Environment variables

This page describes where deployment values enter the system and which process consumes them. For application behavior and Project Studio fallbacks, see the existing Environment reference.

Note

deploy/docker-compose.prod.yml uses an explicit environment block, not env_file. A variable supported by apps/server/config/env.ts is not available inside a production project unless that Compose file forwards it. Console-managed settings can override many application fallbacks without changing Compose.

Installer inputs

These are read directly by setup.sh.

Name	Consumed by	Required?	Default	Description
`DOMAIN`	`setup.sh`	VPS: yes	empty	Base suffix for Console-managed project domains; also selects VPS as the unattended default.
`CONSOLE_DOMAIN`	`setup.sh`, Console Compose	VPS: yes after defaulting	`console.<DOMAIN>`	Public Console hostname.
`ACME_EMAIL`	`setup.sh`, Traefik	VPS: yes	none	ACME registration email.
`ADMIN_EMAIL`	`setup.sh`	no	`admin@example.com`	Initial Console owner email.
`ADMIN_PASSWORD`	`setup.sh`	repair: conditional	generated	Initial owner password or credential used to repair a missing Console hash.
`MOTHERBASE_IMAGE_TAG`	`setup.sh`	no	`1.0.0`	Derives the default first-party image tags inside setup.
`API_IMAGE`	setup, Console, orchestrator, project Compose	no	`motherbase-api:<tag>`	Shared project API image.
`CONSOLE_IMAGE`	setup and Console Compose	no	`motherbase-console:<tag>`	Platform Console image.
`POSTGRES_IMAGE`	setup, orchestrator, project Compose	no	`motherbase-postgres:<tag>`	Per-project PostgreSQL image.
`ORCHESTRATION_IMAGE`	setup and Console Compose	no	`motherbase-orchestrator:<tag>`	Internal lifecycle daemon image.
`MINIO_IMAGE`	setup, orchestrator, project Compose	no	pinned from setup default	Per-project MinIO image; resolved to a digest on VPS.
`MINIO_MC_IMAGE`	setup, orchestrator, project Compose	no	pinned from setup default	MinIO client image; resolved to a digest on VPS.
`TRAEFIK_IMAGE`	setup and production Traefik	VPS: yes after pinning	pinned from `traefik:v3.3`	Production reverse-proxy image.
`TRAEFIK_DOCKER_PROXY_IMAGE`	setup and production Traefik	VPS: yes after pinning	pinned from `nginx:alpine`	Docker API proxy image.
`DOCKER_CLI_IMAGE`	setup and orchestrator build	production: yes	pinned from `docker:27-cli`	Source image for Docker CLI and Compose plugin.
`GODADDY_API_KEY`	setup and Traefik	DNS-01: yes	empty	GoDaddy DNS challenge key.
`GODADDY_API_SECRET`	setup and Traefik	DNS-01: yes	empty	GoDaddy DNS challenge secret.
`PLATFORM_DOMAIN_SUFFIX`	setup and Console	no	`DOMAIN` in VPS mode	Suffix used when pre-filling project domains.
`USER`	Docker installation branch	no	shell value	User added to the Docker group after Linux installation.

Platform Console and orchestrator

Generated values live in deploy/console/.env; Compose also supports the optional values below.

