls POST /api/cron/tick | (optional, commented out) usertasks worker container) instead of pg_cron; replicas elect one leader with a Postgres advisory lock on SCHEDULER_DATABASE_URL, else DATABASE_URL (a session connection, not a transaction pooler), else the tick lease. Set SCHEDULER_IN_PROCESS=false on web replicas when a separate worker runs. |
SCHEDULER_IN_PROCESS | true | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_DATABASE_URL | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_OIDC_SERVICE_ACCOUNTS | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_OIDC_AUDIENCE | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_ENTRA_TENANT_ID | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_ENTRA_AUDIENCE | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_ENTRA_ALLOWED_PRINCIPALS | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_COGNITO_USER_POOL_ID | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_COGNITO_ALLOWED_CLIENTS | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_COGNITO_SCOPE | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_COGNITO_REGION | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SCHEDULER_PG_CRON_BASE_URL | | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
EMAIL_PROVIDER | smtp sends through any SMTP relay (Exchange, Postfix, | (optional, commented out) every minute with CRON_SECRET, or with a Google Cloud Scheduler OIDC token (SCHEDULER_OIDC_SERVICE_ACCOUNTS, audience SCHEDULER_OIDC_AUDIENCE, default <APP_URL>/api/cron/tick) or an Entra ID managed-identity token (SCHEDULER_ENTRA_TENANT_ID, SCHEDULER_ENTRA_AUDIENCE, SCHEDULER_ENTRA_ALLOWED_PRINCIPALS: object or client ids), or an Amazon Cognito access token from an EventBridge API destination whose connection uses OAuth client credentials (SCHEDULER_COGNITO_USER_POOL_ID, SCHEDULER_COGNITO_ALLOWED_CLIENTS: app client ids, SCHEDULER_COGNITO_SCOPE optional, SCHEDULER_COGNITO_REGION default the pool id's prefix). SCHEDULER_PG_CRON_BASE_URL is the URL pg_cron calls (default APP_URL). |
SMTP_TLS_REJECT_UNAUTHORIZED | false (prefer NODE_EXTRA_CA_CERTS for a | (optional, commented out) Microsoft 365, Workspace SMTP relay, Mailpit). SMTP_SECURE=true is implicit TLS (port 465); otherwise SMTP_STARTTLS=required|opportunistic|off (default opportunistic). Certificates are verified unless |
SMTP_HOST | | (optional, commented out) private CA). SMTP_NAME is the EHLO host name. |
SMTP_PORT | 587 | (optional, commented out) private CA). SMTP_NAME is the EHLO host name. |
SMTP_SECURE | false | (optional, commented out) private CA). SMTP_NAME is the EHLO host name. |
SMTP_STARTTLS | opportunistic | (optional, commented out) private CA). SMTP_NAME is the EHLO host name. |
SMTP_USER | | (optional, commented out) private CA). SMTP_NAME is the EHLO host name. |
SMTP_PASSWORD | | (optional, commented out) private CA). SMTP_NAME is the EHLO host name. |
SMTP_TLS_REJECT_UNAUTHORIZED | true | (optional, commented out) private CA). SMTP_NAME is the EHLO host name. |
SMTP_TLS_SERVERNAME | | (optional, commented out) private CA). SMTP_NAME is the EHLO host name. |
SMTP_NAME | | (optional, commented out) private CA). SMTP_NAME is the EHLO host name. |
SES_REGION | | (optional, commented out) ses: Amazon SES (SESv2 API). Without keys the AWS default chain is used. |
SES_ACCESS_KEY_ID | | (optional, commented out) ses: Amazon SES (SESv2 API). Without keys the AWS default chain is used. |
SES_SECRET_ACCESS_KEY | | (optional, commented out) ses: Amazon SES (SESv2 API). Without keys the AWS default chain is used. |
SES_CONFIGURATION_SET | | (optional, commented out) ses: Amazon SES (SESv2 API). Without keys the AWS default chain is used. |
ACS_EMAIL_CONNECTION_STRING | | (optional, commented out) azure_communication: Azure Communication Services Email, by connection string, or by endpoint with Entra ID (managed identity). |
ACS_EMAIL_ENDPOINT | | (optional, commented out) azure_communication: Azure Communication Services Email, by connection string, or by endpoint with Entra ID (managed identity). |
GRAPH_TENANT_ID | | (optional, commented out) microsoft_graph: Graph sendMail (Mail.Send application permission), with a client secret or, without one, a managed identity. GRAPH_SENDER is the mailbox to send as (default: the EMAIL_FROM address); GRAPH_ENDPOINT for national clouds. |
