Environment Variables Reference¶

Last Updated: 2025-08-02

Overview¶

This document provides a comprehensive reference of all environment variables used across the infrastructure, their security classification, and configuration guidelines.

Security Classifications¶

🔴 SECRET: Must be kept secure, never commit to version control
🟡 SENSITIVE: Contains configuration that should be protected
🟢 PUBLIC: Safe to share, non-sensitive configuration

Core Infrastructure Variables¶

Traefik Variables¶

Variable	Classification	Required	Default	Description	Valid Values
`CF_DNS_API_TOKEN`	🔴 SECRET	Yes	-	Cloudflare API token for DNS challenges	Valid Cloudflare API token
`CF_API_TOKEN`	🔴 SECRET	Yes	-	Alternative Cloudflare API token	Valid Cloudflare API token
`CLOUDFLARE_DNS_API_TOKEN`	🔴 SECRET	Yes	-	Legacy Cloudflare token name	Valid Cloudflare API token
`ACME_EMAIL`	🟡 SENSITIVE	Yes	-	Email for Let's Encrypt notifications	Valid email address

PostgreSQL Database¶

Variable	Classification	Required	Default	Description	Valid Values
`POSTGRES_PASSWORD`	🔴 SECRET	Yes	-	PostgreSQL superuser password	32+ character hex string
`POSTGRES_USER`	🟢 PUBLIC	No	postgres	PostgreSQL superuser name	Valid username
`POSTGRES_DB`	🟢 PUBLIC	No	postgres	Default database name	Valid database name

Supabase Service Variables¶

Core Supabase Configuration¶

Variable	Classification	Required	Default	Description	Valid Values
`JWT_SECRET`	🔴 SECRET	Yes	-	JWT signing secret (min 64 chars)	64+ character hex string
`ANON_KEY`	🟡 SENSITIVE	Yes	-	Anonymous/public API key	Valid JWT signed with JWT_SECRET
`SERVICE_ROLE_KEY`	🔴 SECRET	Yes	-	Service role API key (admin access)	Valid JWT signed with JWT_SECRET
`SUPABASE_DOMAIN`	🟢 PUBLIC	Yes	-	Full domain for Supabase services	FQDN (e.g., supabase.rbnk.uk)
`API_EXTERNAL_URL`	🟢 PUBLIC	Yes	-	External API URL	https://${SUPABASE_DOMAIN}
`SITE_URL`	🟢 PUBLIC	Yes	-	Site URL for auth redirects	https://${SUPABASE_DOMAIN}

Supabase Image Tags¶

Variable	Classification	Required	Default	Description	Valid Values
`SUPA_POSTGRES_TAG`	🟢 PUBLIC	No	15.8.1.060	PostgreSQL image version	Valid image tag
`SUPA_GOTRUE_TAG`	🟢 PUBLIC	No	v2.177.0	GoTrue auth image version	Valid image tag
`SUPA_POSTGREST_TAG`	🟢 PUBLIC	No	v12.2.12	PostgREST image version	Valid image tag
`SUPA_STORAGE_TAG`	🟢 PUBLIC	No	v1.25.7	Storage API image version	Valid image tag
`SUPA_META_TAG`	🟢 PUBLIC	No	v0.91.0	Postgres Meta image version	Valid image tag
`SUPA_STUDIO_TAG`	🟢 PUBLIC	No	2025.06.30-sha-6f5982d	Studio image version	Valid image tag

Application-Specific Variables¶

n8n Workflow Automation¶

Variable	Classification	Required	Default	Description	Valid Values
`DOMAIN_NAME`	🟢 PUBLIC	Yes	-	Base domain name	Valid domain (e.g., rbnk.uk)
`SUBDOMAIN`	🟢 PUBLIC	Yes	-	Service subdomain	Valid subdomain (e.g., n8n)
`GENERIC_TIMEZONE`	🟢 PUBLIC	No	America/New_York	Timezone for scheduling	Valid timezone string
`SSL_EMAIL`	🟡 SENSITIVE	Yes	-	Email for SSL certificates	Valid email address
`VUE_APP_URL_BASE_API`	🟢 PUBLIC	Yes	-	n8n API base URL	https://${SUBDOMAIN}.${DOMAIN_NAME}
`WEBHOOK_URL`	🟢 PUBLIC	Yes	-	n8n webhook URL	https://${SUBDOMAIN}.${DOMAIN_NAME}
`EDITOR_BASE_URL`	🟢 PUBLIC	Yes	-	n8n editor base URL	https://${SUBDOMAIN}.${DOMAIN_NAME}

