.env file generated by bin/prepare.js. In production, set them directly in your environment, Docker Compose file, or Dokku config.
Use
.env.example at the repo root as the canonical template. Never commit a .env file containing real secrets.Database
PostgreSQL connection string. Set automatically by Dokku’s
postgres:link command, or configure manually.Example: postgresql://postgres:postgres@localhost/mainRedis connection URL used for sessions, async task queues (Bull), and caching.Example:
redis://localhost:6379Alternative to
REDIS_URL for Valkey or Redis-compatible key-value stores.Example: redis://localhost:7001Server
The public-facing URL of the application. Used by Next.js for API calls from the frontend to the backend.Example:
https://condo.example.comThe port the application listens on. Assigned automatically by
bin/prepare.js during local setup.Example: 4006Application environment. Must be set to
production in production deployments.Accepted values: development, production, testDefault locale for the application UI.Example:
enDisables structured logging output when set to
true. Not recommended in production.Example: falseDisables API rate limiting. Set to
false in production to enable rate limiting.Example: trueAuth and security
Secret key used by KeystoneJS to sign session cookies. Use a long, randomly generated string.Example:
AWJfbsbaf! (use a securely generated 32+ character string in production)JSON configuration for data encryption used by the webhook system. The object key is the version identifier and must match
DATA_ENCRYPTION_VERSION_ID. The secret must be exactly 32 characters.Example: {"myapp_1":{"algorithm":"aes-256-gcm","secret":"your-32-character-secret-string","compressor":"brotli","keyDeriver":"pbkdf2-sha512"}}Identifies which encryption key version from
DATA_ENCRYPTION_CONFIG is currently active.Example: v1Build variables
These variables are used during the Docker image build stage. Set them in your.env before running docker-compose build.
Shell command run inside the Dockerfile to install extra system packages or Python dependencies.Example:
python3 -m pip install 'psycopg2-binary>=2.8.5' && python3 -m pip install 'Django>=3.0.6'Shell command run inside the Dockerfile to build static assets or prepare production files.Example:
yarn workspace @app/condo buildRuntime (Docker Compose)
These variables are consumed bydocker-compose.yml at container startup.
The command Docker uses to start the web application inside the container.Example:
yarn workspace @app/condo startSession cookie secret passed into the container. Equivalent to
COOKIE_SECRET for Docker Compose deployments.Example: some-secret-random-stringPublic URL of the application passed into the container. Equivalent to
SERVER_URL for Docker Compose deployments.Example: https://condo.example.comFile storage
Storage backend for uploaded files. Use
local for development or s3 for production.Accepted values: local, s3S3-compatible endpoint URL. Required when
FILE_FIELD_ADAPTER=s3.Example: https://s3.amazonaws.comAWS or S3-compatible access key ID. Required when
FILE_FIELD_ADAPTER=s3.AWS or S3-compatible secret access key. Required when
FILE_FIELD_ADAPTER=s3.Name of the S3 bucket for file storage. Required when
FILE_FIELD_ADAPTER=s3.AWS region for the S3 bucket.Example:
us-east-1Worker
Number of concurrent jobs the worker process will handle.Example:
50Cache
JSON configuration for the Keystone adapter-level cache.Example:
{"enabled": true, "excludedLists":[], "logging":0, "maxCacheSize":1000, "logStatsEachSecs": 60}JSON configuration for per-request caching.Example:
{"enabled": true, "logging":0, "logStatsEachSecs": 60}Notifications
When
true, all notification messages are printed to stdout instead of being dispatched. Useful for local development.Example: trueDisables notification-specific log output.Example:
falseOptional integrations
Firebase Admin SDK service account JSON for push notifications. Retrieve from the Firebase console under Settings → Service accounts.Example:
{"type": "service_account", "project_id": "<PROJECT_ID>", ...}Huawei Messaging System (HMS) credentials for push notifications to Huawei devices.Example:
{"resident": {"clientId": "<ID>", "secret": "<SECRET>"}, "master": {"clientId": "<ID>", "secret": "<SECRET>"}}Apple Push Notification service (APNs) credentials.Example:
{"kid": "<KEY_ID>", "iss": "<ISSUER_ID>", "privateKey": "<PRIVATE_KEY>"}hCaptcha configuration for bot protection on forms.Example:
{"API_KEY":"<API_KEY>", "SITE_KEY":"<SITE_KEY>", "ANDROID_KEY":"<KEY>", "IOS_KEY":"<KEY>"}Disables captcha verification. Set to
false in production when HCAPTCHA_CONFIG is configured.Example: trueOpenID Connect client configuration for SSO integration.Example:
{"serverUrl":"http://localhost:3000", "clientId":"<client id>", "clientSecret":"<client secret>"}Feature flag service configuration. Supports remote API or static flags.Example:
{"url": "http://localhost:3100/api/features", "apiKey": "key"}NATS-based messaging broker configuration for real-time subscriptions.Example:
{"enabled":true,"brokerUrl":"nats://127.0.0.1:4222","wsUrl":"ws://localhost:8080","tokenSecret":"your-secret-key",...}Enables AI-powered features.Example:
trueJSON configuration mapping AI flow names to adapter endpoints (Flowise, n8n, etc.).
JSON configuration for AI adapter credentials.
Contact details shown in the UI for support requests.Example:
{"support_email": "[email protected]", "support_phone": "+1 301 000-00-00"}Email address that receives bank account request notifications.Example:
[email protected]Disables Next.js anonymous telemetry. Set to
1 to opt out.Example: 1Enables GraphQL subscription support via the messaging broker.Example:
trueForces the app to use locally defined feature flags instead of a remote service.Example:
true