Environment variable reference

Use this reference to find which role reads a variable, what happens when you leave it unset and where its behavior is explained. Each service bundle declares its variables in a manifest; only declared variables reach the service.

Availability: This reference describes the reference service bundles from 0.9.18. Your generated deployment can omit optional roles or modules. Check the bundle you deploy before you set a value.

Read this reference

• Role(s) names the service hosts whose manifest declares the variable: Web, API, Voice, Ops, Media, TelPro, Database, SigNoz or Squid. All means every role.
• Range and default is the manifest or image default. A dash means that the deployment must supply the value or that the feature stays off without it.
• secret marks a value that belongs in Secrets Manager or the protected bootstrap file. This page never shows secret values.
• Where explained links to the page that describes the behavior. "This page" means that the row is the full description.

Feature flags accept only the literal lowercase values true and false. For the order in which the bootstrap file, SSM and Secrets Manager override each other, see Place configuration in the correct layer.

To list the variables that a role expects on a provisioned host without printing their values, run:

/opt/services/common/show-env.sh --service api

Replace api with the role you are checking.

Changes in 0.9.19

These variables are new or newly declared from 0.9.19. None of them is a feature flag.

• Web: APP_EDIT_IDLE_TIMEOUT_MS for the shared draft idle release.
• TelPro media address: TELPRO_FLOATING_IP_BIND_ENABLED, TELPRO_MEDIA_INTERFACE and TURN_RELAY_IP. See Bind the floating media address.
• TelPro server groups and two-edge operation: TELPRO_GROUP_NAME, TELPRO_ROUTING_*, TELPRO_DIALOG_IP, TELPRO_RTP_BIND_IP and TELPRO_RTP_ADVERTISE_IP.
• TelPro certificate tracking: EDGE_TLS_FULLCHAIN_SOURCE_VERSION and EDGE_TLS_PRIVKEY_SOURCE_VERSION, set by initialization.

Changed in 0.9.19:

• TURN_LISTEN_IP: the default is now empty instead of 0.0.0.0. See TelPro variables and Bind the floating media address for the effect on TURN replies.
• Media HTTPS: MEDIA_TLS_CERT_FILE and MEDIA_TLS_KEY_FILE are no longer configurable, MEDIA_TLS_SAN_DNS is removed, and Media no longer generates a self-signed certificate. The issued MEDIA_TLS_FULLCHAIN_B64 and MEDIA_TLS_PRIVKEY_B64 pair is now the expected source, and MEDIA_TLS_CERT_HOST_PATH is a legacy fallback. See Media variables and Media HTTPS trust.

For the upgrade sequence, see Upgrade to 0.9.19.

Changes in 0.9.18

These variables are new or newly declared from 0.9.18:

• Bootstrap: FETCH_CONFIG_ATTEMPTS and FETCH_CONFIG_RETRY_DELAY.
• Integration features: FEATURE_BROWSER_SDK and FEATURE_WEBRTC.
• Logging: LOG_INTEGRATION_PAYLOADS.
• Managed system audio: SYSTEM_AUDIO_*, AZURE_TTS_API_KEY, AZURE_REGION and the TTS_MEDIA_CACHE_* consumers.
• Voice: GPT_LIVE_PILOT_ENABLED, AZURE_STT_AUDIO_FLUSH_MS, ARIHTTPSESSIONLIMIT and ARIWEBSOCKETWRITETIMEOUT.

Removed in 0.9.18

Variable	What to do instead
FEATURE_API_ACCESS	Select Browser SDK and browser voice explicitly with FEATURE_BROWSER_SDK and FEATURE_WEBRTC. The old flag has no alias, and its earlier default of true no longer applies.

Save an explicit, valid feature selection for the new release before you generate its configuration. For the upgrade sequence, see Upgrade to 0.9.18.

Variables defined on other pages

These variables have their own owner pages. Follow the link to see defaults and behavior.