Open WebUI¶

Variable	Classification	Required	Default	Description	Valid Values
`APP_NAME`	🟢 PUBLIC	Yes	-	Application name	Alphanumeric string
`APP_IMAGE`	🟢 PUBLIC	Yes	-	Docker image	Valid Docker image
`APP_PORT`	🟢 PUBLIC	Yes	-	Internal port	1-65535
`APP_DOMAIN`	🟢 PUBLIC	Yes	-	Full domain	Valid FQDN
`OLLAMA_BASE_URL`	🟢 PUBLIC	No	-	Ollama API endpoint	Valid URL
`ENABLE_OLLAMA`	🟢 PUBLIC	No	false	Enable Ollama integration	true/false
`WEBUI_SECRET_KEY`	🔴 SECRET	Yes	-	Session secret key	Random string (32+ chars)
`OPENAI_API_KEY`	🔴 SECRET	No	-	OpenAI API key	Valid API key
`ANTHROPIC_API_KEY`	🔴 SECRET	No	-	Anthropic API key	Valid API key

LiteLLM Virtual Keys¶

Variable	Classification	Required	Default	Description	Valid Values
`LITELLM_VIRTUAL_KEY_<SERVICE>`	🔴 SECRET	Varies	-	Service-specific virtual key	Valid LiteLLM virtual key

Note: Virtual keys are the recommended approach for service-to-service LLM API access. See LiteLLM Virtual Keys for complete implementation details.

Generic Stack Variables¶

Variable	Classification	Required	Default	Description	Valid Values
`TRAEFIK_NETWORK`	🟢 PUBLIC	Yes	traefik_proxy	Traefik network name	Valid Docker network
`TRAEFIK_CERTRESOLVER`	🟢 PUBLIC	Yes	cf	Certificate resolver	cf (Cloudflare)
`TRAEFIK_ENTRYPOINT`	🟢 PUBLIC	Yes	websecure	Traefik entrypoint	web/websecure

Notification Services Variables¶

Apprise¶

Variable	Classification	Required	Default	Description	Valid Values
`APPRISE_CONFIG_DIR`	🟢 PUBLIC	No	/config	Configuration directory	Valid path
`APPRISE_ATTACH_DIR`	🟢 PUBLIC	No	/attach	Attachment directory	Valid path
`APPRISE_STATELESS_URLS`	🟡 SENSITIVE	No	-	Default notification URLs	Comma-separated URLs

ntfy¶

Variable	Classification	Required	Default	Description	Valid Values
`NTFY_BASE_URL`	🟢 PUBLIC	Yes	-	Public base URL	https://ntfy.rbnk.uk
`NTFY_ENABLE_LOGIN`	🟢 PUBLIC	Yes	1	Enable authentication	0/1
`NTFY_ENABLE_SIGNUP`	🟢 PUBLIC	No	0	Enable user signup	0/1
`NTFY_ATTACHMENT_CACHE_DIR`	🟢 PUBLIC	No	/var/cache/ntfy	Attachment storage	Valid path
`NTFY_AUTH_FILE`	🟢 PUBLIC	No	/var/lib/ntfy/auth.db	Auth database path	Valid path
`NTFY_AUTH_DEFAULT_ACCESS`	🟢 PUBLIC	No	deny-all	Default access level	deny-all/read-only/write-only/read-write

Mailrise¶

Variable	Classification	Required	Default	Description	Valid Values
`MAILRISE_CONFIG`	🟡 SENSITIVE	Yes	-	Path to config file	Valid file path
`MAILRISE_SMTP_PORT`	🟢 PUBLIC	No	8025	SMTP server port	1-65535

Uptime Kuma¶

Variable	Classification	Required	Default	Description	Valid Values
`UPTIME_KUMA_PORT`	🟢 PUBLIC	No	3001	Web interface port	1-65535
`DATA_DIR`	🟢 PUBLIC	No	/app/data	Data directory	Valid path

