Environment Reference

What It Is

An isolated environment (see Isolated Deployment and Self-Hosting) is configured through environment variables, set before it starts:

• in a managed installation, the console sets them;
• in a self-hosted one, they are in .env next to compose.yaml.

This chapter lists every variable, one per heading.

Why It Matters

These variables decide things that cannot be changed from inside the application:

• who the environment is;
• where its data lives;
• which secrets protect it;
• which services it may use.

Most have sensible defaults; the required ones are marked.

How To Read This Chapter

Each variable states what it controls, its default, and when to change it. Changing a variable takes effect when the environment is restarted:

• self-hosted: docker compose up -d;
• managed: a redeploy by the console.

Identity And Domains

TENANT_ID

Required. The permanent identity of the environment, written like a domain, for example acme.jetstack.app. It names the environment's data and its lineage in Promotion And Packages. Set it once and never change it, also when the environment's domains change; production and development must have different values.

JETSTACK_PUBLIC_HOST

Required. The primary domain: links, e-mails, sign-in and file URLs use it. It can change, for example when the organization moves to its own domain.

JETSTACK_HOSTS

Further domains the environment answers to (aliases), comma-separated. Requests for any domain not listed here, nor as the public host, the tenant ID or an entry domain, are refused, so another site pointed at the server cannot show this environment. Do not list exclusive entry domains here (see JETSTACK_ENTRY_HOSTS). Default: none.

JETSTACK_REDIRECT_HOSTS

Aliases that answer with a permanent redirect to the same page on the primary domain instead of serving the environment, comma-separated. List them in JETSTACK_HOSTS too. Use this for a legacy domain whose users should converge on the new one. Default: none.

JETSTACK_ENTRY_HOSTS

Domains that open one custom app, comma-separated, each as domain=app or domain=app:exclusive, for example www.acme.com=website:exclusive,portal.acme.com=portal.

• domain=app opens the app at /; the rest of the platform answers there too. List the domain in JETSTACK_HOSTS as well.
• domain=app:exclusive serves only the app, mounted at the root of the domain, with sign-in. Everything else answers "not found". Do not list the domain in JETSTACK_HOSTS: an older image that does not know this variable then refuses the domain instead of serving the back office there.

The primary domain, the tenant ID and redirecting aliases cannot open an app. Items that are not valid are left out and reported by jetstack-admin entry-hosts and in the console. See Entry Domains. Default: none.

JETSTACK_ENVIRONMENT

production (default) or development. Development shows a banner and, with JETSTACK_OUTBOUND_GUARD, never sends messages to real people.

JETSTACK_PEER_URL

The address of the paired environment (development for production and vice versa). The development banner links to it, command-line tools read it to find both environments, and production accepts a promotion sign-in only from it. Default: none.

JETSTACK_PEER_INTERNAL_URL

Where development's server reaches production during a promotion from its History screen, when production's public address does not work from the inside, for example http://acme-prod-app on a self-hosted pair's network. The calls still name production's public domain. The self-hosted installer sets it on development. Default: none, which uses JETSTACK_PEER_URL.

APP_TIMEZONE

The default time zone of the environment, for example Europe/Prague (default), used where neither the user nor the Application Settings choose another.

Database

DB_HOST

Required. The MariaDB server. In the self-hosted stack it is the bundled database.

DB_PORT

The database port. Default 3306.

DB_NAME

The database name. Default jetstack.

DB_USER

The database user of the application. Default jetstack.

DB_PASSWORD

Required. The password of DB_USER. Generated by the installer or the console.

DB_RO_PASSWORD

The password of jetstack_ro, a read-only database user. The console's SQL tool uses it, so read-only queries cannot change data even by mistake. Without it, the user is not created.

DB_ROOT_PASSWORD

The database administrator's password. When present, the environment uses it at start to create the read-only user and the AI assistant's database, and then removes it from its own process environment. Without it those steps are skipped.

