Environment variable reference
These tables cover the existing configuration groups from committed *.env.example files and root compose.yaml. The unified stack reads the motherrepo root .env. Standalone examples apply only to their separate entrypoints.
Start with environment configuration. For provider prerequisites, use account login, Microsoft Graph, and Google Cloud.
A template value is not always a code default. Empty required fields need deployment values. Keep credentials private. Ports are integer host ports where a supported override exposes one. Empty and absent overrides can differ.
ECS_EFFECTIVE_* values are internal outputs. The runtime derives them from validated local/remote inputs. Never add them to a user configuration or archive. Secret-bearing Java configuration must not enter logs.
Root runtime and infrastructure
| Variable or group | Meaning | Default, format, and consumer |
|---|---|---|
ECAS_BOOTSTRAP_ADMIN_EMAIL | First administrator email address. | Empty. Required for root Compose resolution. Account consumes it during bootstrap. |
ECAS_BOOTSTRAP_ADMIN_PASSWORD | First administrator password. | Empty. Supply a private 32–64-character password. Required for Compose resolution even after bootstrap. |
ECS_INSTANCE_ID | Lowercase instance name for stack, hostnames, and resource namespace. | Empty. Required during setup, for example devbox. |
ECS_APPLICATION_SOURCE_ROOT | Absolute application source path for builds and mounts. | . uses this checkout. Optional. Runtime and Compose consume it. |
ECS_MEMORY_GIB | Total application container-memory budget in GiB. Host reserve is additional. | Example 40, omitted runtime default 30. Accepted: 8, 12, 16, 30, 35, 40, 44. Development floors increase at 30 and 35 GiB. |
POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB | PostgreSQL initialization user, password, and database. | postgres, empty password, mailGen. Password required. Application connections must match the initialized database. |
S3_ACCESS_KEY, S3_SECRET_KEY, S3_BUCKET_EMAIL_BODIES, S3_REGION | SeaweedFS S3 access identity, secret, bucket, and AWS-style region. | Empty credentials, ecas, us-east-1. Required for BFF/backend/.NET object access. |
SEAWEEDFS_ADMIN_PASSWORD | SeaweedFS administration password. Separate from the S3 secret. | Empty. Supply a private value for local provisioning. |
KAFKA_CLUSTER_ID | Persistent Kafka cluster identity in Kafka's Base64 UUID representation. | Empty. Required for bootstrap/ownership. Preserve it with existing data. |
KAFKA_APP_PASSWORD, KAFKA_ADMIN_PASSWORD, KAFKA_UI_PASSWORD | Separate Kafka application, administration, and UI passwords. | Empty. Required by active Kafka services and their clients. |
INTERNAL_PROXY_SECRET, KEYSTORE_INTERNAL_TOKEN | Internal proxy authentication and KeyStore API token. | Empty. Required by enabled internal APIs. Match values across consumers. |
DRAGONFLY_PASSWORD, REDIS_VIEWER_PASSWORD | Dragonfly authentication and read-only Redis viewer password. | Empty. Both required for root Compose resolution, including when you do not use the viewer. |
CLOUDFLARE_TOKEN, CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_ZONE_ID | Cloudflare API token, account ID, and zone ID. | No credential default. Selected account/zone IDs must each contain 32 hexadecimal characters. The management token needs account Tunnel Write and zone DNS Edit/Read plus Zone Read. See ingress and ownership recovery. |
BFF_MICROSOFT_CLIENT_ID, BFF_MICROSOFT_CLIENT_SECRET, BFF_MICROSOFT_TENANT_ID | Microsoft application-login client ID, secret, and tenant ID. | Empty. Required for Microsoft login. Separate from backend Graph access. |
BACKEND_TENANT_ID, BACKEND_CLIENT_ID, BACKEND_CLIENT_SECRET | Backend bootstrap and current GraphOneTimeUserOnboarder app-only Graph identity. | Empty, no credential default. Required for these Microsoft runtimes, including standalone Graph worker execution. Root Compose forwards the names unchanged. Separate from BFF_MICROSOFT_* application login. |
GRAPH_WEBHOOK_URL, GRAPH_LIFECYCLE_WEBHOOK_URL | Public HTTPS notification and lifecycle callback URLs. | Empty. Required for subscriptions. Use this deployment's own domain/tunnel. |
GRAPH_WEBHOOK_CLIENT_STATE | Stable Graph callback validation secret. | Empty. Maximum 128 characters. Retain it for active subscriptions. |
DELTA_LINK_ENCRYPTION_KEY | Base64 encoding of exactly 32 random bytes. | Empty. Required for retained encrypted Graph delta state. Do not rotate without recovery/migration. |
ECS_DEPLOYMENT_MODE, ECS_REMOTE_SIMULATION | Infrastructure placement and local simulation selectors. | fulllocal / partialRemote, true / false. Missing values mean fulllocal / false. |
REMOTE_KAFKA_BOOTSTRAP_SERVERS | Comma-separated remote broker host:port list. | Example broker1:9092,broker2:9092,broker3:9092 is local simulation data. Replace with reachable remote endpoints. |
REMOTE_KAFKA_SECURITY_PROTOCOL, REMOTE_KAFKA_SASL_MECHANISM | Remote Kafka protocol and SASL mechanism. | Example sasl_plaintext, PLAIN. Real plaintext requires canonical Tailscale IPv4 endpoints. Otherwise use sasl_ssl. |
REMOTE_KAFKA_APP_USERNAME, REMOTE_KAFKA_APP_PASSWORD, REMOTE_KAFKA_ADMIN_USERNAME, REMOTE_KAFKA_ADMIN_PASSWORD | Separate remote application and administrator credentials. | Example references local variables. Use those only when they match the remote cluster. |
REMOTE_KAFKA_EXPECTED_CLUSTER_ID | Expected existing remote Kafka cluster identity. | Example references KAFKA_CLUSTER_ID. Required for remote ownership checks. |
REMOTE_CLAMAV_HOST, REMOTE_CLAMAV_PORT | Private TCP scanner host and port. | Example clamav, 3310. Use only for an approved TCP scanner. A Docker hostname is not a remote private IP. |
REMOTE_CLAMAV_SCAN_URL, REMOTE_CLAMAV_SCAN_TOKEN | Exact HTTPS scanner /scan URL and bearer token. | Empty. Supply both for HTTPS scanning. Real remote mode requires authenticated transport. |
REMOTE_COLLABORA_URL | Collabora HTTP(S) origin without credentials or endpoint path. | Example http://collabora:9980. Required for remote Office preview. |
REMOTE_WOPI_ORIGIN, REMOTE_WOPI_ALLOWED_CIDRS | Local BFF callback origin and permitted renderer source CIDRs. | Example http://bff:5173, empty CIDRs. Real remote mode needs a reachable callback and narrow source allowlist. |
WOPI_CALLBACK_MODE, WOPI_TAILSCALE_HOST, WOPI_TAILSCALE_BIND_IP, WOPI_TAILSCALE_PORT | Callback mode and local Tailscale hostname, bind IP, and port. | private, empty binding values. Required for tailscale-proof; identify this developer machine. |