Name	Consumed by	Required?	Default	Description
`CONSOLE_MODE`	Console config	no	`prod`; Compose sets `dev` locally	Selects scheme, project directory, and project Compose file.
`CONSOLE_PORT`	Console	no	`5500`	Console HTTP listen port.
`CONSOLE_JWT_SECRET`	Console	prod: yes, min 32 chars	dev-only constant in dev mode	Signs owner sessions; generated by setup.
`CONSOLE_ADMIN_EMAIL`	Console	Compose: yes	`admin@example.com` in code	Initial owner email.
`CONSOLE_ADMIN_PASSWORD_HASH_B64`	Console	shipped Compose: yes	none	Base64 bcrypt hash, used to avoid Compose dollar interpolation.
`PREVIEW_ENABLED`	Console	no	`false`	Turns on preview projects per pull request. Has no effect without `PREVIEW_GITHUB_SECRET`.
`PREVIEW_GITHUB_SECRET`	Console	required for previews	none	Webhook secret. The receiver verifies an HMAC over the raw body with it; without one, nothing is accepted.
`PREVIEW_REPO_ALLOWLIST`	Console	required for previews	empty	Comma-separated `owner/repo`. Empty means no repository may provision — the receiver fails closed.
`PREVIEW_GITHUB_TOKEN`	Console	no	none	Only used to post the "preview ready" comment back on the pull request.
`PREVIEW_TTL_HOURS`	Console	no	`72`	Preview stacks older than this are swept hourly. `0` disables the sweep.
`CONSOLE_ADMIN_PASSWORD_HASH`	bare-node Console	no	empty	Legacy raw bcrypt fallback; setup can migrate it.
`CONSOLE_ADMIN_PASSWORD_TEMPORARY`	Console	no	`false`	Requires replacement of a generated bootstrap password.
`ORCHESTRATION_SECRET`	Console and orchestrator	shipped Compose: yes	none	Generated internal bearer shared by the two services.
`ORCHESTRATION_URL`	Console	no	`http://orchestrator:5501`	Internal daemon URL.
`ORCHESTRATION_PORT`	orchestrator	no	`5501`	Internal daemon listen port.
`PROJECTS_DIR`	Console and orchestrator	no	dev `.dev-projects`; prod `/srv/projects`	Project manifest and environment directory.
`COMPOSE_FILE`	Console and orchestrator	no	mode-specific project Compose file	Compose definition used for project lifecycle actions.
`TRAEFIK_NETWORK`	Console and orchestrator	no	`traefik_proxy`	Shared routing network.
`PLATFORM_DOMAIN_SUFFIX`	Console	no	`localhost` in dev mode, otherwise empty; setup writes `DOMAIN`	Default project-domain suffix.
`CERT_RESOLVER`	Console and project manifest	no	`letsencrypt`	Resolver written into newly generated project environments.
`UPDATE_CHECK_URL`	Console	no	empty	Read-only release-channel endpoint.
`TRUST_PROXY`	Console	no	Compose defaults to `1` in production	Express trusted proxy setting.
`CONSOLE_BASE_URL`	Console auth	no	`<scheme>://localhost:<port>`	Better Auth public base URL outside standard Compose wiring.
`CONSOLE_TRUSTED_ORIGINS`	Console auth	no	empty	Extra comma-separated auth origins.
`CONSOLE_RATE_LIMIT_WINDOW_MIN`	Console login limiter	no	`15`	Credential-attempt window in minutes.
`CONSOLE_RATE_LIMIT_AUTH_MAX`	Console login limiter	no	`20`	Credential attempts per window.
`CONSOLE_AUDIT_MAX_ENTRIES`	Console audit store	no	`10000`	Maximum audit entries, clamped to `[1, 1000000]`.
`CONSOLE_STACK_COMPOSE`	Console update service	no	`deploy/console/docker-compose.yml`	Console stack path reported by update plans.
`CONSOLE_STACK_SERVICES`	Console update service	no	`console orchestrator`	Space-separated services reported by update plans.
`CONSOLE_BILLING_ENABLED`	Console feature flags	no	`false`	Enables the optional billing surface.
`POSTGRES_IMAGE`	orchestrator	no	`motherbase-postgres:1.0.0`	Passed to project Compose commands.
`MINIO_IMAGE`	orchestrator	production: yes	local tag in dev	Passed to project Compose commands.
`MINIO_MC_IMAGE`	orchestrator	production: yes	local tag in dev	Passed to project Compose commands.
`DOCKER_CLI_IMAGE`	Console Compose build	production: yes	`docker:27-cli` in dev	Orchestrator build argument.

The standard production Console Compose does not pass CONSOLE_BASE_URL, CONSOLE_TRUSTED_ORIGINS, Console rate-limit overrides, audit size, stack-report overrides, or CONSOLE_BILLING_ENABLED.

Traefik

Values live in deploy/traefik/.env; the generated file starts the dashboard fields empty.

