Required
| Variable | Description |
|---|---|
DATABASE_URL | PostgreSQL connection string |
BETTER_AUTH_SECRET | Auth secret (32 hex chars): openssl rand -hex 32 |
BETTER_AUTH_URL | Your app URL |
ENCRYPTION_KEY | Encryption key (32 hex chars): openssl rand -hex 32 |
INTERNAL_API_SECRET | Internal API secret (32 hex chars): openssl rand -hex 32 |
TEMPORAL_WORKER_BROKER_SECRET | Separate 32+ byte secret used only between web and the Temporal Worker credential broker |
NEXT_PUBLIC_APP_URL | Public app URL |
NEXT_PUBLIC_SOCKET_URL | WebSocket URL (default: http://localhost:3002) |
AI Providers
| Variable | Provider |
|---|---|
OPENAI_API_KEY | OpenAI |
ANTHROPIC_API_KEY_1 | Anthropic Claude |
GEMINI_API_KEY_1 | Google Gemini |
MISTRAL_API_KEY | Mistral |
OLLAMA_URL | Ollama (default: http://localhost:11434) |
For load balancing, add multiple keys with _1, _2, _3 suffixes (e.g., OPENAI_API_KEY_1, OPENAI_API_KEY_2). Works with OpenAI, Anthropic, and Gemini.
In Docker, use OLLAMA_URL=http://host.docker.internal:11434 for host-machine Ollama.
Azure OpenAI
| Variable | Description |
|---|---|
AZURE_OPENAI_API_KEY | Azure OpenAI API key |
AZURE_OPENAI_ENDPOINT | Azure OpenAI endpoint URL |
AZURE_OPENAI_API_VERSION | API version (e.g., 2024-02-15-preview) |
vLLM (Self-Hosted)
| Variable | Description |
|---|---|
VLLM_BASE_URL | vLLM server URL (e.g., http://localhost:8000/v1) |
VLLM_API_KEY | Optional bearer token for vLLM |
OAuth Providers
| Variable | Description |
|---|---|
GOOGLE_CLIENT_ID | Google OAuth client ID |
GOOGLE_CLIENT_SECRET | Google OAuth client secret |
GITHUB_CLIENT_ID | GitHub OAuth client ID |
GITHUB_CLIENT_SECRET | GitHub OAuth client secret |
Workflow Source Control
These server-side variables configure the deployment-wide GitHub App used by Workflow Source Control. They are separate from the personal GitHub OAuth variables above.
| Variable | Description |
|---|---|
GITHUB_APP_ID | Source Control GitHub App identifier |
GITHUB_APP_PRIVATE_KEY | GitHub App PEM private key; escaped \n newlines are supported |
GITHUB_APP_WEBHOOK_SECRET | GitHub webhook signing secret (minimum 16 characters) |
Hosted customers do not set these variables. SteelEngine manages the platform GitHub App; organization admins only install it and choose repository access.
Workflow Egress Allowlist
By default, workflow HTTP calls (the API block and fetch inside function blocks) cannot reach private or reserved addresses, and hostnames that resolve to them are rejected the same way. On a self-hosted deployment this means workflows cannot call systems on your own network. EGRESS_ALLOWLIST opens specific destinations without changing the default for anything else.
| Variable | Description |
|---|---|
EGRESS_ALLOWLIST | Comma-separated destinations workflows may reach on private networks. Empty by default. Set it on every service that executes workflows: the app and the Temporal Worker. |
Each entry is scheme://host:port, optionally followed by =CIDR:
EGRESS_ALLOWLIST="https://erp.corp.internal:8443=10.0.42.0/24,http://legacy-tickets.corp:8080"- Exact host. No wildcards and no paths.
erp.corp.internaldoes not coverapi.erp.corp.internal. - Port required. An entry authorises one port. A URL with no port matches on the scheme default (443 or 80).
- Scheme is explicit. An
http://entry allows plaintext to that destination only. Usehttps://wherever the service supports it. - CIDR pin, recommended. When present, the address the host resolves to must fall inside it. This is what stops a DNS change for an allowlisted name from redirecting workflow traffic somewhere else.
An entry can never:
- reach instance metadata (
169.254.0.0/16,fe80::/10,fd00:ec2::254), loopback, unspecified, multicast, or broadcast addresses, even when DNS for the allowlisted name points there - open a blocked port (22, 23, 25, 3306, 5432, 6379, 27017, 9200)
- relax anything for a destination that is not listed
A malformed value stops the app and the Worker at startup with a message naming the bad entry, so a typo cannot widen the list or silently disable it.
Every request an entry permits is logged by the EgressAudit logger with the workflow id, workspace id, host, port, resolved IP, and the matching entry. Watch that log after enabling an entry. A destination you did not expect is the signal that something is wrong.
Workflow code is written by workspace users. Every destination in this list is reachable from every workflow on the deployment, including function blocks run from the editor. On a multi-tenant deployment, leave it empty unless a destination is meant to be shared with all tenants.
Database, SFTP, SSH, and email blocks validate their hosts separately and are not covered by this list.
Optional
| Variable | Description |
|---|---|
API_ENCRYPTION_KEY | Encrypts stored API keys (32 hex chars): openssl rand -hex 32 |
COPILOT_API_KEY | API key for the Chat assistant backend (variable keeps its legacy name) |
ADMIN_API_KEY | Admin API key for GitOps operations |
RESEND_API_KEY | Email service for notifications |
ALLOWED_LOGIN_DOMAINS | Restrict signups to domains (comma-separated) |
ALLOWED_LOGIN_EMAILS | Restrict signups to specific emails (comma-separated) |
DISABLE_REGISTRATION | Set to true to disable new user signups |
Example .env
DATABASE_URL=postgresql://postgres:postgres@db:5432/steelengine
BETTER_AUTH_SECRET=<openssl rand -hex 32>
BETTER_AUTH_URL=https://steelengine.yourdomain.com
ENCRYPTION_KEY=<openssl rand -hex 32>
INTERNAL_API_SECRET=<openssl rand -hex 32>
TEMPORAL_WORKER_BROKER_SECRET=<a different openssl rand -hex 32 value>
NEXT_PUBLIC_APP_URL=https://steelengine.yourdomain.com
NEXT_PUBLIC_SOCKET_URL=https://steelengine.yourdomain.com
OPENAI_API_KEY=sk-...See apps/web/.env.example for all options.