# Trigger.dev self-hosting environment variables

# - These are the default values for the self-hosting stack

# - You should change them to suit your needs, especially the secrets

# - See the docs for more information: https://trigger.dev/docs/self-hosting/overview

# Secrets — REQUIRED, no defaults. The stack will not boot until each is set to a unique value.

# Generate each with: openssl rand -hex 16

SESSION_SECRET=

MAGIC_LINK_SECRET=

ENCRYPTION_KEY=

# These authenticate the internal control-plane connections. Generate each with: openssl rand -hex 16

# COORDINATOR_SECRET must match the coordinator's PLATFORM_SECRET; MANAGED_WORKER_SECRET the supervisor's.

PROVIDER_SECRET=

COORDINATOR_SECRET=

MANAGED_WORKER_SECRET=

# Worker token

# - This is the token for the worker to connect to the webapp

# - When running the combined stack, this is set automatically during bootstrap

# - For the split setup, you will have to set this manually. The token is available in the webapp logs but will only be shown once.

# - See the docs for more information: https://trigger.dev/docs/self-hosting/docker

# TRIGGER_WORKER_TOKEN=

# Worker URLs

# - In split setups, uncomment and set to the public URL of your webapp

# TRIGGER_API_URL=https://trigger.example.com

# OTEL_EXPORTER_OTLP_ENDPOINT=https://trigger.example.com/otel

# Postgres

# - Password is REQUIRED, no default. Run ./generate-secrets.sh to fill it (or openssl rand -hex 16).

# - DATABASE_URL / DIRECT_URL are derived from POSTGRES_PASSWORD automatically - only set them

# below to point at an external Postgres (POSTGRES_PASSWORD is then unused).

# POSTGRES_USER=postgres

POSTGRES_PASSWORD=

# POSTGRES_DB=postgres

# DATABASE_URL=postgresql://user:password@host:5432/main?schema=public&sslmode=disable

# DIRECT_URL=postgresql://user:password@host:5432/main?schema=public&sslmode=disable

# Trigger image tag

# - This is the version of the webapp and worker images to use, they should be locked to a specific version in production