Name	Consumed by	Required?	Default	Description
`ACME_EMAIL`	both ACME resolvers	yes	none	ACME account email.
`TRAEFIK_IMAGE`	Traefik Compose	production: yes	none in Compose	Digest-pinned Traefik image.
`TRAEFIK_DOCKER_PROXY_IMAGE`	Traefik Compose	production: yes	none in Compose	Digest-pinned Nginx proxy image.
`TRAEFIK_DASHBOARD_HOST`	dashboard router	no	`traefik.invalid`	Host rule; empty leaves the dashboard effectively disabled.
`TRAEFIK_DASHBOARD_AUTH`	basic-auth middleware	no	invalid credential	Compose-escaped htpasswd entry.
`DNS_CHALLENGE_PROVIDER`	DNS-01 resolver	no	`godaddy` in Compose	Traefik DNS challenge provider name.
`GODADDY_API_KEY`	Traefik process	DNS-01: conditional	empty	Provider credential.
`GODADDY_API_SECRET`	Traefik process	DNS-01: conditional	empty	Provider credential.

Generated project environment

apps/server/console/lib/manifest.ts writes these values to /srv/projects/<name>/.env.prod.

Name	Consumed by	Required?	Generated default	Description
`COMPOSE_PROJECT_NAME`	Compose	yes	project name	Namespaces containers, networks, and volumes.
`PROJECT_DOMAIN`	API and Traefik labels	yes	`<name>.<suffix>`	Public project host.
`STORAGE_DOMAIN`	MinIO and Traefik labels	yes	`<name>-storage.<suffix>`	Public object-storage host.
`MINIO_CONSOLE_DOMAIN`	MinIO and Traefik labels	no	`<name>-minio.<suffix>`	MinIO admin host.
`CORS_ORIGINS`	API	no	project origin plus supplied origins	Comma-separated browser origins.
`API_IMAGE`	Compose	no	Console's configured API image	API runtime image.
`POSTGRES_PASSWORD`	PostgreSQL and API URL	yes	24 random bytes as hex	Per-project database password.
`DB_PORT`	Compose and API	no	allocated from 54320-54419	Host port the project's PostgreSQL is published on. Stable for the life of the project, so a saved connection string survives a recreate. Absent on projects created before this existed, which falls back to a random loopback port.
`DB_BIND`	Compose	no	`127.0.0.1`	Interface that port binds to. Loopback means the database is an SSH tunnel away and not an internet service. `0.0.0.0` publishes it — firewall it first.
`JWT_SECRET`	API	yes	32 random bytes as hex	Project JWT secret.
`CONFIG_ENCRYPTION_KEY`	API	no to boot	32 random bytes, base64	Encrypts Studio-managed secrets.
`PLATFORM_SERVICE_TOKEN`	Console proxy and API	yes in multi-project mode	32 random bytes as hex	Console-to-project admin bearer.
`MINIO_ROOT_USER`	MinIO and API	yes	`admin`	Per-project object-storage user.
`MINIO_ROOT_PASSWORD`	MinIO and API	yes	24 random bytes as hex	Per-project object-storage password.
`S3_BUCKET`	MinIO init and API	no	`uploads`	Private physical bucket.
`S3_REGION`	API	no	`us-east-1`	S3 region.
`CERT_RESOLVER`	Traefik labels	no	Console resolver or `letsencrypt`	Certificate resolver for project routers.
`CONSOLE_SQL_ENABLED`	API	no	`true`	Enables Project Studio SQL.
`API_CPUS`	Compose	no	`0.5`	API CPU limit.
`API_MEM`	Compose	no	`512M`	API memory limit.
`DB_CPUS`	Compose	no	`0.5`	PostgreSQL CPU limit.
`DB_MEM`	Compose	no	`512M`	PostgreSQL memory limit.
`MINIO_CPUS`	Compose	no	`0.25`	MinIO CPU limit.
`MINIO_MEM`	Compose	no	`256M`	MinIO memory limit.

deploy/docker-compose.prod.yml also accepts the following project values:

Name	Consumed by	Required?	Default	Description
`POSTGRES_IMAGE`	`db` service	no	`motherbase-postgres:1.0.0`	PostgreSQL image.
`MINIO_IMAGE`	`minio` service	prod: yes	none in Compose	Digest-pinned MinIO image.
`MINIO_MC_IMAGE`	`minio-init`	prod: yes	none in Compose	Digest-pinned MinIO client image.
`S3_PUBLIC_BUCKET`	init and API	no	`public`	Public-download physical bucket.
`ACCESS_TOKEN_EXP_MIN`	API	no	`15`	Access-token minutes.
`REFRESH_TOKEN_EXP_DAYS`	API	no	`30`	Refresh-token days.
`EMAIL_SMTP_HOST`	API	no	empty	SMTP host fallback.
`EMAIL_SMTP_USERNAME`	API	no	empty	SMTP username fallback.
`EMAIL_SMTP_PASSWORD`	API	no	empty	SMTP password fallback.
`FIREBASE_PROJECT_ID`	API	no	empty	Firebase project.
`FIREBASE_CLIENT_EMAIL`	API	no	empty	Firebase service-account email.
`FIREBASE_PRIVATE_KEY`	API	no	empty	Firebase private key.
`APNS_KEY`	API	no	empty	APNs private key.
`APNS_KEY_ID`	API	no	empty	APNs key ID.
`APNS_TEAM_ID`	API	no	empty	APNs team ID.
`APNS_BUNDLE_ID`	API	no	empty	APNs bundle ID.
`APNS_PRODUCTION`	API	no	`true` in production Compose	APNs production gateway toggle.
`CONSOLE_LOG_BUFFER_SIZE`	API	no	`500`	In-memory Project Studio log lines.
`DATABASE_ACCESS_MANAGED`	API	no	`true` in production Compose	Declares that this Postgres is the stack's own, so the Database Access screen may rewrite its `pg_hba.conf` and reload it. Anywhere else the settings are stored and reported as not applied, because the database may be shared with a dev machine, CI or a managed provider.
`LOG_PERSISTENCE_ENABLED`	API	no	`true` in production Compose	Store log lines in the database instead of the in-memory buffer only.
`LOG_RETENTION_DAYS`	API	no	`7`	Days of stored log history.
`LOG_MAX_ROWS`	API	no	`2000000`	Ceiling on stored log lines regardless of age; `0` disables it.
`EDGE_RUNTIME_URL`	API	no	`http://edge-runtime:9000`	Where the API reaches the edge runtime sidecar.
`EDGE_RUNTIME_TOKEN`	API and `edge-runtime`	prod: yes	none	Shared secret between the two. The sidecar refuses to start without it and answers `401` to a request without it.
`EDGE_RUNTIME_CALLBACK_URL`	API	no	`http://api:5001`	This API as the sidecar reaches it, for a function's `sendMail()`.

The `edge-runtime` service

deploy/docker-compose.prod.yml runs the Deno sidecar as its own service on its own network, with no route to Postgres or MinIO — the first of the two barriers that keep a function away from the stack's internals.

Name	Consumed by	Required?	Default	Description
`EDGE_RUNTIME_PORT`	`edge-runtime`	no	`9000`	Port the sidecar listens on.
`EDGE_RUNTIME_TOKEN`	`edge-runtime`	prod: yes	none	Must match the API's.
`EDGE_ALLOWED_INTERNAL_ORIGINS`	`edge-runtime`	no	`http://api:5001` in production Compose	Exact origins a function's `fetch` may call despite resolving to a private address.
`DENO_DIR`	`edge-runtime`	no	`/tmp/deno-dir`	Module cache for the worker processes.
`EDGE_RUNTIME_IMAGE`	`edge-runtime` service	no	`motherbase-edge-runtime:1.0.0`	Sidecar image.
`EDGE_RUNTIME_CPUS`	Compose	no	`0.5`	Sidecar CPU limit.
`EDGE_RUNTIME_MEM`	Compose	no	`768M`	Sidecar memory limit.

Worker-pool tuning (EDGE_MAX_WORKERS, EDGE_WORKER_IDLE_TTL_MS, EDGE_WORKER_MAX_INVOCATIONS, EDGE_WORKER_BASE_RSS_MB) is read by the sidecar too and documented in the environment reference.