GRAPH_CLIENT_ID | | (optional, commented out) microsoft_graph: Graph sendMail (Mail.Send application permission), with a client secret or, without one, a managed identity. GRAPH_SENDER is the mailbox to send as (default: the EMAIL_FROM address); GRAPH_ENDPOINT for national clouds. |
GRAPH_CLIENT_SECRET | | (optional, commented out) microsoft_graph: Graph sendMail (Mail.Send application permission), with a client secret or, without one, a managed identity. GRAPH_SENDER is the mailbox to send as (default: the EMAIL_FROM address); GRAPH_ENDPOINT for national clouds. |
GRAPH_SENDER | | (optional, commented out) microsoft_graph: Graph sendMail (Mail.Send application permission), with a client secret or, without one, a managed identity. GRAPH_SENDER is the mailbox to send as (default: the EMAIL_FROM address); GRAPH_ENDPOINT for national clouds. |
GRAPH_ENDPOINT | https://graph.microsoft.com | (optional, commented out) microsoft_graph: Graph sendMail (Mail.Send application permission), with a client secret or, without one, a managed identity. GRAPH_SENDER is the mailbox to send as (default: the EMAIL_FROM address); GRAPH_ENDPOINT for national clouds. |
GMAIL_SERVICE_ACCOUNT_JSON | | (optional, commented out) gmail: Gmail API, a service account with domain-wide delegation impersonating GMAIL_SENDER (default: the EMAIL_FROM address). |
GMAIL_SENDER | | (optional, commented out) gmail: Gmail API, a service account with domain-wide delegation impersonating GMAIL_SENDER (default: the EMAIL_FROM address). |
EMAIL_CONSOLE_DIR | | (optional, commented out) console: log each message and, with EMAIL_CONSOLE_DIR, write .eml files. |
SECRETS_NAME_PREFIX | | (optional, commented out) SECRETS_PROVIDER: where secret://<name>[#field] references in any provider option (e.g. SMTP_PASSWORD=secret://smtp#password) are read from: env (default; also <VAR>_FILE and SECRETS_FILES_DIR), db (encrypted secrets.<name> instance settings), supabase_vault, hashicorp_vault (also OpenBao), azure_key_vault, gcp_secret_manager, aws_secrets_manager. Values are cached for SECRETS_CACHE_TTL_SECONDS (default 300). ENCRYPTION_KEY may itself be a secret:// reference; when it is unset, an external store's SECRETS_ENCRYPTION_KEY_NAME (default encryption_key) is used. |
SECRETS_CACHE_TTL_SECONDS | 300 | (optional, commented out) SECRETS_PROVIDER: where secret://<name>[#field] references in any provider option (e.g. SMTP_PASSWORD=secret://smtp#password) are read from: env (default; also <VAR>_FILE and SECRETS_FILES_DIR), db (encrypted secrets.<name> instance settings), supabase_vault, hashicorp_vault (also OpenBao), azure_key_vault, gcp_secret_manager, aws_secrets_manager. Values are cached for SECRETS_CACHE_TTL_SECONDS (default 300). ENCRYPTION_KEY may itself be a secret:// reference; when it is unset, an external store's SECRETS_ENCRYPTION_KEY_NAME (default encryption_key) is used. |
SECRETS_ENCRYPTION_KEY_NAME | encryption_key | (optional, commented out) SECRETS_PROVIDER: where secret://<name>[#field] references in any provider option (e.g. SMTP_PASSWORD=secret://smtp#password) are read from: env (default; also <VAR>_FILE and SECRETS_FILES_DIR), db (encrypted secrets.<name> instance settings), supabase_vault, hashicorp_vault (also OpenBao), azure_key_vault, gcp_secret_manager, aws_secrets_manager. Values are cached for SECRETS_CACHE_TTL_SECONDS (default 300). ENCRYPTION_KEY may itself be a secret:// reference; when it is unset, an external store's SECRETS_ENCRYPTION_KEY_NAME (default encryption_key) is used. |
SECRETS_FILES_DIR | /run/secrets | (optional, commented out) SECRETS_PROVIDER: where secret://<name>[#field] references in any provider option (e.g. SMTP_PASSWORD=secret://smtp#password) are read from: env (default; also <VAR>_FILE and SECRETS_FILES_DIR), db (encrypted secrets.<name> instance settings), supabase_vault, hashicorp_vault (also OpenBao), azure_key_vault, gcp_secret_manager, aws_secrets_manager. Values are cached for SECRETS_CACHE_TTL_SECONDS (default 300). ENCRYPTION_KEY may itself be a secret:// reference; when it is unset, an external store's SECRETS_ENCRYPTION_KEY_NAME (default encryption_key) is used. |