REMOTE_KNOWLEDGE_EXTRACTOR_URL, REMOTE_KNOWLEDGE_EXTRACTOR_TOKEN | Extractor origin and separate service token. | Example http://knowledge-extractor:9998, empty token. Real remote mode requires the authenticated HTTPS pair. |
REMOTE_QDRANT_URL, REMOTE_QDRANT_API_KEY | Qdrant origin and API key. | Example http://qdrant:6333, local key reference. Use actual remote credentials in real remote mode. |
Additional Compose inputs
| Variable or group | Meaning | Default, format, and consumer |
|---|---|---|
ACCOUNT_LOCALHOST_ENABLED, ACCOUNT_LOGIN_ENABLED, BFF_LOCALHOST_ENABLED, FORMGEN_LOCALHOST_ENABLED | Account/BFF/FormGen localhost and login feature selectors. | Unified ACCOUNT_LOGIN_ENABLED defaults true. ACCOUNT_LOCALHOST_ENABLED, BFF_LOCALHOST_ENABLED, and FORMGEN_LOCALHOST_ENABLED default false. BFF standalone schema defaults account login false. Account login routes and localhost integration consume different flags. |
ANTHROPIC_API_KEY, GOOGLE_AI_KEY, NEBIUS_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY | AI provider API keys. | No public default. Supply secrets only for the selected provider's features. |
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, S3_BUCKET | Other AWS-compatible integrations: access key, secret, region, and bucket. | Service-specific optional inputs. They do not replace canonical Graph body S3_* settings. |
BFF_GOOGLE_CLIENT_ID, BFF_GOOGLE_CLIENT_SECRET, BFF_GOOGLE_LOGIN_CLIENT_ID, BFF_GOOGLE_LOGIN_CLIENT_SECRET | Google application identity and separate login OAuth credential fields. | Empty. Supply a complete selected client pair. Client secrets remain private. |
BFF_KEYCLOAK_CLIENT_ID, BFF_KEYCLOAK_CLIENT_SECRET, BFF_KEYCLOAK_ISSUER | BFF Keycloak OIDC client ID, secret, and issuer. | Forwarded compatibility fields, empty by default. Current Account/BFF login-provider factory selects Microsoft and Google, not Keycloak. No current consumer for these BFF-specific Keycloak inputs was found. FormGen has its own separate Keycloak configuration. |
BFF_STATUS_CONSUMER_GROUP, BFF_REALTIME_CONSUMER_GROUP, KAFKA_CONSUMER_GROUP_PREFIX | Kafka status/realtime group names and group prefix. | Unified BFF_STATUS_CONSUMER_GROUP defaults empty and has no current BFF/backend production-source read. BFF realtime group defaults bff-graph-sync-realtime-v1. Backend group prefix defaults empty, accepts only ASCII letters/digits/dot/underscore/hyphen, and is prepended unchanged. Group changes affect offsets. |
BODY_ENCRYPTION_ALLOW_LEGACY_READ, BODY_ENCRYPTION_REQUIRED | Legacy plaintext-read permission and a forwarded compatibility flag. | BODY_ENCRYPTION_ALLOW_LEGACY_READ defaults false; only literal true enables it, excluding owners in EMAIL_ENCRYPTION_MIGRATED_OWNERS. Compose forwards BODY_ENCRYPTION_REQUIRED with default true, but current BFF/backend production code does not read it. Required encryption comes from owner/group policy. It is not a working override. Preserve policy and read encryption settings. |
COMPLEXITY_GETTER_PORT, COMPLEXITY_SERVICE_PORT, COMPLEXITY_UPLOAD_PORT, COMPLEXITY_MAX_PARALLEL_RUNS, MAX_ACTORS_PER_COMPLEXITY_PARTITION | Complexity WebSocket/API ports, parallel-run limit, and actors per partition. | Compose service/getter/upload ports default to 6590/6591/6592. BFF validates service/getter ports as integers 1–65535. Parallel runs default to 4, clamped to 1–32 by BFF/backend admission. Actors per partition default to 1, floored and clamped to at least 1 by command-outbox code. These are internal service settings, not published host ports. |
DEV_DOMAIN_SUFFIX | Instance hostname suffix. | ecas.local. Runtime combines it with the instance ID for proxy hosts. |
DOCUSAURUS_MCP_ENABLED | Docusaurus MCP sidecar selector. | Default false in Compose. The lifecycle sets true when selecting docs-mcp. Docusaurus configuration consumes it to enable the sidecar integration. |
DOTNET_USE_POLLING_FILE_WATCHER, WATCHPACK_POLLING, FORMGEN_WATCHPACK_POLLING | .NET/Watchpack/FormGen file-polling switches. | Unified Watchpack and .NET polling default to false. FormGen forwarding also defaults false. The corresponding development watcher consumes the flag. Use only for missing bind-mount notifications; polling can increase CPU use. |
ECS_CPUSET | Shared logical CPU list for runtime services. | Optional, for example 0-19. Launcher adapts an omitted value to Docker-visible CPUs. |
ECS_BUILD_CPUSET | Logical CPU list for production builds. | Optional, for example 0-7. Launcher derives up to 20 CPUs independently. Raw production Compose falls back to ECS_CPUSET, then 0-19. |
ECS_MEMORY_MODE, ECS_SWAP_GIB | Memory mode and additional swap budget in GiB. | bounded by default, or hybrid. Swap default 4, accepted 0–8. Hybrid needs systemd cgroups v2 and passwordless sudo systemctl. |
ECS_PROXY_STATE_DIR, ECS_NPM_CONTAINER_ID, PROXY_ADMIN_BIND_IP, NPM_ADMIN_EMAIL, NPM_ADMIN_PASSWORD, NPM_HTTP_PORT, NPM_HTTPS_PORT, NPM_ADMIN_PORT | Shared NPM state directory/container, administration binding/login, and HTTP/HTTPS/admin ports. | State path automatic. Admin bind 127.0.0.1. Ports must avoid conflicts. Password is secret. |
ECS_CLONE_ROOT, ECS_UID, ECS_GID | Absolute clone root and numeric host user/group IDs. | Runtime-generated mount-ownership inputs. Do not set manually in root configuration. |
ECS_TEST_INSTANCE | Isolated-test marker. | Generated by test setup. Do not use it as a manual root input. |
ECAS_DEPLOYMENT_TENANT_ID | Stable deployment authorization tenant UUID. | Required explicitly for Google-only/personal deployments. It is not an email address or domain. |
EMAIL_FROM, SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD | Outgoing email sender and SMTP host, port, user, password. | Empty, port integer. Required only by the selected email sender. |
ENCRYPTION_KEY, LLM_DB_DECRIPTION_KEY | Legacy key inputs forwarded to BFF/backend. | Empty defaults. They do not replace delta, mailbox, or administration keys. Preserve existing legacy values. |
MAILBOX_CONTENT_KEK_KEYS_JSON | Strict JSON array of mailbox key-encryption-key versions. | Compose default []. Example item: {"reference":"mailbox-v1","version":1,"keyPath":"/runtime/mailbox-content-keys/mailbox-kek"}. Version is positive; file must be container-readable. KeyStore consumes the list. |
