Skip to main content

Environment variables

Three layers, documented in .env.example: secrets, deploy, product. Compose looks for .env next to the compose file (infra/.env). The Makefile and prod-up.sh pass --env-file .env from the bundle/repo root. Without that, every ${VAR:-default} uses the institution-agnostic default.

Do not dump compose config: it prints secrets. Do not commit .env.

Secrets (the ones you must change)​

The change-me-* values in .env.example. Minimum: pg_PASSWORD, object-store_ROOT_*, LLM Router_MASTER_KEY, runtime del agente_PROFILE_API_KEY, runtime del agente_API_SERVER_KEY, SOCIETY_INTERNAL_TOKEN, SOCIETY_AGENT_DB_PASSWORD, at least one LLM provider key.

install.sh autogenerates secrets and does not clobber an existing .env.

Kill-switches (default off)​

SOCIETY_SPAWN_ENABLED=0
SOCIETY_RAG_WRITE_ENABLED=0
SOCIETY_SKILL_PUBLISH_ENABLED=0
SOCIETY_EVALUATOR_AUTO_APPROVALS_ENABLED=0
SOCIETY_GOVERNANCE_ENFORCE=0

SOCIETY_AUTH_ENABLED: off in Dev, ON on clients.

Instance identity​

SOCIETY_INSTANCE_ID: DEV | client-specific values. Lives in service config, not in host registry tables — the full X-Road identifier cannot be rebuilt from the database alone.

SOCIETY_BIND_IP: Dev usually 127.0.0.1; VPS 0.0.0.0 + firewall.

Ontology​

SOCIETY_ontology-catalog_URL=http://ontology-catalog-explorer:8000
SOCIETY_ontology-catalog_API_KEY=          # from /opt/ontology-catalog/.env
SOCIETY_ontology-catalog_PUBLIC_URL=       # https://onto.<client>.do

They must be in .env and the box compose.

Chat / LLM​

SOCIETY_CHAT_API_KEY, SOCIETY_DEFAULT_LLM_MODEL, SOCIETY_DEFAULT_LLM_BASE_URL, plus provider keys. Local destination: LMSTUDIO_BASE_URL.

Alternate Conversation UI stack (infra/conversation-ui/.env, not the root .env): same SOCIETY_CHAT_API_KEY; plus CREDS_* / JWT_*, search index key, admin session secret, DOMAIN_CLIENT / DOMAIN_SERVER, bind address (default 127.0.0.1). Template: infra/conversation-ui/.env.example.

OIDC auth​

SOCIETY_OIDC_* (identity provider), SOCIETY_ADMIN_EMAILS (superadmin → ["*"]), SOCIETY_ACCEPT_ID_TOKEN (today true: accepts ID token and access token).

Full list: .env.example (commented, ~100 product + secret lines). This page does not duplicate it.