JETSTACK_DB_DUMP_KEEP

How many nightly database dumps to keep in the tenant directory (backup/). Default 3; 0 turns the dumps off. They are a convenient, consistent copy for self-hosted backups.

Cache And Sessions

REDIS_HOST

Required. The Redis (or Valkey) server: cache, sessions, the scheduler's lock and live updates.

REDIS_PORT

The Redis port. Default 6379.

REDIS_PASSWORD

Required in the bundled stack. The Redis password.

Secrets

APP_SECRET_KEYS_JSON

Required. The keys that encrypt the secrets the tenant stores (the Secret Store and the credentials it holds for integrations): a JSON object of a numeric key ID to a base64 32-byte key, for example {"1":"…"}. Never reuse it between environments, and back it up: without it, a restored database cannot read its secrets.

JETSTACK_OPS_SECRET

Turns on the signed operations API the provider's console uses: health, installation, log files, final archives and the SQL tool. Leave it empty in a self-hosted installation; the API then does not exist.

Files

JETSTACK_STORAGE_DRIVER

Where uploaded files are kept:

• local (default): on the environment's volume;
• s3: in an S3-compatible bucket.

Files are not moved when this changes, so choose it before files are uploaded.

JETSTACK_S3_ENDPOINT

With s3: the bucket's endpoint, for example https://s3.eu-central-003.backblazeb2.com.

JETSTACK_S3_REGION

With s3: the bucket's region. Default us-east-1.

JETSTACK_S3_BUCKET

With s3: the bucket.

JETSTACK_S3_ACCESS_KEY_ID

With s3: the access key.

JETSTACK_S3_SECRET_ACCESS_KEY

With s3: the secret key.

JETSTACK_S3_PREFIX

With s3: the key prefix the environment's files go under. Default: the tenant ID, so production and development can share a bucket.

JETSTACK_S3_PATH_STYLE

With s3: path-style addresses (endpoint/bucket/key), which most non-AWS endpoints need. Default on.

JETSTACK_S3_PUBLIC_BASE_URL

With s3: a public or CDN address of the bucket. Without it, file links are signed and expire.

Mail, SMS And Push

MAIL_RESEND_API_KEY_DEFAULT

The default Resend key for e-mail, used until the tenant configures its own mail gateway. Default: none.

MAIL_DEFAULT_FROM_EMAIL

The default sender address. It must belong to a domain verified with the mail gateway.

MAIL_DEFAULT_FROM_NAME

The default sender name.

MAIL_DEFAULT_REPLY_TO

The default reply-to address of e-mail sent with the default sender. A reply-to set in the tenant takes precedence.

SMS_BULKGATE_APPLICATION_ID_DEFAULT

The default BulkGate application for SMS, used until the tenant configures its own.

SMS_BULKGATE_APPLICATION_TOKEN_DEFAULT

The token of the default BulkGate application.

JETSTACK_OUTBOUND_GUARD

on sends e-mail, SMS and push only to the override recipients set in the tenant, or to nobody. Development environments of a managed installation have it on, so testing never reaches real people. Default off.

Sign-In

OAUTH_GOOGLE_CLIENT_ID

The installation's own Google OAuth client, for signing in with Google. Its redirect URI is https://<domain>/identity/google.

OAUTH_GOOGLE_CLIENT_SECRET

The secret of that Google client.

OAUTH_MICROSOFT_CLIENT_ID

The installation's own Microsoft OAuth client. Its redirect URI is https://<domain>/identity/microsoft.

OAUTH_MICROSOFT_CLIENT_SECRET

The secret of that Microsoft client.

JETSTACK_IDENTITY_BROKER_URL

Signs in with Google and Microsoft through a Jetstack identity broker instead of own OAuth clients; the console sets it for managed tenants. Default: none (own clients).

JETSTACK_IDENTITY_BROKER_PUBLIC_KEY

The broker's public key (base64 of 32 bytes). The environment accepts only confirmations signed with it, for one of its own domains, within two minutes, once.

AI Assistant

JETSTACK_AI_SIDECAR

on (default) runs the AI assistant's service inside the environment; off leaves it out.