MAILBOX_CONTENT_KEK_REFERENCE, MAILBOX_CONTENT_KEK_VERSION | Active key-encryption-key reference and positive integer version. | Unified Compose defaults both to empty. Supply a nonempty reference and positive integer version matching exactly one JSON entry. mailbox-v1 / 1 is an example, not an automatic active key. KeyStore consumes the pair. Retain older versions during rotation. |
MAILBOX_CONTENT_KEY_SECRET_DIRECTORY | Host directory mounted for mailbox key-encryption-key files. | Unified host default ./.docker-state/mailbox-content-keys, mounted read-only at /runtime/mailbox-content-keys. JSON keyPath values must use container-readable paths. Each selected file contains Base64 for exactly 32 bytes. KeyStore reads them. |
FORMGEN_AUTH_TRUSTED_IP_HEADER | Name of a trusted proxy's client-IP header. | Use only a header the trusted proxy overwrites. FormGen consumes it. |
FORMGEN_BETTERAUTH_SECRET, FORMGEN_BETTERAUTH_URL, FORMGEN_MYSQL_PASSWORD | FormGen auth session secret, public origin, and MySQL password. | Private values and own HTTPS origin. Required by the FormGen profile. |
FORMGEN_CDN_MAX_SIZE | Compatibility value forwarded as CDN_MAX_SIZE. | Compose default 10. No current FormGen upload-code consumer was found. Its unit is undefined, and changing it does not tune the implemented upload limits. See actual FormGen limits. |
FORMGEN_DEFAULT_REGISTER_ROLE | Initial role for public FormGen registration. | MEMBER or GUEST. Default/fallback is GUEST unless the value is exactly MEMBER. |
FORMGEN_SITE_INVITE_ONLY | Require an invitation for FormGen registration. | Default true. Set false only to permit public registration. |
FORMGEN_GOOGLE_CLIENT_ID, FORMGEN_GOOGLE_CLIENT_SECRET, FORMGEN_KEYCLOAK_CLIENT_ID, FORMGEN_KEYCLOAK_CLIENT_SECRET, FORMGEN_KEYCLOAK_ISSUER, FORMGEN_MICROSOFT_CLIENT_ID, FORMGEN_MICROSOFT_CLIENT_SECRET, FORMGEN_MICROSOFT_TENANT_ID | FormGen OAuth client credentials and Keycloak issuer. | Empty/provider URL/private secrets. Supply only for enabled FormGen login providers. |
FORMGEN_SMTP_HOST, FORMGEN_SMTP_PORT, FORMGEN_SMTP_USER, FORMGEN_SMTP_PASSWORD, FORMGEN_SMTP_SECURE | FormGen SMTP host, integer port, credentials, and TLS flag. | Unified defaults: host formgen-mailcatcher, port 1025, secure false, user noreply@mailcatcher.test, and a local-only development password. Do not reuse that password for production. FormGen requires all connection fields and reads port with parseInt. Without a standalone secure value, it defaults to whether NODE_ENV is production; a supplied value is trimmed and compared case-insensitively to true. |
FORMGEN_WATCHPACK_POLLING | FormGen file-polling selector. | Compose default false, forwarded as WATCHPACK_POLLING to FormGen development. Use true when bind-mount watcher events are missing. |
GOOGLE_APP_LOGIN_CALLBACK_URL, GOOGLE_APP_LOGIN_ENABLED, GOOGLE_APP_LOGIN_PROXY_SECRET | Google app-login callback, enable flag, and internal proxy secret. | Default disabled. Exact HTTPS /api/auth/callback/google, no query/fragment/credentials. Proxy secret at least 32 characters. |
GOOGLE_DIRECTORY_POLICIES_JSON | Google directory policy JSON array. | Each item has UUID workspaceConnectionId, boolean directoryEnabled, optional string array visibleGroupIds, and optional oauthMailboxBindings with UUID mailbox/credential source IDs and string directory user ID. Empty means no explicit policy. |
GOOGLE_PUBSUB_CONFIG_JSON | Google push-routing JSON array. | Each item needs topicName, subscriptionId, exact HTTPS /v1/pubsub/push pushAudience, pushServiceAccountEmail, pushServiceAccountSubject, and oauthClientId or workspaceCredentialReference. Topic/subscription must share a project. IAM is separate from mailbox consent. |
GOOGLE_MAILBOX_BFF_COMPLETION_URL, GOOGLE_MAILBOX_CALLBACK_URL, GOOGLE_MAILBOX_CLIENT_ID, GOOGLE_MAILBOX_CLIENT_SECRET_PATH, GOOGLE_MAILBOX_GRANT_KEY_REFERENCE, GOOGLE_MAILBOX_OAUTH_ENABLED, GOOGLE_MAILBOX_SECRET_DIRECTORY, GOOGLE_MAILBOX_SYNC_ENABLED, GOOGLE_MAILBOX_WATCH_ENABLED | Google mailbox OAuth/sync/watch settings, client ID, secret directory/path, grant-key reference, and callback/completion URLs. | Flags default false. Callback is HTTPS /v1/oauth/callback. Completion is /api/google-mailbox/complete on MAILGEN_PUBLIC_URL. No URL credentials/query/fragment. Secret file contains raw nonempty secret, not exported JSON. Login client is separate. |
GOOGLE_QUOTA_REDIS_URL | Redis/Dragonfly URL for shared Google API quota coordination. | redis://<host>:<port>. Can contain credentials. Used by concurrent Google workers. |
GOOGLE_MAILBOX_CLIENT_SECRET_PATH | Dedicated mailbox OAuth client-secret file. | Container-readable secret mount. Raw nonempty text, not OAuth export JSON. Required when mailbox client ID is configured. |
GOOGLE_MAILBOX_GRANT_KEY_PATH | Mailbox OAuth grant-encryption key file. | Container-readable path. Base64 content must decode to exactly 32 bytes. Preserve it with existing grants. |
GOOGLE_WORKSPACE_CREDENTIALS_JSON, GOOGLE_WORKSPACE_SECRET_DIRECTORY | Workspace credential allowlist and service-account secret directory. | Default [], /run/secrets/google. Each entry has reference, absolute container-readable keyPath, directoryAdminSubject, and approvedScopes array. Used for domain-wide delegation. |
KAFKA_TOPIC_BFF_COMMANDS, KAFKA_TOPIC_BFF_COMMANDS_DLQ, KAFKA_TOPIC_COMPLEXITY_COMMANDS, KAFKA_TOPIC_COMPLEXITY_DLQ, KAFKA_TOPIC_COMPLEXITY_NOTIFICATIONS, KAFKA_TOPIC_EMAIL_SCHEDULER_COMMANDS, KAFKA_TOPIC_EMAIL_SCHEDULER_DLQ, KAFKA_TOPIC_GRAPH_SYNC_APPLY, KAFKA_TOPIC_GRAPH_SYNC_DLQ, KAFKA_TOPIC_GRAPH_SYNC_FETCH, KAFKA_TOPIC_GRAPH_SYNC_NOTIFICATIONS, KAFKA_TOPIC_GRAPH_SYNC_PROJECTION, KAFKA_TOPIC_GRAPH_SYNC_TRIGGERS, KAFKA_TOPIC_INDEPENDENT_COMMANDS, KAFKA_TOPIC_INDEPENDENT_COMMANDS_DLQ, KAFKA_TOPIC_MAILBOX_STATUS, KAFKA_TOPIC_MAILBOX_STATUS_DLQ, KAFKA_TOPIC_MOCK_ORDERS, KAFKA_TOPIC_MOCK_PAGEVIEWS, KAFKA_TOPIC_MOCK_USERS, KAFKA_TOPIC_ONBOARDING_COMMANDS, KAFKA_TOPIC_ONBOARDING_DLQ, KAFKA_TOPIC_ONBOARDING_ERRORS, KAFKA_TOPIC_ONBOARDING_LIFECYCLE, KAFKA_TOPIC_QUEUEPROCESSOR_COMMANDS, KAFKA_TOPIC_QUEUEPROCESSOR_COMMANDS_DLQ, KAFKA_TOPIC_SEARCH_COMMANDS, KAFKA_TOPIC_SEARCH_COMMANDS_DLQ, KAFKA_TOPIC_USER_CREATED, KAFKA_TOPIC_USER_CREATED_DLQ, KAFKA_TOPIC_APP_REALTIME | Separate command, event, projection, status, onboarding, search, and dead-letter topic names. | Format example app.<domain>.<action>.v1. Match name/version across producers and consumers. A DLQ suffix denotes failed events. |
