Environment variables
Every environment variable Eddytor reads - secrets, datastores, UI, and config overrides.
Secrets and per-deploy wiring live in the environment (.env for Compose, the
eddytor-secrets Secret for Kubernetes). Non-secret settings go in
config.toml.
Required
| Variable | Purpose |
|---|---|
EDDYTOR_DATABASE_URL | Postgres connection string. Add ?sslmode=require for managed Postgres. |
EDDYTOR_ENCRYPTION_KEY | 32-byte base64 AES-256-GCM-SIV master key (openssl rand -base64 32). Back it up. |
EDDYTOR_API_KEY_SECRET | 32+ random bytes used to sign API keys. Rotating it invalidates all keys. |
Optional / common
| Variable | Purpose |
|---|---|
EDDYTOR_CONFIG_FILE | Path to your config.toml. |
EDDYTOR_VERSION | Pinned server/engine image tag (Compose). |
EDDYTOR_BUCKET | Bundled object-store bucket name (default eddytor). |
EDDYTOR_SMTP_HOST / _PORT / _USER / _PASS / _FROM | SMTP for magic-link delivery. |
Web UI (Compose)
| Variable | Purpose |
|---|---|
COMPOSE_PROFILES=ui | Start the eddytor-ui service. |
EDDYTOR_WITH_UI=true | Non-interactive installer flag to include the UI. |
EDDYTOR_UI_VERSION | Pinned UI image tag. |
EDDYTOR_UI_ORIGIN | The UI's public origin. |
EDDYTOR_UI_API_BASE_URL | Backend origin the browser is redirected to for OAuth. |
EDDYTOR_UI_COOKIE_DOMAIN | Auth cookie domain (empty = host-only). |
See Deploy the Web UI.
Bundled Garage (evaluation)
| Variable | Purpose |
|---|---|
GARAGE_ACCESS_KEY / GARAGE_SECRET_KEY | Bundled object-store credentials (installer-generated). |
Config overrides
Any config.toml field can be set via
EDDYTOR__SECTION__KEY (double underscores), e.g.:
EDDYTOR__SERVER__PUBLIC_URL=https://app.example.com
EDDYTOR__SERVER__WEB_REDIRECT_URIS=https://app.example.com/auth/callback
EDDYTOR__SERVER__CORS__ALLOWED_ORIGINS=https://app.example.comThese take top priority in the resolution order.
Heads up
Back up the secrets -
.env (Compose) or the
eddytor-secrets Secret (k8s). Losing EDDYTOR_ENCRYPTION_KEY makes stored
secrets unrecoverable; a wrong one fails boot with secret decrypt failed. See
Backups & key rotation.