Subject	Variables	Owner page
Database connection and credential refresh	DATABASE_URL, DATABASE_SECRET_*, DATABASE_REFRESH_*, DATABASE_POOL_SIZE	Database credentials
Platform, database and Redis TLS	TLS_ENABLED, EDGE_TLS_*, API_TLS_ENABLED, CERTBOT_EMAIL, DATABASE_SSL_MODE, DATABASE_SSL_CA_FILE, REDIS_TLS_ENABLED, REDIS_TLS_PORT, REDIS_TLS_SERVERNAME, REDIS_TLS_REJECT_UNAUTHORIZED, REDIS_FORCE_TLS, POSTGRES_TLS_ENABLED, PGBOUNCER_CLIENT_TLS_SSLMODE, PGBOUNCER_SERVER_TLS_SSLMODE	Verify platform TLS
Component log levels	TELWEB_LOG_LEVEL, TELAPI_LOG_LEVEL, TELSYS_LOG_LEVEL, TELPHI_LOG_LEVEL, AUDIOPROC_LOG_LEVEL, SCALER_LOG_LEVEL, TASKER_LOG_LEVEL, TELPRO_LOG_LEVEL, RTPENGINE_LOG_LEVEL, WEBRTC_LOG_LEVEL	Set the level for each component
API credential retry limits	API_CREDENTIAL_*	API key access
Email delivery and worker cloud access	EMAIL_TRANSPORT, EMAIL_SENDER_ADDRESS, EMAIL_SENDER_NAME, SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, AWS_REGION, AWS_USE_INSTANCE_PROFILE	Configure and verify email delivery
Database backups	S3_BUCKET, S3_PREFIX	Database backup and restore
Audit retention and security export	AUDIT_LOG_RETENTION_DAYS, OTEL_EXPORT_BACKEND_HOST, OTEL_EXPORT_BACKEND_PORT, DYNATRACE_*, SIEM_HEC_*	Security event export
SigNoz API credential	SIGNOZ_API_KEY	Register a platform secret
Call duration cap	MAX_CALL_DURATION_SECONDS, MAX_CALL_DURATION_WARNING_MESSAGE	Build a flow

SigNoz also reads the SMTP_* variables to send alert email. They have the same meaning as on the Ops host.

Bootstrap variables

Provisioning writes these values to /opt/deployment/.env on every host. Manifests mark them as local, so SSM and Secrets Manager do not supply them. See Provision instances and bootstrap a role for how the file is created.

Variable	Role(s)	Range and default	Effect	Where explained
ENVIRONMENT	All	—	Environment label for the deployment.	This page
HOSTNAME	All	—	Name of this host.	This page
SERVER_ROLE	All	—	Role whose bundle the host fetches and initializes.	Fetch configuration
ECR_REGISTRY	Web, API, Voice, Ops, Media, TelPro	—	Container registry for image pulls.	Prerequisites
ECR_TAG	Web, API, Voice, Ops, Media, TelPro	latest	Image tag that Compose pulls.	Release compatibility
AWS_ACCESS_KEY_ID	All	— (secret)	Cloud access key for the registry, bundle, SSM and Secrets Manager.	Prerequisites
AWS_SECRET_ACCESS_KEY	All	— (secret)	Secret part of that access key.	Prerequisites
AWS_SESSION_TOKEN	Ops, Media	— (secret)	Optional token for temporary cloud credentials.	This page
AWS_DEFAULT_REGION	Voice	—	Region fallback for cloud SDK clients on the Voice host.	Database credentials
NAMESPACE	All	—	Prefix for this deployment's SSM parameters and secrets.	Place configuration in the correct layer
CONFIG_BUCKET	All	—	Bucket that holds the configuration bundles.	Fetch configuration
CONFIG_REF	All	— (Ops scaler: main)	Bundle reference to fetch, such as a release tag.	Fetch configuration
CONFIG_BASE_PATH	All	configs	Path prefix of the bundles inside the bucket.	Fetch configuration
FETCH_CONFIG_ATTEMPTS	All	5	Full download attempts before configuration fetch fails. New in 0.9.18.	Fetch configuration
FETCH_CONFIG_RETRY_DELAY	All	5	Base wait in seconds between attempts; the wait grows with each attempt. New in 0.9.18.	Fetch configuration
PUBLIC_IP	Hosts with a public address	—	Public address of the host.	NAT and media addresses
FLOATING_IP	Hosts with a reserved address	—	Reserved public address assigned to the host.	Operate the telephony edge
PRIVATE_IP	API, Voice, Media, TelPro	—	Private network address of the host; initialization detects it when unset.	NAT and media addresses
HTTP_PROXY, HTTPS_PROXY	Private hosts	—	Outbound proxy for hosts without a public address.	Prerequisites
NO_PROXY	Private hosts	Local and private addresses	Destinations that bypass the proxy.	Prerequisites
http_proxy, https_proxy, no_proxy	Voice	—	Lowercase proxy settings passed to TelPhi for clients that read them.	This page

Shared runtime variables

These variables appear in more than one role. Set the same value on every role that declares them unless the row says otherwise.