SECRETS_DATABASE_URL | | (optional, commented out) SECRETS_PROVIDER: where secret://<name>[#field] references in any provider option (e.g. SMTP_PASSWORD=secret://smtp#password) are read from: env (default; also <VAR>_FILE and SECRETS_FILES_DIR), db (encrypted secrets.<name> instance settings), supabase_vault, hashicorp_vault (also OpenBao), azure_key_vault, gcp_secret_manager, aws_secrets_manager. Values are cached for SECRETS_CACHE_TTL_SECONDS (default 300). ENCRYPTION_KEY may itself be a secret:// reference; when it is unset, an external store's SECRETS_ENCRYPTION_KEY_NAME (default encryption_key) is used. |
VAULT_ADDR | | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_NAMESPACE | | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_KV_MOUNT | secret | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_AUTH_METHOD | | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_TOKEN | | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_ROLE_ID | | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_SECRET_ID | | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_APPROLE_MOUNT | approle | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_K8S_ROLE | | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_K8S_MOUNT | kubernetes | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
VAULT_K8S_TOKEN_PATH | /var/run/secrets/kubernetes.io/serviceaccount/token | (optional, commented out) hashicorp_vault: KV v2 at VAULT_KV_MOUNT (default secret). Auth by VAULT_TOKEN, AppRole (VAULT_ROLE_ID + VAULT_SECRET_ID) or Kubernetes (VAULT_K8S_ROLE); VAULT_AUTH_METHOD picks one explicitly. |
AZURE_KEY_VAULT_URL | https://my-vault.vault.azure.net | (optional, commented out) azure_key_vault: managed identity / DefaultAzureCredential. |
GCP_SECRET_MANAGER_PROJECT | | (optional, commented out) gcp_secret_manager: Application Default Credentials / workload identity. |
GCP_SECRET_MANAGER_CREDENTIALS_JSON | | (optional, commented out) gcp_secret_manager: Application Default Credentials / workload identity. |
GCP_SECRET_MANAGER_ENDPOINT | | (optional, commented out) Regional or private endpoint, e.g. https://secretmanager.europe-west1.rep.googleapis.com |
AWS_SECRETS_MANAGER_REGION | | (optional, commented out) aws_secrets_manager: AWS default credential chain. |
AWS_SECRETS_MANAGER_ENDPOINT | | (optional, commented out) aws_secrets_manager: AWS default credential chain. |
CACHE_KEY_PREFIX | usertasks: | (optional, commented out) CACHE_PROVIDER: where rate-limit windows (API keys, OAuth tokens, sign-in, agent runs, signups), credential / settings cache invalidations and idempotency claims live. memory (default): per instance, as before — with several replicas every limit multiplies by the replica count. postgres: an UNLOGGED table in this database (migration 20261108000000), no extra service. redis: Redis / Valkey / KeyDB / Dragonfly, Azure Cache for Redis, Memorystore, ElastiCache (rediss:// for TLS). Other processes see a revoked credential or a changed instance setting within CACHE_INVALIDATION_CHECK_MS (default 1000). |
CACHE_INVALIDATION_CHECK_MS | 1000 | (optional, commented out) CACHE_PROVIDER: where rate-limit windows (API keys, OAuth tokens, sign-in, agent runs, signups), credential / settings cache invalidations and idempotency claims live. memory (default): per instance, as before — with several replicas every limit multiplies by the replica count. postgres: an UNLOGGED table in this database (migration 20261108000000), no extra service. redis: Redis / Valkey / KeyDB / Dragonfly, Azure Cache for Redis, Memorystore, ElastiCache (rediss:// for TLS). Other processes see a revoked credential or a changed instance setting within CACHE_INVALIDATION_CHECK_MS (default 1000). |
CACHE_REDIS_URL | redis://valkey:6379 | (optional, commented out) CACHE_PROVIDER: where rate-limit windows (API keys, OAuth tokens, sign-in, agent runs, signups), credential / settings cache invalidations and idempotency claims live. memory (default): per instance, as before — with several replicas every limit multiplies by the replica count. postgres: an UNLOGGED table in this database (migration 20261108000000), no extra service. redis: Redis / Valkey / KeyDB / Dragonfly, Azure Cache for Redis, Memorystore, ElastiCache (rediss:// for TLS). Other processes see a revoked credential or a changed instance setting within CACHE_INVALIDATION_CHECK_MS (default 1000). |