Notification Helper Script¶

Variable	Classification	Required	Default	Description	Valid Values
`APPRISE_URL`	🟢 PUBLIC	No	https://apprise.rbnk.uk/notify/apprise	Apprise API endpoint	Valid URL
`NTFY_URL`	🟢 PUBLIC	No	https://ntfy.rbnk.uk	ntfy server URL	Valid URL
`NTFY_USER`	🟡 SENSITIVE	No	-	ntfy username for auth	Valid username
`NTFY_PASS`	🔴 SECRET	No	-	ntfy password for auth	Valid password

Media & Content Services Variables¶

Metube (YouTube Downloader)¶

Variable	Classification	Required	Default	Description	Valid Values
`UID`	🟢 PUBLIC	No	1000	User ID for file permissions	Valid UID
`GID`	🟢 PUBLIC	No	1000	Group ID for file permissions	Valid GID
`DOWNLOAD_DIR`	🟢 PUBLIC	No	/downloads	Download directory path	Valid path
`DOWNLOAD_MODE`	🟢 PUBLIC	No	sequential	Download mode	sequential/parallel
`MAX_CONCURRENT_DOWNLOADS`	🟢 PUBLIC	No	3	Maximum concurrent downloads	1-10
`UMASK`	🟢 PUBLIC	No	022	File creation mask	Valid octal umask

Watchtower (Container Updates)¶

Variable	Classification	Required	Default	Description	Valid Values
`WATCHTOWER_CLEANUP`	🟢 PUBLIC	No	true	Remove old images after update	true/false
`WATCHTOWER_INCLUDE_STOPPED`	🟢 PUBLIC	No	false	Include stopped containers	true/false
`WATCHTOWER_INCLUDE_RESTARTING`	🟢 PUBLIC	No	true	Include restarting containers	true/false
`WATCHTOWER_POLL_INTERVAL`	🟢 PUBLIC	No	86400	Check interval in seconds	300-604800
`WATCHTOWER_NOTIFICATIONS`	🟢 PUBLIC	No	email	Notification method	email/slack/gotify
`WATCHTOWER_NOTIFICATION_EMAIL_FROM`	🟡 SENSITIVE	No	-	Sender email address	Valid email
`WATCHTOWER_NOTIFICATION_EMAIL_TO`	🟡 SENSITIVE	No	-	Recipient email address	Valid email
`WATCHTOWER_NOTIFICATION_EMAIL_SERVER`	🟡 SENSITIVE	No	-	SMTP server hostname	Valid hostname
`WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT`	🟢 PUBLIC	No	587	SMTP server port	25/465/587
`WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER`	🟡 SENSITIVE	No	-	SMTP username	Valid username
`WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD`	🔴 SECRET	No	-	SMTP password	Valid password
`WATCHTOWER_LOG_LEVEL`	🟢 PUBLIC	No	info	Log level	trace/debug/info/warn/error/fatal/panic
`WATCHTOWER_ROLLING_RESTART`	🟢 PUBLIC	No	false	Restart containers one by one	true/false
`WATCHTOWER_TIMEOUT`	🟢 PUBLIC	No	30s	Operation timeout	Valid duration
`TZ`	🟢 PUBLIC	No	UTC	Timezone	Valid timezone

Paperless NGX (Document Management)¶

Variable	Classification	Required	Default	Description	Valid Values
`POSTGRES_DB`	🟢 PUBLIC	No	paperless	PostgreSQL database name	Valid database name
`POSTGRES_USER`	🟢 PUBLIC	No	paperless	PostgreSQL username	Valid username
`POSTGRES_PASSWORD`	🔴 SECRET	Yes	-	PostgreSQL password	Strong password
`PAPERLESS_REDIS`	🟢 PUBLIC	No	redis://paperless-redis:6379	Redis connection URL	Valid Redis URL
`PAPERLESS_DBHOST`	🟢 PUBLIC	No	paperless-db	Database hostname	Valid hostname
`PAPERLESS_DBNAME`	🟢 PUBLIC	No	paperless	Database name	Valid database name
`PAPERLESS_DBUSER`	🟢 PUBLIC	No	paperless	Database username	Valid username
`PAPERLESS_DBPASS`	🔴 SECRET	Yes	-	Database password	Must match POSTGRES_PASSWORD
`PAPERLESS_SECRET_KEY`	🔴 SECRET	Yes	-	Django secret key	50+ character random string
`PAPERLESS_URL`	🟢 PUBLIC	Yes	-	External URL	https://paperless.rbnk.uk
`PAPERLESS_ADMIN_USER`	🟡 SENSITIVE	No	admin	Initial admin username	Valid username
`PAPERLESS_ADMIN_PASSWORD`	🔴 SECRET	No	-	Initial admin password	Strong password
`PAPERLESS_ADMIN_MAIL`	🟡 SENSITIVE	No	-	Admin email address	Valid email
`PAPERLESS_TIME_ZONE`	🟢 PUBLIC	No	UTC	Timezone	Valid timezone
`PAPERLESS_OCR_LANGUAGE`	🟢 PUBLIC	No	eng	OCR languages	ISO 639-2 codes