Local root stack and generated-only values

The local .env written by setup.sh is consumed by the root docker-compose.yml and, for server values, by the API.

Name	Consumed by	Required?	Default	Description
`POSTGRES_PORT`	root Compose	no	`55432`	Host PostgreSQL port.
`MINIO_PORT`	root Compose	no	`59000`	Host MinIO API port.
`MINIO_CONSOLE_PORT`	root Compose	no	`59001`	Host MinIO Console port.
`S3_ACCESS_KEY_ID`	root MinIO and API	no	`minioadmin` in root Compose/setup	S3 access key.
`S3_SECRET_ACCESS_KEY`	root MinIO and API	no	`minioadmin` in root Compose/setup	S3 secret.
`S3_ENDPOINT`	API	no	empty in code	S3-compatible endpoint.
`S3_PUBLIC_URL`	API	no	empty in code	Public object base URL.
`SEED_ADMIN_EMAIL`	seed script	no	none	Local seed administrator email.
`SEED_ADMIN_PASSWORD`	seed script	no	none	Local seed administrator password.
`EMAIL_SMTP_PORT`	generated local `.env` only	no	prompt `587`	Written by `setup.sh`, but not declared in `apps/server/config/env.ts`.
`EMAIL_FROM`	generated local `.env` only	no	prompt value	Written by `setup.sh`, but not declared in `apps/server/config/env.ts`.

Project API runtime variables

These are validated by apps/server/config/env.ts. Rows already defined in the project tables above are not repeated here. The standard production Compose file forwards only the values it explicitly names.

Name	Consumed by	Required?	Code default	Production Compose
`APP_NAME`	auth emails, TOTP issuer	no	`Motherbase`	not forwarded
`NODE_ENV`	API	no	`development`	forced to `production`
`PORT`	API	no	`5001`	forced to `5001`
`DATABASE_URL`	API/Prisma	yes	none	constructed from `POSTGRES_PASSWORD`
`BASE_HOST`	API URL generation	no	`localhost:5001`	set from `PROJECT_DOMAIN`
`STATIC_PATH`	local storage	no	`uploads`	not forwarded
`USER_PATH`	legacy local user path	no	`users`	not forwarded
`MAX_UPLOAD_MB`	upload ceiling	no	`25`	not forwarded
`STORAGE_DRIVER`	storage service	no	`local`	forced to `s3`
`S3_ENDPOINT`	S3 driver	no	empty	forced to `http://minio:9000`
`S3_ACCESS_KEY_ID`	S3 driver	no	empty	set from `MINIO_ROOT_USER`
`S3_SECRET_ACCESS_KEY`	S3 driver	no	empty	set from `MINIO_ROOT_PASSWORD`
`S3_PUBLIC_URL`	S3 driver	no	empty	derived from `STORAGE_DOMAIN` and public bucket
`RATE_LIMIT_WINDOW_MIN`	API limiter	no	`15`	not forwarded
`RATE_LIMIT_GLOBAL_MAX`	API limiter/settings fallback	no	`1000`	not forwarded
`RATE_LIMIT_AUTH_MAX`	API limiter/settings fallback	no	`20`	not forwarded
`RATE_LIMIT_REST_READ_MAX`	API limiter/settings fallback	no	`300`	not forwarded
`RATE_LIMIT_REST_WRITE_MAX`	API limiter/settings fallback	no	`120`	not forwarded
`RATE_LIMIT_EDGE_MAX`	API limiter/settings fallback	no	`60`	not forwarded
`EDGE_PUBLIC_INVOKE_ENABLED`	edge invoke guard	no	`false`	not forwarded
`EDGE_INVOKE_TOKEN`	edge invoke guard	no	empty	not forwarded
`EDGE_SECRETS_ENABLED`	edge function service	no	`true`	not forwarded
`BACKUP_DIR`	backup/import service	no	`backups`	not forwarded; volume is mounted at `/app/backups`
`AI_DATA_DIR`	assistant thread store	no	`data`	not forwarded; volume is mounted at `/app/data`
`PG_BIN_DIR`	pg_dump/psql launcher	no	PATH lookup	not forwarded
`BACKUP_ENABLED`	backup settings fallback	no	`false`	not forwarded
`BACKUP_CRON`	backup settings fallback	no	`0 3 * * *`	not forwarded
`BACKUP_RETENTION`	backup settings fallback	no	`7`	not forwarded
`BACKUP_OFFSITE`	backup settings fallback	no	`false`	not forwarded
`BACKUP_BUCKET`	offsite backup client	no	`backups`	not forwarded
`BACKUP_S3_ENDPOINT`	offsite backup client	no	main S3 endpoint	not forwarded
`BACKUP_S3_REGION`	offsite backup client	no	main S3 region	not forwarded
`BACKUP_S3_ACCESS_KEY_ID`	offsite backup client	no	main S3 access key	not forwarded
`BACKUP_S3_SECRET_ACCESS_KEY`	offsite backup client	no	main S3 secret	not forwarded