KEYSTORE_CACHE_TTL_SECONDS, KEYSTORE_LEASE_SECONDS, KEYSTORE_INTERNAL_TOKEN | KeyStore cache and lease lifetimes in seconds, plus internal API token. | KeyStore lease default 3600 seconds; cache default 300 seconds. Each accepts integers 1–86400. Effective cache is min(cache, lease). Backend/internal clients must use the matching private API token. See personal-key runtime. |
KNOWLEDGE_QDRANT_COLLECTION, QDRANT_API_KEY | Qdrant collection name and API key. | Collection default ecas_knowledge_small_1536. Names accept 1–64 ASCII letters, digits, underscores, or hyphens. lib/knowledge/vectors.ts validates the name and requires Qdrant URL/API key. The collection contract uses 1536-dimensional Cosine vectors. API key has no public default. |
MAX_USERS_PER_Q | Legacy Q-worker users-per-partition capacity. | Positive integer. Do not confuse it with MAX_USERS_PER_QueProcessor_PARTITION. |
MICROSOFT_CONNECTOR_ENABLED | Microsoft connector selector. | true / false, default enabled. Prepare credentials before enabling it. |
BETTER_AUTH_URL, NEXT_PUBLIC_BETTER_AUTH_URL | Better Auth server and browser origins. | Unified values both use Account HTTPS, for example https://account.<instance>.<suffix>:8443. Standalone BFF localhost examples serve a different entrypoint. Never put a secret here. |
OPENSEARCH_INDEX, OPENSEARCH_ENCRYPTED_INDEX | Plain and encrypted email-index names. | emails-onboarding, optional empty encrypted name. Configure the migration index for encrypted rollout. |
POSTGRES_CONNECTION_STRING | Npgsql connection string, not a URI. | Setup derives it from PostgreSQL inputs. Syntax Host=...;Port=...;Database=...;Username=...;Password=.... Quote/escape separators. Compose forwards it unchanged to .NET. DATABASE_URL and BETTERAUTH_DATABASE_URL are separate PostgreSQL URIs. |
REDIS_VIEWER_USER, REDIS_VIEWER_PASSWORD | Read-only Redis viewer username and password. | User admin, private password. Password always required for unified Compose resolution. Separate from application credentials. |
RESEND_SECRET | Resend API secret. | Secret-store value. Required only for Resend email delivery. |
SEED_ADMIN_EMAIL, SEED_ADMIN_NAME, SEED_ADMIN_PASSWORD | Development seed administrator email, name, and password. | Local seed/bootstrap inputs. They do not replace production user provisioning. |
WOPI_TAILSCALE_BIND_IP, WOPI_TAILSCALE_HOST, WOPI_TAILSCALE_PORT | Local Tailscale callback bind IP, hostname, and HTTPS port. | Own node values. Required for tailscale-proof, with matching network access and certificate trust. |
Optional Office callback domain
Use the private Office callback setup guide for prerequisites and the explicit setup command.
| Variable | Consumer | Purpose | Type or format | Required when | Default | Example | Constraints or security |
|---|---|---|---|---|---|---|---|
WOPI_CALLBACK_DOMAIN_SUFFIX | docker/runtime/setup_environment.py, test_instance_environment.py, office_validation.py, and office.py; root compose.yaml; docker/proxy/setup_office_callback.py | Derive a separate callback origin and select private mode. | Lowercase DNS suffix with at least two labels. | Optional. Explicit callback setup requires a nonempty value in the target. | Empty in .env.example and Compose. Empty preserves previous callback settings. | ecs.t42.hu | Each label follows DNS syntax. Suffix and full hostname must each fit 253 characters. Derivation uses ECS_PUBLIC_HOST_PREFIX, ECS_ORIGIN_DEPLOYMENT_ID (fallback: ECS_INSTANCE_ID), and NPM_HTTPS_PORT (fallback: 8443). A nonempty suffix derives REMOTE_WOPI_ORIGIN and forces WOPI_CALLBACK_MODE=private. Setup requires prefix test, renderer Tailscale IPv4 /32 source CIDRs within 100.64.0.0/10, and an existing shared HTTPS listener. Apply configuration through the normal runtime lifecycle. |
Generated runtime outputs
| Variable or group | Meaning | Default, format, and consumer |
|---|---|---|
ECS_EFFECTIVE_CLAMAV_HOST, ECS_EFFECTIVE_CLAMAV_PORT | Selected scanner TCP host and port. | Internal runtime output from local/remote scanner inputs. Used by scanner clients. |
ECS_EFFECTIVE_COLLABORA_CONVERT_URL, ECS_EFFECTIVE_COLLABORA_INTERNAL_URL | Selected Office conversion endpoint and internal WOPI origin. | Internal runtime output from Collabora/callback configuration. Used by BFF/FormGen. |
ECS_EFFECTIVE_KAFKA_ADMIN_PASSWORD, ECS_EFFECTIVE_KAFKA_ADMIN_USERNAME, ECS_EFFECTIVE_KAFKA_APP_PASSWORD, ECS_EFFECTIVE_KAFKA_APP_USERNAME, ECS_EFFECTIVE_KAFKA_CLUSTER_ID, ECS_EFFECTIVE_KAFKA_INTERNAL_BOOTSTRAP_SERVERS, ECS_EFFECTIVE_KAFKA_LAN_BOOTSTRAP_SERVERS, ECS_EFFECTIVE_KAFKA_NETWORK, ECS_EFFECTIVE_KAFKA_SASL_MECHANISM, ECS_EFFECTIVE_KAFKA_SECURITY_PROTOCOL, ECS_EFFECTIVE_KAFKA_TAILSCALE_BOOTSTRAP_SERVERS | Validated active Kafka credentials, cluster identity, network, protocol, mechanism, and endpoints. | Internal runtime output from local and REMOTE_KAFKA_* inputs. Used by application clients. |
ECS_EFFECTIVE_KAFKA_JAVA_ADMIN_JAAS_CONFIG, ECS_EFFECTIVE_KAFKA_JAVA_SASL_MECHANISM, ECS_EFFECTIVE_KAFKA_JAVA_SECURITY_PROTOCOL, ECS_EFFECTIVE_KAFKA_JAVA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM | Java-formatted Kafka SASL/TLS client configuration. | Runtime-generated for Java tooling/Kafka UI. Can contain credentials. Never log it. |
ECS_EFFECTIVE_KAFKA_LAB_OVERRIDE | Selected Kafka laboratory Compose override. | Internal output from placement parsing, consumed by the lab configuration. |
ECS_EFFECTIVE_KNOWLEDGE_EXTRACTOR_URL, ECS_EFFECTIVE_QDRANT_API_KEY, ECS_EFFECTIVE_QDRANT_URL | Selected extractor/Qdrant endpoints and Qdrant API key. | Internal output from remote/local settings. Used by service containers. |
ECS_EFFECTIVE_WOPI_ALLOWED_CIDRS, ECS_EFFECTIVE_WOPI_CALLBACK_MODE, ECS_EFFECTIVE_WOPI_INTERNAL_ORIGIN, ECS_EFFECTIVE_WOPI_PROOF_MODE | Validated WOPI origin, callback policy, source CIDRs, and proof mode. | Internal output from REMOTE_WOPI_* / WOPI_*, used by Office/BFF. |
Backend, BFF, and .NET services
| Variable or group | Meaning | Default, format, and consumer |
|---|---|---|
DATABASE_URL, BETTERAUTH_DATABASE_URL, POSTGRES_CONNECTION_STRING | PostgreSQL URI or Npgsql connection string. | Example database mailGen. Better Auth uses schema betterauth. Required by the corresponding application. Keep database credentials consistent. |
NODE_ENV, HOST, INTERNAL_PROXY_SECRET, USE_KAFKA_NOT_REST | Node environment, listen host, internal proxy secret, and backend bus selector. | Examples development, 127.0.0.1, boolean. Match the shared secret across BFF, backend, and DataSearcher. |
