| Variable | Required? | Notes |
|---|---|---|
| AUTH_SECRET | Yes | NextAuth JWT signing secret, ≥32 chars. Auto-generated by start.sh/start.bat if left as the placeholder. |
| NEXTAUTH_URL | Yes | Public URL of the app — http://localhost:3000 for local use. |
| ANTHROPIC_API_KEY | No | Falls back to whatever you set via Settings → API Keys if unset. |
| OPENAI_API_KEY | No | Same fallback behavior; also needed for Telegram voice-note transcription. |
| NVIDIA_API_KEY | No | Free-tier key, same fallback behavior. |
| OLLAMA_BASE_URL | No | Only needed if running Ollama outside the bundled container — default http://ollama:11434. |
| DATABASE_URL | Auto | Built automatically by entrypoint.sh — you don't set this yourself. |
| CRON_SECRET | Yes | Bearer token for cron-triggered/admin routes. |
Keys set as env vars take priority over keys entered through Settings for that same provider.
These matter once you're running the full multi-service stack (Traefik, n8n, Syncthing vault) —
see .env.template at the repo root for the complete, commented list. Highlights:
| Variable | Purpose |
|---|---|
| DOMAIN / ACME_EMAIL | Your domain + Let's Encrypt email for Traefik's auto-HTTPS |
| POSTGRES_USER/PASSWORD/DB | Database credentials, shared by the app, n8n, and pgvector |
| REDIS_PASSWORD | Cache/rate-limiting |
| OLLAMA_DATA_PATH | Host path for Ollama model storage — use a dedicated volume |
| OLLAMA_AUTO_PULL | Space-separated model list to auto-pull on container start (e.g. qwen2.5:3b qwen2.5:7b) |
| N8N_ENCRYPTION_KEY, N8N_BASIC_AUTH_USER/PASSWORD, N8N_HOST | n8n's own config, if you run it alongside |
| VAULT_PATH, BRAIN_SECRET, VAULT_CONTEXT_ENABLED | Obsidian vault sync + Brain context injection — see n8n — connect AgentPlayground to n8n |
| TELEGRAM_BOT_TOKEN, TELEGRAM_WEBHOOK_SECRET | Telegram bot — see Telegram |
| REGISTRATION_OPEN | Self-registration master switch — unset/false = closed (default) |
| REQUIRE_INVITE_CODE | Gate self-registration behind an invite code, applies on top of REGISTRATION_OPEN |
| VPS_SSH_KEY | Enables the SSH-based tool installer for admin/dev use |
Never put real secrets in docker-compose.yml itself — only in .env/.env.local, which is
gitignored. This is a hard rule in this codebase, not just good practice.