# - For example: TRIGGER_IMAGE_TAG=v4.5.0

TRIGGER_IMAGE_TAG=latest

# Webapp

# - These should generally be set to the same value

# - In production, these should be set to the public URL of your webapp, e.g. https://trigger.example.com

APP_ORIGIN=http://localhost:8030

LOGIN_ORIGIN=http://localhost:8030

API_ORIGIN=http://localhost:8030

DEV_OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:8030/otel

# You may need to set this when testing locally or when using the combined setup

# API_ORIGIN=http://webapp:3000

# Webapp - memory management

# - This sets the maximum memory allocation for Node.js heap in MiB (e.g. "4096" for 4GB)

# - It should be set according to your total webapp machine's memory or any container limits you have set

# - Setting this too high or low WILL cause crashes, inefficient memory utilization and high CPU usage

# - You should allow for some memory overhead, we suggest at least 20%, for example:

# - 2GB machine: NODE_MAX_OLD_SPACE_SIZE=1600

# - 4GB machine: NODE_MAX_OLD_SPACE_SIZE=3200

# - 6GB machine: NODE_MAX_OLD_SPACE_SIZE=4800

# - 8GB machine: NODE_MAX_OLD_SPACE_SIZE=6400

# NODE_MAX_OLD_SPACE_SIZE=8192

# ClickHouse

# - Password is REQUIRED, no default. Run ./generate-secrets.sh to fill it.

# - CLICKHOUSE_URL / RUN_REPLICATION_CLICKHOUSE_URL are derived from CLICKHOUSE_PASSWORD

# automatically - only set them below to point at an external ClickHouse.

CLICKHOUSE_USER=default

CLICKHOUSE_PASSWORD=

# CLICKHOUSE_URL=http://user:password@host:8123?secure=false

# RUN_REPLICATION_CLICKHOUSE_URL=http://user:password@host:8123

# Docker Registry

# - Password is REQUIRED, no default. Run ./generate-secrets.sh to fill it - it also writes

# the matching registry/auth.htpasswd (bcrypt) the bundled registry authenticates against.

# - See the docs for more information: https://trigger.dev/docs/self-hosting/docker#registry-setup

DOCKER_REGISTRY_URL=localhost:5000

DOCKER_REGISTRY_USERNAME=registry-user

DOCKER_REGISTRY_PASSWORD=

# When using an external registry you will have to change this

# On Docker Hub it should generally be the same as your username

DOCKER_REGISTRY_NAMESPACE=trigger

# Object store

# - You need to log into the Minio dashboard and create a bucket called "packets"

# - See the docs for more information: https://trigger.dev/docs/self-hosting/docker#object-storage

# Default provider (backward compatible - no protocol prefix)

# - Secret access key is REQUIRED, no default. Run ./generate-secrets.sh to fill it.

# - For the bundled MinIO, these ARE its root credentials (MINIO_ROOT_USER/PASSWORD derive from them).

OBJECT_STORE_ACCESS_KEY_ID=admin

OBJECT_STORE_SECRET_ACCESS_KEY=

# You will have to uncomment and configure this for production

# OBJECT_STORE_BASE_URL=http://localhost:9000

# OBJECT_STORE_REGION=auto

# OBJECT_STORE_SERVICE=s3

# OBJECT_STORE_DEFAULT_PROTOCOL=s3 # Optional: protocol to use for new uploads (e.g., "s3", "r2")

#

# Named providers (protocol-prefixed data) - optional for multi-provider support

# OBJECT_STORE_S3_BASE_URL=https://s3.amazonaws.com

# OBJECT_STORE_S3_ACCESS_KEY_ID=

# OBJECT_STORE_S3_SECRET_ACCESS_KEY=

# OBJECT_STORE_S3_REGION=us-east-1

# OBJECT_STORE_S3_SERVICE=s3

#

# OBJECT_STORE_R2_BASE_URL=https://{bucket}.{accountId}.r2.cloudflarestorage.com

# OBJECT_STORE_R2_ACCESS_KEY_ID=

# OBJECT_STORE_R2_SECRET_ACCESS_KEY=

# OBJECT_STORE_R2_REGION=auto

# OBJECT_STORE_R2_SERVICE=s3

# Minio dashboard at http://localhost:9001

# - The bundled Minio's root credentials default to OBJECT_STORE_ACCESS_KEY_ID / OBJECT_STORE_SECRET_ACCESS_KEY.

# - For production, set a separate root user here and create a non-root user scoped to the "packets" bucket for OBJECT_STORE_*.

# MINIO_ROOT_USER=admin

# MINIO_ROOT_PASSWORD=

# Realtime streams

# - Realtime streams power AI-agent token streaming and run streams

# - They default to v2, backed by the bundled s2-lite service (open-source S2, https://s2.dev)

# - To fall back to the Redis-backed v1 streams, set REALTIME_STREAMS_DEFAULT_VERSION=v1

# REALTIME_STREAMS_DEFAULT_VERSION=v2

# The bundled s2-lite creates whatever basin you set here (min 8 characters)

# REALTIME_STREAMS_S2_BASIN=trigger-realtime

# REALTIME_STREAMS_S2_ENDPOINT=http://s2/v1

# REALTIME_STREAMS_S2_SKIP_ACCESS_TOKENS=true

# To use a hosted S2 (https://s2.dev) instead of the bundled s2-lite:

# - point the endpoint at your basin, disable token-skipping, and set an access token

# REALTIME_STREAMS_S2_SKIP_ACCESS_TOKENS=false

# REALTIME_STREAMS_S2_ACCESS_TOKEN=

# Pin the s2-lite image in production (full image reference, digest recommended)

# S2_IMAGE=ghcr.io/s2-streamstore/s2:latest@sha256:d6ded5ca7dd619fa7c946f06e39a98f9c95c6883c8bb884e5eaa129f232c920c

# Other image tags

# - These are the versions of the other images to use

# - You should lock these to a specific version in production

# POSTGRES_IMAGE_TAG=14

# REDIS_IMAGE_TAG=7

# ELECTRIC_IMAGE_TAG=1.0.13

# CLICKHOUSE_IMAGE_TAG=26.2

# REGISTRY_IMAGE_TAG=2

# MINIO_IMAGE_TAG=latest

# DOCKER_PROXY_IMAGE_TAG=latest

# TRAEFIK_IMAGE_TAG=v3.4

# Publish IPs

# - These are the IPs to publish the services to

# - Setting to 127.0.0.1 makes the service only accessible locally

# - When deploying to production, you will have to change these, depending on your setup

# WEBAPP_PUBLISH_IP=0.0.0.0

# POSTGRES_PUBLISH_IP=127.0.0.1

# REDIS_PUBLISH_IP=127.0.0.1

# ELECTRIC_PUBLISH_IP=127.0.0.1

# CLICKHOUSE_PUBLISH_IP=127.0.0.1

# REGISTRY_PUBLISH_IP=127.0.0.1

# MINIO_PUBLISH_IP=127.0.0.1

# Restart policy

# - Applies to all services, adjust as needed

# RESTART_POLICY=unless-stopped

# Docker logging

# - See the official docs: https://docs.docker.com/engine/logging/configure/

# LOGGING_DRIVER=local

# LOGGING_MAX_SIZE=20m

# LOGGING_MAX_FILES=5

# LOGGING_COMPRESS=true

# Traefik

# - Reverse proxy settings only serve as an example and require further configuration

# - See the partial overrides in docker-compose.traefik.yml for more details

# TRAEFIK_ENTRYPOINT=websecure

# TRAEFIK_HTTP_PUBLISH_IP=0.0.0.0

# TRAEFIK_HTTPS_PUBLISH_IP=0.0.0.0

# TRAEFIK_DASHBOARD_PUBLISH_IP=127.0.0.1