UIDG_PORT, IDQP_PORT, WEBHOOK_CATCHER_PORT, GRAPH_PULL_POLLER_PORT, QUE_PROCESSOR_PORT, TSP_PORT, ADMIN_SERVICE_PORT, WEBHOOK_CATCHER_URL | Backend listen ports and WebhookCatcher origin. | Examples 3000, http://127.0.0.1:3080. Standalone inputs. Unified Compose supplies internal values. |
BACKEND_TENANT_ID, BACKEND_CLIENT_ID, BACKEND_CLIENT_SECRET | Backend bootstrap and current GraphOneTimeUserOnboarder app-only identity. | Required for the selected Microsoft provider, including standalone Graph worker execution. Unified root Compose forwards these exact names. Keep them separate from BFF_MICROSOFT_* login credentials. See Microsoft runtime setup. |
TENANT_ID, CLIENT_ID, CLIENT_SECRET | Separate standalone CLI and Graph experimenter identity. | Required by Architecture/GraphSyncExperimenter/cli-graph and the lab dashboard. These names do not configure backend bootstrap or current GraphOneTimeUserOnboarder. The Graph worker's unprefixed example fields are stale. Legacy PST worker scope is listed separately below. |
GRAPH_WEBHOOK_URL, GRAPH_LIFECYCLE_WEBHOOK_URL, GRAPH_WEBHOOK_CLIENT_STATE | Public HTTPS notification/lifecycle callbacks and shared validation secret. | Required by Graph subscriptions. Use this deployment's public host and stable secret. |
DELTA_LINK_ENCRYPTION_KEY, DELTA_LINK_ENCRYPTION_KEY_REFERENCE | Process-level Graph delta AES key and nonsecret version reference. | Base64 key must decode to exactly 32 bytes. Default process reference local-dev-v1. Current unified Compose forwards only the key, not the reference. Explicit references apply only to processes that receive them. Preserve the compatible pair with encrypted database state. |
GRAPH_SYNC_CERTS_DIR, GRAPH_WEBHOOK_ENCRYPTION_CERTIFICATE_PATH, GRAPH_WEBHOOK_ENCRYPTION_PRIVATE_KEY_PATH, GRAPH_WEBHOOK_ENCRYPTION_CERTIFICATE_ID | Certificate root, public certificate path, private-key path, and certificate ID file/literal. | Required for rich notifications. certgen.sh prepares development files. Unified mounts use container paths. |
GRAPH_WEBHOOK_ENCRYPTION_CERTIFICATE, GRAPH_WEBHOOK_ENCRYPTION_CERTIFICATE_REFERENCE | Optional Base64 DER public certificate and secret-store reference. | Explicit certificate and ID must be supplied together. Keep the private key separate. |
S3_ENDPOINT, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY, S3_BUCKET_EMAIL_BODIES, S3_FORCE_PATH_STYLE | Complete S3 store connection settings. | Example http://127.0.0.1:8333, us-east-1, ecas, true. Endpoint, region, credentials, and bucket must identify the same store. |
SEAWEEDFS_ADMIN_PASSWORD, SEAWEEDFS_ADMIN_USER, SEAWEEDFS_BIND_IP, SEAWEEDFS_S3_PORT, SEAWEEDFS_ADMIN_PORT | SeaweedFS local administration/provisioning identity, bind IP, and ports. | Required for local provisioning only. Application S3 credentials remain separate. |
OPENSEARCH_URL, OPENSEARCH_INDEX, OPENSEARCH_ENCRYPTED_INDEX, OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD, EMAIL_ENCRYPTION_MIGRATED_OWNERS | OpenSearch origin/indexes, optional authentication, and migrated owner IDs. | Examples http://127.0.0.1:9200, emails-onboarding. Encrypted index settings apply to encrypted rollout. |
KAFKA_CLIENT_ID, KAFKA_NETWORK, KAFKA_LAN_BOOTSTRAP_SERVERS, KAFKA_TAILSCALE_BOOTSTRAP_SERVERS, KAFKA_SECURITY_PROTOCOL, KAFKA_SASL_MECHANISM | Kafka client ID, network selection, broker lists, protocol, and SASL mechanism. | Examples ecs-backend, lan, sasl_plaintext, PLAIN. Both endpoint lists must satisfy backend schema validation. Selected endpoints must be reachable. |
KAFKA_ADMIN_USERNAME, KAFKA_ADMIN_PASSWORD, KAFKA_APP_USERNAME, KAFKA_APP_PASSWORD | Separate Kafka admin/application login pairs. | Required for Kafka clients. Match broker roles and Coolify SERVICE_PASSWORD_64_* values. |
KAFKA_TOPIC_* | Kafka topic-name family. | Examples app.graphsync.fetch.v1, app.user.realtime.v1, app.onboarding.commands.v1. Producers and consumers must agree. |
GOOGLE_MAILBOX_OAUTH_ENABLED, GOOGLE_MAILBOX_OAUTH_PORT, ECAS_DEPLOYMENT_TENANT_ID, GOOGLE_MAILBOX_CLIENT_ID, GOOGLE_MAILBOX_CLIENT_SECRET_PATH, GOOGLE_MAILBOX_CALLBACK_URL, GOOGLE_MAILBOX_BFF_COMPLETION_URL, GOOGLE_MAILBOX_GRANT_KEY_PATH, GOOGLE_MAILBOX_GRANT_KEY_REFERENCE, GOOGLE_WORKSPACE_CREDENTIALS_JSON | Google mailbox connector flag/port, tenant/client IDs, secret/key paths, callbacks, key reference, and Workspace allowlist. | Examples false, 3020, /runtime/google/..., []. Supply secrets through files or a secret store. |
BFF_ENABLE_KAFKA, BETTER_AUTH_SECRET, BETTER_AUTH_URL, NEXT_PUBLIC_BETTER_AUTH_URL, BFF_PORT, WEBSOCKET_PORT | BFF bus selector, session secret/origins, and listen ports. | Standalone examples http://localhost:5173, 5173, 6589. Unified login uses Account origin. Secret changes can invalidate sessions. |
NEXT_PUBLIC_API_URL, NEXT_PUBLIC_SORTER_SERVER_URL, DATASEARCHER_URL, DATASEARCHER_PORT, DATASEARCHER_IUDG_URL, ADMIN_SERVICE_URL | Backend, sorter, DataSearcher, IUDG, and administration origins/ports. | Required for related BFF features. NEXT_PUBLIC_* values can reach the browser. Never place secrets there. |
MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, MICROSOFT_TENANT_ID | Legacy BFF Microsoft application-login credentials. | Required for standalone Microsoft app login. Separate from backend app-only Graph credentials. |
COMPLEXITY_RUNTIME_ROLE, COMPLEXITY_SERVICE_URL, COMPLEXITY_SERVICE_PORT, COMPLEXITY_GETTER_URL, COMPLEXITY_GETTER_PORT, MAX_ACTORS_PER_COMPLEXITY_PARTITION, COMPLEXITY_KAFKA_MAX_POLL_MS, KAFKA_TOPIC_COMPLEXITY_* | Complexity runtime role, WebSocket addresses, partition capacity, poll timeout, and command/notification/DLQ topics. | BFF role enum bff / service / getter, default bff. Service/getter ports default 6590/6591, integers 1–65535. URLs must use ws:// in the BFF schema. Actors per partition default 1, floored/minimum 1. Backend command-consumer poll default 3600000 ms; positive finite inputs are floored and clamped to 600000–86400000 ms. Match topic contracts across BFF/backend. |
BFF_REALTIME_CONSUMER_GROUP, BFF_REALTIME_INSTANCE_ID, MAX_USERS_PER_QueProcessor_PARTITION | Realtime Kafka group, optional stable instance identity, and mailbox partition capacity. | BFF group default bff-graph-sync-realtime-v1; optional instance identity is nonempty when set. Unified setup derives INSTANCE-bff. Backend assignment capacity defaults 1, integer range 1–100. Group changes affect offset ownership. |