TRUST_PROXY defaults to empty (false) in code, but deploy/docker-compose.prod.yml forwards it as ${TRUST_PROXY:-1}: a project stack behind Traefik trusts exactly the one hop in front unless you override it. Leaving it unset in a stack with no proxy is the correct choice — trusting X-Forwarded-For there lets any client forge its IP.

Project setting fallbacks

The settings registry under apps/server/config/settings/ reads these process variables only as initial fallbacks. Persisted AppSetting values take precedence.

Name	Consumed by	Required?	Default	Description
`GOOGLE_CLIENT_ID`	`auth.social` fallback	no	empty	Enables/configures Google when present.
`GOOGLE_CLIENT_SECRET`	`auth.social` fallback	no	empty	Google client secret.
`APPLE_CLIENT_ID`	`auth.social` fallback	no	empty	Enables/configures Apple when present.
`APPLE_CLIENT_SECRET`	`auth.social` fallback	no	empty	Apple client secret.
`APPLE_BUNDLE_ID`	`auth.social` fallback	no	empty	Apple audience/bundle ID.
`AUTH_ALLOW_SIGNUP`	auth policy fallback	no	enabled unless `false`	Allows new users.
`AUTH_REQUIRE_EMAIL_VERIFICATION`	auth policy fallback	no	`false`	Requires verified email.
`AUTH_AUTO_SIGNIN`	auth policy fallback	no	enabled unless `false`	Signs in after verification.
`AUTH_MIN_PASSWORD_LENGTH`	auth policy fallback	no	`8`	Minimum password length.
`AUTH_MAX_PASSWORD_LENGTH`	auth policy fallback	no	`128`	Maximum password length.
`TWILIO_ACCOUNT_SID`	SMS fallback	no	empty	Twilio account SID.
`TWILIO_AUTH_TOKEN`	SMS fallback	no	empty	Twilio auth token.
`TWILIO_FROM_NUMBER`	SMS fallback	no	empty	Twilio sender used by messaging settings.
`EMAIL_VERIFICATION_SUBJECT`	email template fallback	no	built-in template	Verification subject.
`EMAIL_VERIFICATION_BODY`	email template fallback	no	built-in template	Verification body.
`EMAIL_RECOVERY_SUBJECT`	email template fallback	no	built-in template	Recovery subject.
`EMAIL_RECOVERY_BODY`	email template fallback	no	built-in template	Recovery body.
`DATA_RETENTION_ENABLED`	data retention settings	no	enabled unless `false`	Enables operational-log pruning.
`DATA_RETENTION_CRON`	data retention settings	no	`15 4 * * *`	Pruning schedule.
`WEBHOOK_DELIVERY_RETENTION_DAYS`	data retention settings	no	`30`	Webhook delivery retention.
`EDGE_FUNCTION_LOG_RETENTION_DAYS`	data retention settings	no	`30`	Edge log retention.
`DATA_RETENTION_BATCH_SIZE`	data retention settings	no	`500`	Rows removed per batch.
`DATA_RETENTION_MAX_BATCHES`	data retention settings	no	`20`	Maximum batches per run.
`REALTIME_RETENTION_ENABLED`	realtime retention settings	no	enabled unless `false`	Enables terminal outbox pruning.
`REALTIME_OUTBOX_COMPLETED_DAYS`	realtime retention settings	no	`7`	Delivered-event retention.
`REALTIME_OUTBOX_FAILED_DAYS`	realtime retention settings	no	`30`	Failed-event retention.
`REST_MAX_ROWS`	REST settings fallback	no	`1000`	Maximum rows per REST read, capped at 1000.

