Configuration
Environment variable reference for Floprints. Required secrets, optional execution caps, and SMTP settings.
Required
| Variable | Description |
|---|---|
DATABASE_URL | PostgreSQL connection string |
SESSION_SECRET | Exactly 32 characters — signs session cookies (openssl rand -hex 16) |
KEK_PRIMARY | Min 32 characters — key-encryption key for envelope-encrypted secrets (openssl rand -hex 32) |
PUBLIC_URL | Public origin for invite and password-reset email links |
Optional
| Variable | Default | Description |
|---|---|---|
PORT | 9000 | HTTP port for the Node API (inside container) |
KEK_SECONDARY | — | Previous KEK during rotation |
LOG_LEVEL | info | Log verbosity |
LOG_FORMAT | pretty | pretty (dev) or json (production) |
Execution cost caps
These only tighten the built-in envelope; values above the envelope are clamped:
| Variable | Default | Envelope max |
|---|---|---|
AGENT_MAX_ITERATIONS | 50 | Set in packages/common workflow schema |
AGENT_TIMEOUT_SECONDS | 1200 | Same |
ORCHESTRATOR_MAX_ITERATIONS | 100 | Same |
ORCHESTRATOR_TIMEOUT_SECONDS | 3600 | Same |
To allow higher limits, raise the envelope in code — the console validates against it.
SMTP (optional)
Leave SMTP_HOST unset to disable email. When set, all of SMTP_HOST, SMTP_USER, SMTP_PASSWORD, and SMTP_FROM are required.
Used for user invites and password resets.
What is NOT in env
AWS Bedrock settings (region, keys, execution role, runtime URI, gateway ARN, default model) are stored per provider in the database via the console.
Per-tool credentials (MCP servers, etc.) are configured in Settings → Tools and envelope-encrypted per row.
Docker Compose reference
See compose.yml in the repo for the production stack:
- traefik — TLS + Let’s Encrypt
- app — nginx (console SPA) + Node API via supervisord
- db — PostgreSQL 18
- migrate — one-shot migration profile