DATASEARCHER_IUDG_URL, IUDG_PORT, DATASEARCHER_CONCURRENCY | DataSearcher backend origin, IUDG port, and search concurrency. | Standalone examples http://127.0.0.1:3000, 3000, 2. |
PST_PATH_LOCATIONS | Absolute PST import directory list. | Only the legacy PST onboarder uses it. Graph onboarding does not require it. |
ONBOARDING_RETRY_* | Operation-specific onboarding retry counts. | Integer attempts. *_DELAY_MS and *_JITTER_MS use milliseconds. Consult the selected onboarder's example for its defaults. |
ONBOARDING_REPLAY_RUN_ID, ONBOARDING_REPLAY_STEP | Target onboarding run ID and checkpoint/step for replay. | Leave empty during normal operation. Use only for an explicit operator replay. |
Optional backend settings
| Variable or group | Meaning | Default, format, and consumer |
|---|---|---|
GRAPH_PULL_POLLER_TICK_MS, GRAPH_SUBSCRIPTION_TICK_MS, GRAPH_FOLDER_DELTA_INTERVAL_MS, GRAPH_MESSAGE_DELTA_INTERVAL_MS, GRAPH_CATEGORY_POLL_INTERVAL_MS, GRAPH_STALE_DELTA_MS, GRAPH_WEBHOOK_RESPONSE_DEADLINE_MS | Graph worker intervals, delta/category poll intervals, stale-delta interval, and webhook deadline. | Defaults in milliseconds: worker tick 60000, subscription tick 60000, folder/message delta intervals 300000 each, stale delta 172800000, webhook deadline 2500. Category interval defaults to 60000 ms from the master-category source catalog. These consumers use numeric conversion rather than one shared bounded schema. See timing contracts. |
GRAPH_SYNC_MAX_PAGES_PER_BATCH | Maximum Graph pages per processing batch. | Graph fetch worker default 10000 pages per batch, read through Number. No additional integer bound is enforced at this read. Tune only against measured mailbox behavior. |
GRAPH_SUBSCRIPTIONS_RESET_ON_START | Legacy subscription-reset-on-start switch. | Listed in the backend example, but no current production-source read was found. It does not control the durable GraphPullPoller renewal policy. Leave unset during normal operation. |
QUE_PROCESSOR_CONSUMER_GROUP, GRAPH_APPLY_CONSUMER_GROUP, GRAPH_FETCH_CONSUMER_GROUP, GRAPH_SYNC_TRIGGER_CONSUMER_GROUP, TEMPORARY_STATUS_STATUS_CONSUMER_GROUP, INTERFACE_NOTIFIER_CONSUMER_GROUP | Consumer group names for queue, fetch/apply/trigger, status, and notifier workers. | Queue default que-processor-ingestion-v2; apply graph-sync-apply-ingestion-v1; fetch graph-sync-fetch-v1; trigger graph-sync-trigger-scheduler-v1; temporary status temporary-status-status-v1; notifier interface-notifier-v1. Consumers read these names at startup. Change only with an offset/migration plan. |
QUE_PROCESSOR_INGESTION_CONCURRENCY, GRAPH_FETCH_CONSUMER_CONCURRENCY, QP_MAX_CONCURRENT_MAILBOXES | Ingestion, fetch-consumer, and mailbox concurrency limits. | Queue ingestion, Graph fetch, and maximum concurrent mailboxes each default to 8. These service reads use Number, not a common positive-integer schema. Invalid overrides must not be treated as validated tuning. Tune from capacity measurements. |
MAILBOX_EXECUTION_LEASE_MS, MAILBOX_EXECUTION_HEARTBEAT_MS | Mailbox execution lease and heartbeat durations. | Mailbox executor defaults: lease 120000 ms, heartbeat 30000 ms. Both are Number reads without a shared bound at configuration access. Tune together with worker latency and lease behavior. |
KAFKA_METADATA_MAX_AGE_MS, KAFKA_IDEMPOTENCY_TX_MAX_WAIT_MS, KAFKA_IDEMPOTENCY_TX_TIMEOUT_MS, KAFKA_OUTBOX_POLL_MS, KAFKA_OUTBOX_DISPATCHING_STALE_MS, KAFKA_OUTBOX_MARK_PUBLISHED_RETRY_DELAY_MS, KAFKA_OUTBOX_STALE_PROBE_TIMEOUT_MS | Kafka metadata, transaction, and outbox timing settings. | Defaults: metadata 5000, idempotency transaction wait 10000, transaction timeout 60000, outbox polling 2000, stale dispatch 60000, publication retry delay 150, probe timeout 30000 milliseconds. Consumers and parsing rules differ. See timing contracts. |
KAFKA_OUTBOX_MARK_PUBLISHED_RETRY_COUNT | Retries for the database status update after publication. | Publisher default 5. Finite nonnegative numeric overrides are floored. Empty, negative, or nonfinite values use the default. No explicit upper cap is applied by this parser. |
KAFKA_CONSUMER_AUTO_OFFSET_RESET | Initial offset-reset policy. | Consumer default earliest. The read passes a supplied string to the Kafka client; it does not impose a local enum. A valid broker/client policy such as latest affects absent/unusable group offsets, not existing committed offsets. |
KAFKA_OUTBOX_UNKNOWN_PARTITION_RECOVERY_ENABLED | Unknown-partition outbox recovery selector. | Publisher default enabled. A case-insensitive string false disables it; other supplied strings remain enabled. This is not strict boolean validation. |
OPENROUTER_API_KEY, OPENROUTER_BASE_URL, REFERER_URL | OpenRouter API secret, API origin, and identifying HTTP referer. | Example/legacy inputs with no current BFF/backend production-source read found for this name group. No active base-URL/referer default is established by these fields. Configure supported model providers through the application's current provider configuration. Keep any retained key private. |
MOCKURL | Legacy mock provider origin. | Only old/mock provider paths use it. m365local does not. |
DEV_STORAGE_MODE, DEV_LOG_DIR, DEV_LOG_TERMINAL | Standalone backend logging/storage selector, absolute log directory, and terminal device. | Standalone scripts default storage mode to local (accepted local / remote) and log directory to backend logs/. Terminal device is optional. Not a replacement for root Docker lifecycle. |
KAFKA_TESTER_CONSUMER_GROUP, KAFKA_TESTER_CONSUMER_CONCURRENCY, KAFKA_TESTER_CONSUMER_IDLE_LOG_MS, KAFKA_TESTER_ASSIGNMENT_STATUS_MS, KAFKA_TESTER_OUTBOX_POLL_MS, KAFKA_TESTER_OUTBOX_IDLE_LOG_MS | KafkaTester group, concurrency, log intervals, and outbox polling intervals. | Worker group default bun-mailbox-events-worker, concurrency 1, consumer idle log 30000 ms, assignment status 1000 ms, outbox poll 2000 ms, outbox idle log 30000 ms. Numeric reads use Number without a shared bounded schema. Only KafkaTester/shared assignment logging consumes these inputs. |
MOCK_USER_1_ID, MOCK_USER_2_ID, MOCK_ORDER_1_ID, MOCK_ORDER_2_ID | Mock user/order fixture UUIDs. | Only for mock/test data. |
RUN_GRAPH_SYNC_E2E, GRAPH_E2E_SENDER_USER_ID, GRAPH_E2E_RECIPIENT_USER_ID, GRAPH_E2E_RECIPIENT_ADDRESS, GRAPH_E2E_ALLOW_PERMANENT_DELETE, GRAPH_E2E_BUN_BINARY | External mailbox E2E opt-in, sender/recipient IDs/address, permanent-delete opt-in, and Bun binary. | Use prepared disposable mailboxes only. Never enable destructive checks against production data. |