JETSTACK_AI_INTERNAL_SECRET

With the assistant: the secret between the application and its service. Without it the assistant stays off.

JETSTACK_AI_CHAT_TOKEN_SECRET

With the assistant: signs the short-lived tokens of chat sessions.

JETSTACK_AI_CHAT_TOKEN_TTL

How long a chat session's token stays valid, in seconds (at least 60; default 900). The chat asks for a new one before it expires.

JETSTACK_AI_AGENT_TOKEN_TTL

How long the keys an agent works with while it answers one message stay valid, in seconds (at least 60; default 900). An agent's own token_ttl_seconds takes precedence.

OPENAI_API_KEY

Optional fallback OpenAI key for the assistant; a key configured in the tenant takes precedence.

ANTHROPIC_API_KEY

Optional fallback Anthropic key for the assistant.

ANTHROPIC_BASE_URL

Where the assistant sends its Anthropic requests, for example an API gateway. Default https://api.anthropic.com. The requests carry the Anthropic key, so name only a service you trust with it.

GEMINI_API_KEY

Optional fallback Google Gemini key for the assistant.

Running

PHP_FPM_MAX_CHILDREN

How many requests the environment handles at once. Default 8. Raise it with the memory limit for busy tenants.

PHP_MEMORY_LIMIT

The memory one request may use. Default 512M.

JETSTACK_KEEPALIVE_AFTER

Seconds a request runs before its answer starts streaming to keep the connection open behind proxies. Default 15. See Long-Running Requests.

JETSTACK_KEEPALIVE_EVERY

Seconds between two blocks of padding of a streaming answer. Default 15; keep it well below the shortest idle limit in front of Jetstack. See Long-Running Requests.

JETSTACK_DRAIN_SECONDS

On stop, how long the environment keeps serving while it reports itself unhealthy, so a proxy moves new requests to its replacement first. Default 0 (one container, nothing to hand over to); managed environments use 15.

JETSTACK_STUDIO_SERVER_BUILDS

off stops the environment from building Studio apps itself. By default it builds an app's draft when nothing else has: when someone publishes it while nobody has the Studio open, and when an AI agent checks it then. The image's Node does the build, with the same tools the Studio uses in the browser. With off, publishing such a draft waits for the Studio to build it.

APP_LICENSE_KEY

Reserved. Leave empty.

Self-Hosted Stack Only

JETSTACK_IMAGE

The application image, for example ghcr.io/martinloucka/jetstack-app.

JETSTACK_IMAGE_TAG

Required. The version: an immutable sha-… tag. The installer sets it; upgrading changes it.

JETSTACK_BIND

The local address the application listens on, which your own HTTPS proxy forwards to. Default 127.0.0.1:8080; the installer gives development 127.0.0.1:8081, so both can run on one machine.

COMPOSE_PROJECT_NAME

The Compose project name, which prefixes the containers and volumes. The installer sets jetstack-<name>-prod, jetstack-<name>-dev and jetstack-<name>-edge, so several installations can share a machine. An installation made before pairs keeps jetstack-<name> for production.

JETSTACK_EDGE_NETWORK

The Docker network a self-hosted pair shares: both applications and the edge Caddy join it. The installer creates it as jetstack-<name>-edge and sets it in each .env, including the edge's. Default: none (an environment on its own).

JETSTACK_EDGE_ALIAS

The name under which the application is reached on the pair's network: the edge Caddy proxies each domain to it, and development reaches production by it. The installer sets <name>-prod-app and <name>-dev-app. Required when JETSTACK_EDGE_NETWORK is set.

APP_MEM_LIMIT

The application container's memory limit. Default 1536m.

DB_MEM_LIMIT

The database container's memory limit. Default 768m.

DB_BUFFER_POOL

The database's buffer pool. Default 256M; about half of DB_MEM_LIMIT is a good value.

REDIS_MAXMEMORY

Redis's memory limit. Default 192mb.