Environment variables
Configuration and secrets for your web services, workers and cron jobs.
Use environment variables for configuration and secrets, such as API keys. They belong to the project. You add each one once, on the project's Environment page, and choose which services receive it. Your code reads them the usual way, for example process.env.API_KEY in Node.js or os.environ["API_KEY"] in Python.
Who receives a variable
When you add or edit a variable, Available to has two options:
- All services: every web service, worker and cron job in the project, including ones you add later.
- Only the services I choose: tick the web services, workers and cron jobs that should receive it.
A worker or cron job also receives the variables chosen for the web service it is attached to.
Databases, key value stores and storage services don't receive variables.
Two variables with the same name can't reach the same service. For example, a project-wide API_KEY and a second API_KEY chosen for one service can't both exist.
Add a variable
- Open the project's Environment page.
- Click Add Variable.
- Enter the key and the value. Keys use letters, digits and underscores, and can't start with a digit.
- Choose Available to.
- Click Save and confirm.
Changes restart services
Saving, editing or deleting a variable restarts the services, workers and cron jobs that receive it, without a rebuild, so they pick up the change within seconds. Appentic asks you to confirm first.
Deleting a variable your app needs to start takes it offline until you add the variable back. Adding it back brings everything up again, workers included.
Reveal, edit and delete
The table lists each variable's Key, Value, Available to and Managed by.
- Reveal: values are hidden. Click one to show it for 10 seconds, and click the shown value to copy it.
- Edit: click the pencil icon, change the key, value or Available to, and click Save.
- Delete: click the bin icon and confirm.
Import a .env file
- Click Import .env.
- Paste the contents of a
.envfile:KEY=VALUEpairs, one per line. Lines starting with#are ignored. - Click Import and confirm.
Imported variables go to all services. An import updates a variable that's already available to all services, and skips one that's limited to chosen services, listing those afterwards. Importing redeploys every service in the project.
Export a .env file
Click Export .env to download every variable in the project as a .env file, with its value. The file includes managed variables such as DATABASE_URL, and comments saying which services each scoped variable is available to. Keep the file private and don't commit it to your repository.
Managed variables
When you connect a database, key value store or storage service to services, or turn on a fixed outbound address, Appentic adds managed variables to the project:
| Connected from | Variables |
|---|---|
| Postgres | DATABASE_URL |
| Key value store | REDIS_URL |
| Storage | S3_ENDPOINT, S3_REGION, S3_BUCKET, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY |
| Fixed outbound address | HTTPS_PROXY, HTTP_PROXY, NO_PROXY, and the same in lower case, for every web service, worker and cron job |
Managed variables show the resource they come from under Managed by, with a lock icon. You can reveal them, but not edit or delete them. They change when you connect or disconnect services in that resource's Settings. You can also connect a database or key value store when you create a web service, with Connect database and Connect key value store.
Set automatically
Every web service receives these:
| Variable | Value |
|---|---|
PORT | Always 8080: the port your app listens on. See Your app's port. |
TRUSTED_HOSTS | Every name the service is reached by, comma-separated: its appentic.app address, its custom domains, and the private names other services in the project use. Frameworks that check the Host header (Feather, Django through your settings) can read it. It updates when a custom domain becomes active, and the service restarts with it. |
WEB_CONCURRENCY | How many worker processes to run for the service's memory: one per 256 MB, from 1 to 8. Gunicorn and Feather's feather start read it. |
TRUSTED_HOSTS is always set. If you add your own, your names are kept and Appentic adds every name the service is reached by. Your app never refuses one of its own custom domains.
To use your own WEB_CONCURRENCY, add the variable yourself. Yours always wins.
Security
Values are encrypted when stored. You see them only when you reveal or export them on the Environment page, and they never appear in logs or events.