Variable	Role(s)	Range and default	Effect	Where explained
REDIS_HOST	Web, API, Voice, Ops, TelPro, Database	127.0.0.1 on Database; none on other roles	Redis host. Required on every role; set it to the Database host or your Redis endpoint.	This page
REDIS_PORT	Web, API, Voice, Ops, TelPro, Database	6379	Plain Redis port.	This page
REDIS_USERNAME	Web, API, Voice, Ops	— (secret)	Redis ACL user name. Leave it unset for password-only authentication.	This page
REDIS_PASSWORD	Web, API, Voice, Ops, TelPro, Database	— (secret)	Redis password.	This page
REDIS_DATABASE	Web, API, Voice, Ops, TelPro	0	Redis logical database number.	This page
REDIS_TLS_CA_FILE	Web, API, Voice, Ops, TelPro	/etc/ssl/redis/ca.crt	Container path of the Redis CA bundle; an empty file falls back to the system CAs.	Verify platform TLS
REDIS_TLS_CA_BUNDLE_B64	Web, API, Voice, Ops, TelPro	— (secret)	Base64 PEM CA bundle that initialization writes to that file.	Verify platform TLS
DATABASE_SSL_CA_BUNDLE_B64	Web, API, Voice, Ops	— (secret)	Base64 PEM CA bundle for database TLS. Required for verify-ca and verify-full.	Verify platform TLS
INTERNAL_CA_CRT_B64	Web, API, Voice, Ops, TelPro, Database	— (secret)	Deprecated CA fallback, used only when the specific database or Redis bundle is unset.	Verify platform TLS
NEXTAUTH_URL	Web, API, Voice, Ops	—	Public TelWeb URL, used for sign-in and for links in emails.	Access and teams
DOMAIN_TELWEB	Web, Voice	—	Public TelWeb name that Web Caddy serves.	Prerequisites
DOMAIN_API	Web, API, Voice, Ops	—	Public API name; Ops also renews its edge certificate.	Prerequisites
DOMAIN_TELPRO	API, Voice, Ops, TelPro	—	Public SIP and browser-voice edge name; TelPhi builds REFER targets from it.	Prerequisites
REFER_TARGET_HOST	Voice, TelPro	Value of DOMAIN_TELPRO	Host used for REFER number targets and for loopback Refer-To detection.	Call transfer methods
SIP_PORT_INTERNAL	Voice, TelPro	5061 on TelPro	Private Kamailio port for traffic between TelPro and TelSys.	Operate the telephony edge
TURN_USER	Web, TelPro	telpro	TURN user name for browser media relay.	Operate the telephony edge
TURN_PASSWORD	Web, TelPro	— (secret)	TURN password for browser media relay.	Operate the telephony edge
FEATURE_BROWSER_SDK	Web, API, Ops	false	Enables Browser SDK keys, sessions and routes; the Ops migration uses it to move legacy keys. New in 0.9.18.	Feature availability
FEATURE_WEBRTC	Web, API	false	Enables browser voice. Requires FEATURE_BROWSER_SDK=true. New in 0.9.18.	Browser journey
FEATURE_SUBSCRIPTION_MANAGEMENT, FEATURE_SMS	Ops	true	Worker and migration side of subscription management and SMS.	Feature availability
FEATURE_REGISTRATION, FEATURE_AI_FLOW_BUILDER	Ops	true	Migration side of self-registration and the AI Flow Builder.	Feature availability
LOG_INTEGRATION_PAYLOADS	API, Voice, Ops	false	Adds integration payloads and headers to transaction log records; redaction still applies. New in 0.9.18.	Protect diagnostic logs
ENABLE_PII_LOGGING	All	false	Turns off personal-data masking in logs when set to exactly true.	Protect diagnostic logs
MSISDN_UNMASKED_DIGITS	All	4	Number of trailing phone-number digits left visible in masked logs.	Protect diagnostic logs
OTEL_ENABLED	Web, API, Voice, Ops	true; Ops false	Turns application telemetry export on or off.	Logs
OTEL_BACKEND_HOST	Web, API, Voice, Ops, TelPro, Database, Squid	Reference SigNoz address	SigNoz host that the local collector exports to. Set it to your SigNoz host.	Telemetry and monitoring
TTS_MEDIA_CACHE_BASE_URL	Web, API, Voice, Ops	—	HTTPS base URL of the media cache on the Media host.	Managed system audio
TTS_MEDIA_CACHE_UPLOAD_TOKEN	Web, API, Voice, Ops	— (secret)	Token for writing to the media cache.	Managed system audio
TTS_MEDIA_CACHE_CA_BUNDLE	Web, API, Voice, Ops	—	CA bundle used to trust the Media host certificate.	Managed system audio
SYSTEM_AUDIO_STORAGE_BASE_URL	Web, API, Ops	—	Base URL of managed system-audio storage; falls back to the media cache URL.	Managed system audio
AZURE_TTS_API_KEY	Web, API, Ops	— (secret)	Azure Speech key for generating system audio from text. Without it, generation is unavailable. New in 0.9.18.	Managed system audio
AZURE_REGION	Web, API, Ops	—	Azure Speech region for that generation. New in 0.9.18.	Managed system audio
SYSTEM_AUDIO_CLEANUP_TOKEN	Ops, Media	— (secret)	Token that Tasker uses for system-audio cleanup requests to the Media host.	Managed system audio
PLATFORM_ROLE_EMAIL_CODE_SECRET	Web, Ops	— (secret)	Key shared only by TelWeb and Tasker for platform-role change codes. Do not reuse the session secret.	Provision users and memberships
PASSWORD_MAX_AGE_DAYS	Web, Ops	90	Days until a password expires. Keep Web and Ops equal.	Change an expiring password
PASSWORD_WARNING_DAYS	Web, Ops	10	Days before expiry when the warning and reminder start. Keep Web and Ops equal.	Change an expiring password
STRIPE_SECRET_KEY	Web, Ops	— (secret)	Billing provider key, used when subscription billing is enabled.	Subscription and usage
GRACE_PERIOD_DAYS	Web, Ops	30	Grace period that the subscription grace-expiry job applies.	Subscription and usage
PLATFORM_SECRETS_NAMESPACE	Web, API	—	Overrides NAMESPACE for platform and team secret paths.	Establish platform secret storage
NODE_ENV	API, Ops	production	Node.js runtime mode.	This page