CACHE_REDIS_USERNAME | | (optional, commented out) CACHE_PROVIDER: where rate-limit windows (API keys, OAuth tokens, sign-in, agent runs, signups), credential / settings cache invalidations and idempotency claims live. memory (default): per instance, as before — with several replicas every limit multiplies by the replica count. postgres: an UNLOGGED table in this database (migration 20261108000000), no extra service. redis: Redis / Valkey / KeyDB / Dragonfly, Azure Cache for Redis, Memorystore, ElastiCache (rediss:// for TLS). Other processes see a revoked credential or a changed instance setting within CACHE_INVALIDATION_CHECK_MS (default 1000). |
CACHE_REDIS_PASSWORD | | (optional, commented out) CACHE_PROVIDER: where rate-limit windows (API keys, OAuth tokens, sign-in, agent runs, signups), credential / settings cache invalidations and idempotency claims live. memory (default): per instance, as before — with several replicas every limit multiplies by the replica count. postgres: an UNLOGGED table in this database (migration 20261108000000), no extra service. redis: Redis / Valkey / KeyDB / Dragonfly, Azure Cache for Redis, Memorystore, ElastiCache (rediss:// for TLS). Other processes see a revoked credential or a changed instance setting within CACHE_INVALIDATION_CHECK_MS (default 1000). |
CACHE_REDIS_DB | | (optional, commented out) CACHE_PROVIDER: where rate-limit windows (API keys, OAuth tokens, sign-in, agent runs, signups), credential / settings cache invalidations and idempotency claims live. memory (default): per instance, as before — with several replicas every limit multiplies by the replica count. postgres: an UNLOGGED table in this database (migration 20261108000000), no extra service. redis: Redis / Valkey / KeyDB / Dragonfly, Azure Cache for Redis, Memorystore, ElastiCache (rediss:// for TLS). Other processes see a revoked credential or a changed instance setting within CACHE_INVALIDATION_CHECK_MS (default 1000). |
CACHE_REDIS_AUTH | password | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_TLS | | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_TLS_CA_FILE | | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_TLS_SERVERNAME | | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_TLS_REJECT_UNAUTHORIZED | true | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_ENTRA_SCOPE | https://redis.azure.com/.default | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_AWS_CACHE_NAME | | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_AWS_REGION | | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_AWS_SERVICE | elasticache | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_AWS_SERVERLESS | false | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
CACHE_REDIS_COMMAND_TIMEOUT_MS | 2000 | (optional, commented out) CACHE_REDIS_AUTH: password (default), entra (Azure: Entra ID token for the managed identity whose object id is CACHE_REDIS_USERNAME) or gcp_iam (Memorystore IAM auth with Application Default Credentials) or aws_iam (ElastiCache / MemoryDB IAM auth: CACHE_REDIS_USERNAME is the IAM-enabled user id, CACHE_REDIS_AWS_CACHE_NAME the replication group / serverless cache / MemoryDB cluster; tokens are signed with the task role and re-sent every 14 minutes; TLS on by default). |
KMS_REFRESH_SECONDS | 60 | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
KMS_ACTIVATION_SECONDS | 120 | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
VAULT_TRANSIT_KEY | usertasks | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
VAULT_TRANSIT_MOUNT | transit | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
AWS_KMS_KEY_ID | alias/usertasks | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
AWS_KMS_REGION | | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
AWS_KMS_ENDPOINT | | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
AZURE_KMS_KEY_ID | https://my-vault.vault.azure.net/keys/usertasks | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