S3_ERASE_PREFIXES, S3_ERASE_PREFIX, OPENSEARCH_ERASER_WAIT_TIMEOUT_MS | Destructive object-prefix targets and OpenSearch eraser timeout. | StorageEraser reads S3_ERASE_PREFIXES, falling back to S3_ERASE_PREFIX; its default prefixes are email-bodies/ and users/, normalized with a trailing slash and deduplicated. OpenSearch wait timeout defaults 120000 ms through Number. Destructive maintenance only. Read the eraser target selection before use. |
Infrastructure and documentation
| Variable or group | Meaning | Default, format, and consumer |
|---|---|---|
mailGen/msmicroservices-architexture/coolify/.env.coolify.example: KAFKA_BIND_IP, KAFKA_JMX_BIND_IP, KAFKA_LAN_HOST, KAFKA_TAILSCALE_HOST | Broker/JMX bind IPs and advertised LAN/Tailscale hosts. | Example 127.0.0.1. Replace with the intended reachable addresses for a Coolify deployment. |
KAFKA_BROKER{1,2,3}_LAN_PORT, KAFKA_BROKER{1,2,3}_TAILSCALE_PORT, KAFKA_BROKER{1,2,3}_JMX_PORT | Three brokers' LAN, Tailscale, and JMX host ports. | Examples 9092–9094, 19092–19094, 9101–9103. Ports must be unique and reachable. |
KAFKA_ADMIN_USER, KAFKA_ADMIN_PASSWORD, KAFKA_APP_USER, KAFKA_APP_PASSWORD | Broker admin/application SASL identities. | Example users admin / app. Example passwords are local-only. All clients must match the selected role. |
SERVICE_PASSWORD_64_KAFKA_ADMIN, SERVICE_PASSWORD_64_KAFKA_APP, SERVICE_PASSWORD_64_KAFKA_UI, SPRING_SECURITY_USER_PASSWORD, KAFKA_UI_USER | Coolify generated passwords and Kafka UI login. | Resource-local values, example UI user admin. Match Compose authentication settings. |
KAFKA_CLUSTER_ID | Persistent Kafka cluster ID. | Example MkU3OEVBNTJENDM2Qg is only for a fresh isolated example cluster. Preserve an existing cluster's exact ID. |
SCHEMA_REGISTRY_LAN_BIND_IP, SCHEMA_REGISTRY_LAN_PORT, SCHEMA_REGISTRY_TAILSCALE_BIND_IP, SCHEMA_REGISTRY_TAILSCALE_PORT | Schema Registry LAN/Tailscale bind IPs and ports. | Examples 127.0.0.1, 8081, 127.0.0.1, 18081. Used only with Schema Registry. |
SERVICE_URL_*, SERVICE_FQDN_* | Coolify-managed public origins and hostnames for optional Kafka tools. | Used for Schema Registry, Connect, REST, ksqlDB, Flink, and Kafka UI routing. Do not confuse internal target ports with public ports. |
SERVICE_URL_SCHEMAREGISTRY, SERVICE_FQDN_SCHEMAREGISTRY, SERVICE_URL_SCHEMAREGISTRY_8081, SERVICE_FQDN_SCHEMAREGISTRY_8081, SERVICE_URL_KAFKACONNECT, SERVICE_FQDN_KAFKACONNECT, SERVICE_URL_KAFKACONNECT_8083, SERVICE_FQDN_KAFKACONNECT_8083, SERVICE_URL_KAFKAREST, SERVICE_FQDN_KAFKAREST, SERVICE_URL_KAFKAREST_8082, SERVICE_FQDN_KAFKAREST_8082, SERVICE_URL_KSQLDB, SERVICE_FQDN_KSQLDB, SERVICE_URL_KSQLDB_8088, SERVICE_FQDN_KSQLDB_8088, SERVICE_URL_FLINK, SERVICE_FQDN_FLINK, SERVICE_URL_FLINK_9081, SERVICE_FQDN_FLINK_9081, SERVICE_URL_KAFKAUI, SERVICE_FQDN_KAFKAUI, SERVICE_URL_KAFKAUI_8080, SERVICE_FQDN_KAFKAUI_8080 | Explicit Coolify component URL/FQDN fields, including target-port variants. | Examples http://127.0.0.1:<port>, 127.0.0.1. Configure component domain/routing. No secrets belong in these fields. |
KAFKA_BROKER1_LAN_PORT, KAFKA_BROKER2_LAN_PORT, KAFKA_BROKER3_LAN_PORT, KAFKA_BROKER1_TAILSCALE_PORT, KAFKA_BROKER2_TAILSCALE_PORT, KAFKA_BROKER3_TAILSCALE_PORT, KAFKA_BROKER1_JMX_PORT, KAFKA_BROKER2_JMX_PORT, KAFKA_BROKER3_JMX_PORT | Explicit broker LAN/Tailscale/JMX host-port mappings. | Examples 9092–9094, 19092–19094, 9101–9103. Keep them consistent with advertised metadata. |
POSTGRES_BIND_IP, POSTGRES_PORT, POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORD | Local PostgreSQL bind IP, port, database, user, password. | Example 127.0.0.1, 5433, mailGen, postgres, private password. Used by the standalone infrastructure deployment. |
SEAWEEDFS_BIND_IP, SEAWEEDFS_S3_PORT, SEAWEEDFS_ADMIN_PORT, SEAWEEDFS_ADMIN_USER, SEAWEEDFS_ADMIN_PASSWORD | Local SeaweedFS bind, S3/admin ports, and administrator credentials. | Example 127.0.0.1, 8333, 5600. Supply a private administration password. S3 credentials are separate. |
Coolify S3_ACCESS_KEY, S3_SECRET_KEY, S3_REGION, S3_BUCKET_EMAIL_BODIES | Separate infrastructure-template SeaweedFS S3 identity, secret, region, and body bucket. | Supply deployment credentials; region example us-east-1, bucket ecas. Match the application configuration for this same store. These are distinct from SeaweedFS administration credentials. |
MOCK_USER_1_ID, MOCK_USER_2_ID, MOCK_ORDER_1_ID, MOCK_ORDER_2_ID | Mock fixture identifiers. | UUIDs for test users and orders. Use only in mock/test tooling. |
Architecture/.env.coolify.example: DOCUSAURUS_PUBLIC_URL | Public documentation-site origin. | http://localhost by default. Supply your public HTTPS origin without a path. Build-time canonical/sitemap input, not an application secret. |
Architecture/GraphSyncExperimenter/graph-call-dashboard/.env.example: DATABASE_URL | Experimenter Prisma SQLite file URL. | Example file:./db.sqlite. Only for the separate Graph experimenter. |
Experimenter: TENANT_ID, CLIENT_ID, CLIENT_SECRET, GRAPH_WEBHOOK_CLIENT_STATE, GRAPH_WEBHOOK_URL | Experimenter Entra IDs/secret, stable client-state, and public HTTPS callback. | All required for normal dashboard startup. Example https://<public-host>/graphWebhook. Store secrets outside Git. |
Experimenter: GRAPH_WEBHOOK_ENCRYPTION_CERTIFICATE_PATH, GRAPH_WEBHOOK_ENCRYPTION_PRIVATE_KEY_PATH, GRAPH_WEBHOOK_ENCRYPTION_CERTIFICATE_ID | Experimenter certificate/private-key file or directory paths and certificate ID. | All required for normal startup. Local certs/ paths supply rich-notification material. |
Experimenter: DELTA_LINK_ENCRYPTION_KEY | Experimenter delta encryption key. | Base64 for exactly 32 bytes. Required at normal startup even if the example omits it. Retain it with database state. |
.NET Graph and legacy onboarding
| Variable or group | Meaning | Default, format, and consumer |
|---|---|---|
POSTGRES_CONNECTION_STRING | Npgsql connection string. | Example Host=127.0.0.1;Port=5433;Database=mailGen;Username=postgres;Password=<private>. Used by standalone Graph/legacy onboarding and DataSearcher. |
KAFKA_CLIENT_ID, KAFKA_NETWORK, KAFKA_LAN_BOOTSTRAP_SERVERS, KAFKA_TAILSCALE_BOOTSTRAP_SERVERS, KAFKA_SECURITY_PROTOCOL, KAFKA_SASL_MECHANISM, KAFKA_ADMIN_USERNAME, KAFKA_ADMIN_PASSWORD, KAFKA_APP_USERNAME, KAFKA_APP_PASSWORD | .NET Kafka client settings with application/administration roles. | Required for Kafka-backed .NET services. Match backend semantics and the actual broker configuration. |