Web variables

Variable	Role(s)	Range and default	Effect	Where explained
NEXTAUTH_SECRET	Web	— (secret)	Secret that signs TelWeb sessions.	This page
PLATFORM_ROLE_EMAIL_TASKER_READY	Web	false	Set to true only after every Tasker replica can send platform-role change codes.	Provision users and memberships
NEXT_TELEMETRY_DISABLED	Web	1	Turns off web framework usage telemetry.	This page
MUI_X_TELEMETRY_DISABLED, NEXT_PUBLIC_MUI_X_TELEMETRY_DISABLED	Web	true	Turns off UI component library telemetry.	This page
DOMAIN_SIGNOZ	Web	—	Optional name under which Web Caddy publishes the SigNoz UI.	Prerequisites
SIGNOZ_PORT	Web	8080	SigNoz UI port that Web Caddy forwards to.	This page
TELAPI_KEY	Web	— (secret)	Development-only fallback key for the browser session proxy; not production integration configuration.	This page
ICE_SERVERS	Web	—	ICE server list that the browser uses for voice calls.	Browser journey
SESSION_TIMEOUT	Web	300000	Idle session time in milliseconds. Deployment template: five minutes; code fallback: thirty minutes.	Understand an ended or refused session
APP_EDIT_IDLE_TIMEOUT_MS	Web	900000	Time in milliseconds without input before Flow Designer releases the shared draft. Minimum 60000. New in 0.9.19.	Shared draft editing
WARNING_TIMEOUT	Web	60000	Time in milliseconds for the warning before an idle session ends.	Understand an ended or refused session
AUTH_WITH_CREDENTIALS	Web	true	Enables email and password sign-in.	Access and teams
AUTH_WITH_MICROSOFT	Web	false	Enables Microsoft Entra sign-in.	Check Microsoft Entra prerequisites
AUTH_MICROSOFT_ENTRA_ID_ID	Web	—	Entra application ID. Required when Microsoft sign-in is on.	Check Microsoft Entra prerequisites
AUTH_MICROSOFT_ENTRA_ID_SECRET	Web	— (secret)	Entra client secret. Required when Microsoft sign-in is on.	Check Microsoft Entra prerequisites
AUTH_MICROSOFT_ENTRA_ID_ISSUER	Web	—	Tenant-specific Entra issuer. Required when Microsoft sign-in is on.	Check Microsoft Entra prerequisites
AUDIT_TRUSTED_PROXY_HOPS	Web	0	Trusted proxy hops for audit client addresses. Keep 0 unless your ingress overwrites forwarded headers.	This page
LEGAL_BANNER_HTML	Web	—	Trusted HTML notice on public TelWeb pages; it wins over the text notice.	This page
LEGAL_BANNER_TEXT	Web	—	Plain-text notice on public TelWeb pages.	This page
STRIPE_WEBHOOK_SECRET	Web	— (secret)	Verifies webhooks from the billing provider.	Subscription and usage
SYSTEM_AUDIO_UPLOAD_MAX_MIB	Web	100	Largest system-audio upload in MiB.	Managed system audio

API variables

Variable	Role(s)	Range and default	Effect	Where explained
TELAPI_PORT	API	3001	TelAPI listener. The load balancer health check uses the same port.	Prerequisites
TELAPI_HOST	API	0.0.0.0	TelAPI bind address.	This page
TELAPI_SWAGGER_UI_ENABLED	API	false	Serves /documentation. Defaults off in production and on otherwise unless explicitly configured.	This page
JWT_SECRET	API	— (secret)	Secret that signs TelAPI tokens.	This page
CORS_ORIGINS	API	—	Legacy declaration with no runtime reader. It does not restrict HTTP CORS; TelAPI reflects origins. Browser endpoint allowedOrigins is a separate session restriction.	This page

API tokens and listener TLS

JWT_SECRET supplies the signing key (at least 32 characters when set); JWT_ISSUER and JWT_AUDIENCE default to telapi and delphi. JWT verification checks those identities. JWT_EXPIRES_IN defaults to 1h for the general JWT generator; session-specific tokens can have their own lifetime. Keep signing material in the deployment's secret mechanism and coordinate issuer/audience changes with the callers that use those tokens.