Paperless-AI (AI Document Analysis)¶

Variable	Classification	Required	Default	Description	Valid Values
`PUID`	🟢 PUBLIC	No	1000	User ID for file permissions	Valid UID
`PGID`	🟢 PUBLIC	No	1000	Group ID for file permissions	Valid GID
`PAPERLESS_AI_PORT`	🟢 PUBLIC	No	3000	Internal port for the service	1-65535
`RAG_SERVICE_URL`	🟢 PUBLIC	No	http://localhost:8000	RAG service endpoint	Valid URL
`RAG_SERVICE_ENABLED`	🟢 PUBLIC	No	true	Enable RAG functionality	true/false

Variable Dependencies¶

Supabase Dependencies¶

API_EXTERNAL_URL depends on SUPABASE_DOMAIN
SITE_URL depends on SUPABASE_DOMAIN
ANON_KEY and SERVICE_ROLE_KEY must be signed with JWT_SECRET

n8n Dependencies¶

VUE_APP_URL_BASE_API depends on SUBDOMAIN and DOMAIN_NAME
WEBHOOK_URL depends on SUBDOMAIN and DOMAIN_NAME
EDITOR_BASE_URL depends on SUBDOMAIN and DOMAIN_NAME

Generating Secure Values¶

Generate Random Passwords/Secrets¶

# Generate 32-byte hex string (64 chars)
openssl rand -hex 32

# Generate 64-byte hex string (128 chars)
openssl rand -hex 64

# Generate base64 encoded secret
openssl rand -base64 32

Generate Supabase JWT Keys¶

# 1. First generate JWT_SECRET
JWT_SECRET=$(openssl rand -hex 64)

# 2. Use the Supabase key generator or JWT.io to create:
#    - ANON_KEY: JWT with "role": "anon"
#    - SERVICE_ROLE_KEY: JWT with "role": "service_role"
#    Both signed with JWT_SECRET

Cloudflare API Token¶

Log into Cloudflare Dashboard
Go to My Profile > API Tokens
Create token with permissions:
Zone:DNS:Edit
Zone:Zone:Read
Scope to specific zone (rbnk.uk)

Environment File Best Practices¶

File Permissions¶

# Set secure permissions on .env files
chmod 640 .env
chown root:docker .env

File Organization¶

service/
├── .env                 # Production environment
├── .env.example         # Template with descriptions
└── .env.local          # Local overrides (gitignored)

Security Guidelines¶

Never commit .env files with real values
Use .env.example files as templates
Rotate secrets regularly
Use different values for dev/staging/production
Store production secrets in a secure vault
Audit environment variables quarterly

Validation Script¶

#!/bin/bash
# validate-env.sh - Check for required environment variables

required_vars=(
    "POSTGRES_PASSWORD"
    "JWT_SECRET"
    "ANON_KEY"
    "SERVICE_ROLE_KEY"
    "CF_DNS_API_TOKEN"
    "ACME_EMAIL"
)

for var in "${required_vars[@]}"; do
    if [ -z "${!var}" ]; then
        echo "ERROR: Required variable $var is not set"
        exit 1
    fi
done

# Check secret lengths
if [ ${#JWT_SECRET} -lt 64 ]; then
    echo "ERROR: JWT_SECRET must be at least 64 characters"
    exit 1
fi

if [ ${#POSTGRES_PASSWORD} -lt 32 ]; then
    echo "ERROR: POSTGRES_PASSWORD must be at least 32 characters"
    exit 1
fi

echo "Environment validation passed"