BACKEND_TENANT_ID, BACKEND_CLIENT_ID, BACKEND_CLIENT_SECRET | Current GraphOneTimeUserOnboarder worker identity, also used by backend bootstrap. | Required even when the Graph worker runs standalone. OnboardingRuntimeOptions.FromEnvironment reads these names with no unprefixed fallback. The committed Graph worker .env.example remains stale for these three fields. Supply the runtime names without changing templates. |
TENANT_ID, CLIENT_ID, CLIENT_SECRET, GRAPH_WEBHOOK_URL, GRAPH_LIFECYCLE_WEBHOOK_URL, GRAPH_WEBHOOK_CLIENT_STATE | Legacy OneTimeUserOnboarder PST worker credentials and notification configuration. | The legacy PST worker reads the unprefixed credential trio, required webhook URL, and client-state. Its option loader accepts an absent lifecycle URL. This is not the current Graph worker's credential contract. The standalone Graph export tester and CLI/lab also use unprefixed credentials in their own configurations. Never copy secrets into tickets or logs. |
S3_ENDPOINT, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY, S3_BUCKET_EMAIL_BODIES, S3_FORCE_PATH_STYLE | Complete S3 connection settings. | Required for Graph onboarding/DataSearcher storage operations. |
OPENSEARCH_URL, OPENSEARCH_INDEX, OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD | OpenSearch origin/index and optional Basic authentication. | Required when onboarding or DataSearcher uses the search index. |
ONBOARDING_RETRY_GRAPH_ATTEMPTS, ONBOARDING_RETRY_GRAPH_DUMP_ATTEMPTS, ONBOARDING_RETRY_GRAPH_EXPORT_ATTEMPTS, ONBOARDING_RETRY_PST_ATTEMPTS, ONBOARDING_RETRY_S3_ATTEMPTS, ONBOARDING_RETRY_INDEXING_ATTEMPTS, ONBOARDING_RETRY_PARTITION_RELEASE_ATTEMPTS, ONBOARDING_RETRY_BASE_DELAY_MS, ONBOARDING_RETRY_JITTER_MS | Per-operation onboarding retries, base delay, and jitter. | Template defaults: Graph/S3 attempts 5, PST 3 (legacy only), Graph dump/export 5 (Graph only), indexing 4, partition release 8, base delay 10000 ms, jitter 1500 ms. Consumers are the selected .NET onboarder; their operation sets differ. |
ONBOARDING_REPLAY_RUN_ID, ONBOARDING_REPLAY_STEP | Onboarding run/checkpoint replay target. | Leave empty except during explicit operator replay. |
DATASEARCHER_PORT, DATASEARCHER_IUDG_URL, IUDG_PORT, DATASEARCHER_CONCURRENCY, INTERNAL_PROXY_SECRET | DataSearcher listen port, IUDG origin/port, concurrency, and internal secret. | Standalone service inputs. Shared secret must match the backend. |
OPENSEARCH_INITIAL_ADMIN_PASSWORD | OpenSearch initial administrator password. | Only for first OpenSearch bootstrap in the onboarding Compose deployment. Supply a private deployment value. |
PST_PATH_LOCATIONS | Absolute directory or directory list for PST files. | Only OneTimeUserOnboarder reads it. Graph onboarding does not. |
Source and precedence
Root inputs come from .env.example, compose.yaml, and docker/runtime/. Service examples include mailGen/msmicroservices-architexture/.env.example, mailGen/bff/.env.example, the .NET onboarding/DataSearcher examples, and coolify/.env.coolify.example.
The current backend and Graph worker use BACKEND_* credentials even outside Compose. The CLI/lab and legacy PST worker have separate unprefixed contracts. Template field names do not override the selected runtime parser.
The remote parser selects active values after placement and transport checks. Unused remote fields do not activate remote mode. Local Compose cannot resolve a different Coolify resource's generated password variable.
The full standard local selection uses a 40 GiB application budget. The full Microsoft/Google/FormGen selection uses 44 GiB. The omitted 30 GiB default does not promise capacity for either full selection. Host reserves and build admission are additional. See first-install capacity.
For the Pub/Sub JSON, a representative item is:
[{"topicName":"projects/<project>/topics/<topic>","subscriptionId":"projects/<project>/subscriptions/<subscription>","pushAudience":"https://<host>/v1/pubsub/push","pushServiceAccountEmail":"<push-sa>@<project>.iam.gserviceaccount.com","pushServiceAccountSubject":"1234567890","oauthClientId":"<oauth-client-id>"}]
Keep existing JSON routing entries when adding a project. Service-account IAM remains a separate prerequisite.
Related guides
- Configuration changes and rollback
- Secrets backup
- Graph keys and certificates
- First developer setup
- Docker runtime
- Daily commands
Actual FormGen upload limits
FORMGEN_CDN_MAX_SIZE does not enforce these limits. Current code rejects image uploads above 15,000,000 bytes. Form attachments have a 25 × 1024 × 1024-byte per-file ceiling. The multipart submission reader has a 64 × 1024 × 1024-byte request ceiling.
Form questions also enforce their configured minFileSize, positive maxSize, minFiles, positive maxFiles, and allowedMimeTypes. A zero maximum means no additional question-level maximum, while the global byte ceilings still apply. The server detects file type and checks size/type again after reading bytes. These are separate paths from MailGen's email-attachment preview limit.
Implemented timing defaults
The reference distinguishes code defaults from commented template examples. A displayed number does not imply a uniform validation rule.
| Input/consumer | Default and implemented parsing |
|---|---|
KAFKA_METADATA_MAX_AGE_MS, Kafka client factory | 5000 ms. Finite nonnegative numbers are floored; invalid/negative inputs use the default. |
KAFKA_IDEMPOTENCY_TX_MAX_WAIT_MS, KAFKA_IDEMPOTENCY_TX_TIMEOUT_MS, database deduplication | 10000 / 60000 ms, read with Number and passed to the transaction. No extra bound at the read. |
KAFKA_OUTBOX_DISPATCHING_STALE_MS, KAFKA_OUTBOX_MARK_PUBLISHED_RETRY_DELAY_MS, KAFKA_OUTBOX_STALE_PROBE_TIMEOUT_MS, publisher | 60000 / 150 / 30000 ms. Accept nonnegative integer text or integer text with ms, s, m, h. Invalid syntax uses the default. |
KAFKA_OUTBOX_POLL_MS, dispatcher | 2000 ms through Number. No extra bound at the read. |
| Graph tick/folder/message/stale values, GraphPullPoller | Numeric millisecond reads. Category polling defaults to 60000 ms from the canonical master-category source catalog. This matches the current example's commented 60000. |
Only set optional timing overrides after checking their actual consumer. Startup/SDK behavior can reject values that a plain Number read does not validate.