Authentication strategies are selected by each route. Configuring a signing key or client certificate does not make every operation accept it. The access-token strategy can verify a JWT or look up an opaque token already stored by an external integration. The parsed OAUTH2_CLIENT_ID, OAUTH2_CLIENT_SECRET, OAUTH2_TOKEN_URL and OAUTH2_AUTHORIZE_URL settings do not provision an OAuth2 login or token exchange in TelAPI.

TLS_ENABLED requests HTTPS on the API listener. TLS_CERT_PATH and TLS_KEY_PATH must refer to readable container-local certificate material. If they are missing or unreadable, the service can start HTTP while waiting for provisioning; check the effective listener before sending credentials. TLS_CA_PATH supplies a client CA bundle, TLS_REQUEST_CERT defaults to false, and TLS_REJECT_UNAUTHORIZED defaults to true. Certificate authentication also depends on the route and certificate mapping. Follow platform TLS verification for deployment and recovery checks; a requested TLS flag alone is not proof of an encrypted listener.

Voice variables

Variable	Role(s)	Range and default	Effect	Where explained
VAIPROXIESPIPED	Voice	—	Pipe-separated TelPro addresses that TelSys accepts calls from. Required.	Operate the voice services
SIPPORTTELPRO	Voice	5060 in the image	TelPro SIP port used with those addresses.	Operate the voice services
SIP_100REL_MODE	Voice	off	Reliable provisional responses: off, peer_supported, yes or required.	Investigate a 100rel mismatch
SIP_CAPTURE_ENABLE_PJSIP_LOGGER	Voice	1	Asterisk SIP packet logging for SIP capture.	Logs
SIP_CAPTURE_TELSYS_LOG_MAX_SIZE	Voice	100m	Docker log file size for TelSys.	Operate the voice services
SIP_CAPTURE_TELSYS_LOG_MAX_FILES	Voice	5	Number of rotated TelSys log files.	Operate the voice services
AMI_PORT	Voice	8038	Asterisk Manager Interface port.	Operate the voice services
SIP_TRUNK_HEALTH_INTERVAL_MS	Voice	30000	Interval between evaluations of edge probe results, in milliseconds.	Diagnose trunk health
SIP_TRUNK_HEALTH_FAILURE_THRESHOLD	Voice	2	Consecutive failed or successful evaluations needed to mark a trunk unavailable or recovered.	Diagnose trunk health
SIP_TRUNK_HEALTH_DEGRADED_RTT_MS	Voice	500	Round-trip time above which a reachable trunk becomes degraded, in milliseconds.	Diagnose trunk health
SIP_TRUNK_HEALTH_REDIS_TTL_MS	Voice	60000	Lifetime of the monitor heartbeat in Redis, in milliseconds.	Diagnose trunk health
AMI_USER	Voice	asterisk	Asterisk Manager Interface user.	Operate the voice services
AMI_SECRET	Voice	Image default (secret)	Asterisk Manager Interface password. Override it in every deployment.	Operate the voice services
RTPSTART, RTPEND	Voice	10000, 11999	TelSys RTP port range.	Prerequisites
TELPHI_MEDIA_HOST, TELPHI_MEDIA_PORT, TELPHI_MEDIA_PATH, TELPHI_MEDIA_SCHEME	Voice	0.0.0.0, 12001, /media, ws	TelPhi media WebSocket that TelSys connects to for each call leg.	Operate the voice services
TELPHI_ENABLE_MEDIA_LOGGING	Voice	false	Adds media transport logging in TelPhi.	This page
ARIHTTPSESSIONLIMIT	Voice (TelSys image)	1000	Concurrent Asterisk HTTP sessions for ARI. New in 0.9.18.	ARI session limits
ARIWEBSOCKETWRITETIMEOUT	Voice (TelSys image)	1000	Milliseconds Asterisk waits for a slow ARI WebSocket reader. New in 0.9.18.	ARI session limits
EGRESS_TLS_REJECT_UNAUTHORIZED	Voice	true	Set to false only for test endpoints with private certificates.	This page
GPT_LIVE_PILOT_ENABLED	Voice	false	Allows the GPT-Live pilot runtime on this host; otherwise TelPhi rejects it. New in 0.9.18.	Provider and channel
AZURE_STT_AUDIO_FLUSH_MS	Voice	— (50 ms batches)	Audio per Azure speech-to-text push, 20–200 ms. Larger values save CPU and add latency. New in 0.9.18.	This page
RECORDING_ENABLED	Voice	false	Legacy forwarded value with no application reader; does not enable recording. Use app recording selection.	Recording output
RECORDING_BUCKET	Voice	recordings	Legacy forwarded value with no application reader; use team recording storage configuration.	Recording output
AUDIOPROC_ENABLED	Voice	false	Sends caller audio through AudioProc.	Operate the voice services
AUDIOPROC_URL	Voice	ws://127.0.0.1:8790	AudioProc address that TelPhi uses.	Operate the voice services
AUDIOPROC_PORT	Voice	8790	AudioProc listener port.	Operate the voice services
AUDIOPROC_DEVICE	Voice	cpu	Processing device for AudioProc.	Operate the voice services

The standard Voice Compose file does not pass ARIHTTPSESSIONLIMIT or ARIWEBSOCKETWRITETIMEOUT, so the TelSys image defaults apply. See ARI session limits before you change them.