These fallback variables are not forwarded by the current production project Compose file. Configure their corresponding groups through Project Studio unless you maintain a Compose override that passes them.

Integration secrets

The uppercase names in apps/server/config/integrations-registry.ts are Project Studio edge-function secrets, not host or Compose process variables. They are injected into an edge sandbox only when edge secrets are enabled.

Name	Consumed by	Required?	Default	Description
`STRIPE_SECRET_KEY`	Stripe edge template	integration: yes	none	Stripe API key.
`CALENDLY_TOKEN`	Calendly edge template	integration: yes	none	Calendly access token.
`AIRTABLE_TOKEN`	Airtable edge template	integration: yes	none	Airtable token.
`AIRTABLE_BASE_ID`	Airtable edge template	integration: yes	none	Airtable base.
`AIRTABLE_TABLE`	Airtable edge template	integration: yes	none	Airtable table.
`SLACK_WEBHOOK_URL`	Slack edge template	integration: yes	none	Incoming webhook.
`DISCORD_WEBHOOK_URL`	Discord edge template	integration: yes	none	Discord webhook.
`RESEND_API_KEY`	Resend edge template	integration: yes	none	Resend key.
`RESEND_FROM`	Resend edge template	integration: yes	none	Sender address.
`OPENAI_API_KEY`	OpenAI edge template	integration: yes	none	OpenAI API key.
`TWILIO_ACCOUNT_SID`	Twilio edge template	integration: yes	none	Twilio SID.
`TWILIO_AUTH_TOKEN`	Twilio edge template	integration: yes	none	Twilio token.
`TWILIO_FROM`	Twilio edge template	integration: yes	none	Twilio sender used by the integration template.
`GITHUB_TOKEN`	GitHub edge template	integration: yes	none	GitHub token.
`GITHUB_REPO`	GitHub edge template	integration: yes	none	Repository identifier.
`NOTION_TOKEN`	Notion edge template	integration: yes	none	Notion token.
`NOTION_DATABASE_ID`	Notion edge template	integration: yes	none	Notion database.

Optional GitHub VPS workflow

The deploy-vps job in .github/workflows/ci.yml uses:

Name	Required?	Default	Use
`VPS_HOST`	deployment: yes	none	SSH host; empty skips deployment.
`VPS_SSH_KEY`	deployment: yes	none	SSH private key; empty skips deployment.
`VPS_KNOWN_HOSTS`	no	generated with `ssh-keyscan`	Pinned SSH host keys.
`VPS_USER`	yes	`motherbase`	Dedicated non-root deploy account; `root` is rejected.
`VPS_SSH_PORT`	no	`22`	SSH port.
`VPS_REMOTE_DIR`	no	`boilerplate-backend` under the user's home	Remote checkout.
`CONSOLE_URL`	smoke test: yes	none	Enables the VPS smoke test when present.
`ADMIN_EMAIL`	smoke test: conditional	none	Console smoke-test login.
`ADMIN_PASSWORD`	smoke test: conditional	none	Console smoke-test password.
`PROJECT`	no	`test`	Smoke-test project.
`PROJECT_URL`	critical flows: yes	none	Project API URL.
`PROJECT_EMAIL`	critical flows: yes	none	Project test user.
`PROJECT_PASSWORD`	critical flows: yes	none	Project test password.
`RLS_MODEL`	critical flows: yes	none	Model used by the RLS smoke flow.
`PRIVATE_EDGE_ROUTE`	critical flows: yes	none	Private edge route used by the smoke flow.

The workflow pulls with --ff-only and runs ./setup.sh --yes --skip-dns-check on the VPS. It does not pass --prod; the existing non-local BASE_HOST makes setup recover VPS mode.

Environment reference — the same variables grouped by feature, with defaults.
Setup script — which of these setup.sh writes for you.