AZURE_KMS_KEY_ALGORITHM | RSA-OAEP-256 | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
GCP_KMS_KEY_NAME | projects/p/locations/l/keyRings/r/cryptoKeys/k | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
GCP_KMS_CREDENTIALS_JSON | | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
GCP_KMS_ENDPOINT | | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
AUTH_PROVIDER | builtin keeps accounts, bcrypt hashes and sessions in this | (optional, commented out) KMS_PROVIDER: the key-encryption key for envelope encryption of stored secrets. env (default): ENCRYPTION_KEY; without data keys (nobody ran usertasks-admin kms rotate) secrets are enc:v1 with ENCRYPTION_KEY, as before. vault_transit (Vault / OpenBao Transit; VAULT_ADDR and Vault auth as above), aws_kms, azure_key_vault (Key Vault key / Managed HSM), gcp_kms. Data keys are unwrapped at startup (other providers fail closed) and picked up by running processes every KMS_REFRESH_SECONDS; a rotated key is used for new values KMS_ACTIVATION_SECONDS after kms rotate. |
AUTH_DATABASE_URL | | (optional, commented out) Postgres (schema app_auth; migration 20261106100000_builtin_auth.sql) instead of Supabase Auth: email + password, invitations, confirmation and reset emails through EMAIL_PROVIDER, plus any OIDC / SAML IdPs in AUTH_SSO_PROVIDERS. AUTH_PROVIDER=oidc or saml: SSO only (no passwords). Needs DATABASE_URL (or AUTH_DATABASE_URL), APP_URL (links and redirect URIs) and, with DB_PROVIDER=supabase or REALTIME_PROVIDER=supabase, SUPABASE_JWT_SECRET (the session's database identity is a short-lived token signed with it). Migrate existing Supabase users first (docs: Infrastructure → Auth); everyone signs in again after the switch. |
AUTH_DATABASE_POOL_MAX | 5 | (optional, commented out) Postgres (schema app_auth; migration 20261106100000_builtin_auth.sql) instead of Supabase Auth: email + password, invitations, confirmation and reset emails through EMAIL_PROVIDER, plus any OIDC / SAML IdPs in AUTH_SSO_PROVIDERS. AUTH_PROVIDER=oidc or saml: SSO only (no passwords). Needs DATABASE_URL (or AUTH_DATABASE_URL), APP_URL (links and redirect URIs) and, with DB_PROVIDER=supabase or REALTIME_PROVIDER=supabase, SUPABASE_JWT_SECRET (the session's database identity is a short-lived token signed with it). Migrate existing Supabase users first (docs: Infrastructure → Auth); everyone signs in again after the switch. |
AUTH_SSO_PROVIDERS | | (optional, commented out) JSON array of identity providers, e.g. [{"id":"entra","type":"oidc","preset":"entra","tenantId":"…","clientId":"…","clientSecret":"secret://entra-client-secret","defaultOrg":"acme"}] OIDC redirect URI: <APP_URL>/auth/sso/<id>/callback. SAML ACS: <APP_URL>/auth/saml/<id>/acs, SP metadata <APP_URL>/auth/saml/<id>/metadata. |
AUTH_ALLOW_SIGNUP | false | (optional, commented out) Anyone may create a password account (default: invited emails only). |
AUTH_REQUIRE_EMAIL_CONFIRMATION | true | (optional, commented out) Confirmation email before the first password sign-in (default true). |
AUTH_SESSION_IDLE_HOURS | 168 | (optional, commented out) Sessions: rolling idle timeout in hours (default 168) and absolute lifetime in days (default 30). Lockout after N wrong passwords for M minutes. |
AUTH_SESSION_MAX_DAYS | 30 | (optional, commented out) Sessions: rolling idle timeout in hours (default 168) and absolute lifetime in days (default 30). Lockout after N wrong passwords for M minutes. |
AUTH_LOCKOUT_THRESHOLD | 10 | (optional, commented out) Sessions: rolling idle timeout in hours (default 168) and absolute lifetime in days (default 30). Lockout after N wrong passwords for M minutes. |
AUTH_LOCKOUT_MINUTES | 15 | (optional, commented out) Sessions: rolling idle timeout in hours (default 168) and absolute lifetime in days (default 30). Lockout after N wrong passwords for M minutes. |
AUTH_PASSWORD_MIN_LENGTH | 8 | (optional, commented out) Sessions: rolling idle timeout in hours (default 168) and absolute lifetime in days (default 30). Lockout after N wrong passwords for M minutes. |
AUTH_COOKIE_SECURE | | (optional, commented out) Force the Secure flag on auth cookies on/off (default: on unless APP_URL is http://). |