Ops variables

Variable	Role(s)	Range and default	Effect	Where explained
MIGRATION_DATABASE_URL	Ops	— (secret)	Privileged database URL for the one-shot migration and setup container only.	Bootstrap and migration
RUN_BASELINE_SEED	Ops	true	Runs the baseline seed after migrations.	Bootstrap and migration
RUN_ACTIVE_FLOW_REDIS_SYNC	Ops	true	Backfills active flows into Redis after migrations.	Bootstrap and migration
REDIS_SYNC_TIMEOUT_SECONDS	Ops	0	Overall deadline for that backfill; 0 means no deadline.	Bootstrap and migration
LEADER_ELECTION_KEY	Ops	voiceai:scaler:leader	Redis key for Scaler leader election.	Background jobs
TASKER_LEADER_ELECTION_KEY	Ops	voiceai:tasker:leader	Redis key for Tasker leader election.	Background jobs
LEADER_HEARTBEAT_INTERVAL_MS	Ops	5000	Leader heartbeat interval for Scaler and Tasker.	Background jobs
LEADER_LOCK_TTL_MS	Ops	10000	Leader lock lifetime for Scaler and Tasker.	Background jobs
SCALING_EVALUATION_INTERVAL_MS	Ops	30000	Interval between Scaler evaluations.	Interpret scaling and health
SCALING_SCRIPTS_PATH	Ops	/opt/services/ops/scaling	Location of the scaling scripts inside the Scaler.	This page
INFRASTRUCTURE_REPO_PATH	Ops	/opt/services/ops	Location of the Ops bundle inside the Scaler.	This page
WORKER_POLL_INTERVAL_MS	Ops	5000	Tasker worker polling interval.	Background jobs
WORKER_CONCURRENCY	Ops	5	Jobs that one Tasker worker runs in parallel.	Background jobs
SCHEDULER_POLL_INTERVAL_MS	Ops	10000	Tasker scheduler polling interval.	Background jobs
SMS_API_KEY	Ops	— (secret)	SMS provider credential. Tasker checks it before sending.	Configure and diagnose SMS delivery
BASTION_PUBLIC_KEY	Ops	—	SSH public key that the Scaler adds to new servers. Required.	Provision instances and bootstrap a role
BASTION_HOST	Ops	—	Bastion address that the edge TLS refresh job connects through.	Verify platform TLS
BASTION_SSH_KEY_B64	Ops	— (secret)	Preferred SSH key for that job, written to a temporary protected file.	Verify platform TLS
BASTION_SSH_KEY_PATH	Ops	/root/.ssh/bastion_key	Fallback key path inside Tasker when the encoded key is unset.	Verify platform TLS
HETZNER_API_TOKEN	Ops	— (secret)	Cloud provider token for scaling and for DNS-based certificate renewal.	Prerequisites
EDGE_TLS_RENEWAL_THRESHOLD_DAYS, EDGE_TLS_CERTBOT_STAGING	Ops	See owner page	Edge certificate renewal settings.	Verify platform TLS

Media variables

Variable	Role(s)	Range and default	Effect	Where explained
MEDIA_DATA_DIR	Media	/mnt/media-data	Host directory for stored media.	Managed system audio
MEDIA_HTTPS_PORT	Media	443	HTTPS port of the media server.	Prerequisites
MEDIA_TLS_CERT_HOST_PATH	Media	—	Legacy host directory with fullchain.pem and privkey.pem, used with a warning when the issued pair is missing or invalid.	Media HTTPS trust
MEDIA_TLS_FULLCHAIN_B64	Media	—	Base64 of the Media server certificate followed by the media CA.	Media HTTPS trust
MEDIA_TLS_PRIVKEY_B64	Media	— (secret)	Base64 private key of that certificate.	Media HTTPS trust
MEDIA_UPLOAD_TOKEN	Media	— (secret)	Token that authorizes uploads to the media server.	Managed system audio
SYSTEM_AUDIO_STORAGE_BACKEND	Media	filesystem	Storage backend for managed system audio: filesystem or s3.	Managed system audio
SYSTEM_AUDIO_S3_BUCKET_PREFIX, SYSTEM_AUDIO_S3_ACCOUNT_ID, SYSTEM_AUDIO_S3_REGION, SYSTEM_AUDIO_S3_PREFIX, SYSTEM_AUDIO_S3_ENDPOINT	Media	—	Settings for automatic S3 bucket provisioning. New in 0.9.18.	Managed system audio
SYSTEM_AUDIO_S3_BUCKETS	Media	—	Alternative map of existing bucket names per owner. New in 0.9.18.	Managed system audio
SYSTEM_AUDIO_MIGRATION_OWNERS	Media	—	Path to the owner manifest for the one-time system-audio storage migration command.	Managed system audio
SYSTEM_AUDIO_CACHE_DIR	Media	/data/system-audio-cache	Disposable playback cache directory. New in 0.9.18.	Managed system audio
SYSTEM_AUDIO_CACHE_MAX_BYTES	Media	0	Playback cache limit; 0 reads directly from verified storage. New in 0.9.18.	Managed system audio

