Required & optional environment variables
The environment variables the Eddytor server reads at boot - secrets and overrides.
Secrets live in the environment, not config.toml. In the self-host stack these
sit in .env (Compose) or the eddytor-secrets Secret (Kubernetes).
Required (minimum)
| Variable | Purpose |
|---|---|
EDDYTOR_DATABASE_URL | Postgres connection string. Append ?sslmode=require for managed Postgres. |
EDDYTOR_ENCRYPTION_KEY | 32-byte base64 AES-256-GCM-SIV master key. Generate with openssl rand -base64 32. |
EDDYTOR_API_KEY_SECRET | 32+ random bytes used to sign API keys. openssl rand -base64 32. |
EDDYTOR_CONFIG_FILE is optional - the path to your config.toml (see
Custom config file).
Heads up
Back up
EDDYTOR_ENCRYPTION_KEY. Losing it makes every
stored secret unrecoverable; a wrong key fails server boot with secret decrypt failed. See Backups & key rotation.Optional
- SMTP (production magic-link delivery):
EDDYTOR_SMTP_HOST,_PORT,_USER,_PASS,_FROM. With none set, magic-link bodies log to stdout. See SMTP. - Provider OAuth apps (let users link Azure/Google for storage discovery) are not env vars - they're configured per-organisation at runtime. See Provider OAuth apps.
Config overrides via env
Any config.toml field can be overridden with EDDYTOR__SECTION__KEY (double
underscores), e.g.:
EDDYTOR__SERVER__PUBLIC_URL=https://app.example.com
EDDYTOR__SERVER__WEB_REDIRECT_URIS=https://app.example.com/auth/callbackThese take top priority - see the resolution order.
Where they live
- Compose:
.envnext todocker-compose.yml(auto-loaded). Back it up. - Kubernetes: the
eddytor-secretsSecret, referenced with--set secrets.existingSecret=eddytor-secrets.