TelPro variables

Variable	Role(s)	Range and default	Effect	Where explained
SIP_PORT	TelPro	5060	Public SIP port for UDP and TCP.	Prerequisites
SIPS_PORT	TelPro	5061	Public SIP-over-TLS port.	Prerequisites
EXTERNAL_IP	TelPro	—	Address to advertise when the edge sits behind a load balancer or NAT.	NAT and media addresses
KAMAILIO_INSTANCE_ID, TELPRO_INSTANCE_ID	TelPro	Host name	Identity of this edge in Redis drain, heartbeat and refresh keys.	Drain an edge instance
TELPRO_HA_ENABLED	TelPro	false	Turns on two-edge operation with floating addresses.	Two-edge operation
TELPRO_INITIAL_ACTIVE_INSTANCE_ID, TELPRO_PROVIDER_SERVER_ID, TELPRO_PEER_INSTANCE_ID, TELPRO_PEER_PROVIDER_SERVER_ID, TELPRO_SIP_FLOATING_IP_ID, TELPRO_MEDIA_FLOATING_IP_ID	TelPro	—	Host-local identities for the two-edge pair.	Two-edge operation
TELPRO_SIP_IP, TELPRO_MEDIA_IP	TelPro	—	Signaling and media addresses that the edge advertises.	NAT and media addresses
TELPRO_FLOATING_IP_BIND_ENABLED	TelPro	false	Binds the configured floating addresses while two-edge operation stays off. New in 0.9.19.	Bind the floating media address
TELPRO_MEDIA_INTERFACE	TelPro	Default-route interface	Interface that receives TELPRO_MEDIA_IP; must be visible to Janus. New in 0.9.19.	Bind the floating media address
TURN_RELAY_IP	TelPro	Empty	Address that TURN binds its relay sockets to. TELPRO_MEDIA_IP, when set, takes precedence. New in 0.9.19.	Bind the floating media address
TELPRO_DIALOG_IP, TELPRO_RTP_BIND_IP, TELPRO_RTP_ADVERTISE_IP	TelPro	—	Stable per-edge dialog and media addresses for answered calls. The RTP advertise address wins for the advertised media address. New in 0.9.19.	Two-edge operation
TELPRO_GROUP_NAME	TelPro	—	Server group that this edge reports to. Optional while exactly one TelPro group exists. New in 0.9.19.	Server Groups maintenance
TELPRO_ROUTING_PROVIDER, TELPRO_ROUTING_TARGET_IDS, TELPRO_ROUTING_ENDPOINT, TELPRO_ROUTING_TOKEN	TelPro	hetzner, —, —, — (secret)	Routing integration that moves the admission address. The token stays on the host and is never passed to containers; initialization and the host reconciler read it. New in 0.9.19.	Two-edge operation
EDGE_TLS_FULLCHAIN_SOURCE_VERSION, EDGE_TLS_PRIVKEY_SOURCE_VERSION	TelPro	unknown	Version of the secret that supplied the certificate and key, set by initialization. New in 0.9.19.	Two-edge operation
HCLOUD_TOKEN	TelPro	— (secret)	Cloud provider token that moves floating addresses. Read by initialization and the host reconciler.	Two-edge operation
TELPRO_TLS_VERIFY_ENDPOINT	TelPro	Edge name and SIPS_PORT	Address where a TLS reload checks the served certificate.	Verify platform TLS
RTPENGINE_INTERFACES	TelPro	—	Network interfaces that RTPEngine uses.	Operate the telephony edge
RTP_PORT_MIN, RTP_PORT_MAX	TelPro	20000, 40000	RTPEngine media port range.	Prerequisites
RTPENGINE_SOCKET, RTPENGINE_SOCKET_1, RTPENGINE_SOCKET_2, RTPENGINE_SET_ID	TelPro	—, —, —, 0	Control sockets and set that Kamailio uses to reach RTPEngine.	Operate the telephony edge
RTPENGINE_LISTEN_NG, RTPENGINE_LISTEN_HTTP, RTPENGINE_LISTEN_CLI, RTPENGINE_LISTEN_PORT	TelPro	RTPENGINE_LISTEN_PORT: 22222	RTPEngine control listeners; the health check uses the listen port.	Operate the telephony edge
STRUCTURED_LOGGING_ENABLED	TelPro	true at initialization	Emits structured Kamailio events such as trunk identification failures.	Operate the telephony edge
SIP_CAPTURE_TELPRO_LOG_MAX_SIZE	TelPro	100m	Docker log file size for Kamailio.	Operate the telephony edge
SIP_CAPTURE_TELPRO_LOG_MAX_FILES	TelPro	5	Number of rotated Kamailio log files.	Operate the telephony edge
JANUS_WS_PORT	TelPro	443	Browser WebSocket port of Janus.	Prerequisites
JANUS_WSS_ENABLED	TelPro	true	Serves the Janus WebSocket over TLS.	Operate the telephony edge
JANUS_ADMIN_PORT	TelPro	7088	Janus admin port.	This page
JANUS_RTP_PORT_MIN, JANUS_RTP_PORT_MAX	TelPro	10000, 12000	Janus media port range.	Prerequisites
KAMAILIO_SIP_HOST	TelPro	Private address of the host	Kamailio address that Janus sends SIP to.	Operate the telephony edge
STUN_SERVER, STUN_PORT	TelPro	A public STUN service, 19302	STUN server that Janus uses for address discovery.	This page
TURN_SERVER, TURN_PUBLIC_IP	TelPro	—	TURN address for Janus and the public address that coturn advertises.	Operate the telephony edge
TURN_PORT, TURN_TLS_PORT	TelPro	3478, 5349	coturn listener ports.	Prerequisites
TURN_MIN_PORT, TURN_MAX_PORT	TelPro	49152, 51152	coturn relay port range.	Prerequisites
TURN_REALM, TURN_LISTEN_IP, TURN_ENABLE_TLS	TelPro	telpro, empty, true	coturn realm, bind addresses and TLS listener switch.	This page
HEALTH_PROBE_ENABLED, HEALTH_PROBE_TARGET_HOST, HEALTH_PROBE_TARGET_PORT, HEALTH_PROBE_TRUNK_IDS, HEALTH_PROBE_INTERVAL, HEALTH_PROBE_TIMEOUT	TelPro	false, —, 5060, —, 60, 3	Optional SIP OPTIONS probes towards a trunk target.	Trunk health controls
LOG_TO_SPAN_OTLP_ENDPOINT	TelPro	localhost:4318	Local collector that the log-to-span sidecar sends traces to.	Telemetry and monitoring
LOG_TO_SPAN_EXPORT_LOGS	TelPro	false	Also exports the converted log records.	Telemetry and monitoring

Database variables

Variable	Role(s)	Range and default	Effect	Where explained
DATA_DIR	Database	/mnt/data	Host directory for PostgreSQL and Redis data.	This page
POSTGRES_USER	Database	voiceai	PostgreSQL application user. Required.	Database credentials
POSTGRES_PASSWORD	Database	— (secret)	Password of that user. Required.	Database credentials
POSTGRES_DB	Database	voiceai	Application database name. Required.	Database credentials
POSTGRES_HOST, POSTGRES_PORT	Database	127.0.0.1, 5432	PostgreSQL address that the local collector monitors.	This page
PGBOUNCER_PORT	Database	6432	PgBouncer listener that application roles connect to.	Prerequisites
POSTGRES_FORCE_SSL	Database	off	Rejects PostgreSQL connections without TLS when on.	Verify platform TLS
INTERNAL_TLS_CERT_B64, INTERNAL_TLS_KEY_B64	Database	— (secret)	Server certificate and key for internal TLS, written to disk by initialization.	Verify platform TLS
POSTGRES_MONITORING_USER	Database	monitoring	PostgreSQL user for the metrics collector.	This page
POSTGRES_MONITORING_PASSWORD	Database	— (secret)	Password of the monitoring user.	This page

SigNoz variables

Variable	Role(s)	Range and default	Effect	Where explained
SIGNOZ_DATA_DIR	SigNoz	/mnt/signoz-data	Host directory for SigNoz data.	Telemetry and monitoring
SIGNOZ_TRANSPARENT_PROXY_PORTS	SigNoz	80,443,25,465,587	Outbound ports that the SigNoz host sends through the proxy.	Prerequisites
SIGNOZ_VERSION, SIGNOZ_OTELCOL_TAG, CLICKHOUSE_IMAGE	SigNoz	See the owner page	Version pins for SigNoz, its ingest collector and ClickHouse.	Declared upstream versions
SIGNOZ_CLICKHOUSE_REPLICA, SIGNOZ_CLICKHOUSE_SHARD	SigNoz	01, 01	ClickHouse replica and shard identifiers.	This page
SMTP_FROM	SigNoz	—	Sender address of SigNoz alert email.	Telemetry and monitoring

Verify the effective values

1. On the host, run show-env.sh --service <role> and confirm that every variable you set appears in the list.
2. Check the running container for the non-secret values you changed, for example with docker inspect.
3. Repeat the functional check from Service health for the changed role.

Related

• Deploy, verify and update Delphi: to activate a changed variable on the right hosts.
• Provision instances and bootstrap a role: to see how the bootstrap file and bundles reach a host.
• Feature availability: to see which interface controls a feature flag changes.
• Release compatibility: to match variables to the release you deploy.