Environment reference

The protected .env is gitignored and mode 0600. This page records variable names and contracts only; it does not reproduce any deployed value.

Protected `.env` names

Variable	Contract
`LOBE_DB_NAME`	PostgreSQL database name consumed by both PostgreSQL and LobeHub
`POSTGRES_PASSWORD`	PostgreSQL superuser password
`RUSTFS_ACCESS_KEY`	RustFS access-key identifier used by LobeHub, RustFS, initialization, backup, and restore
`RUSTFS_SECRET_KEY`	RustFS signing credential
`RUSTFS_LOBE_BUCKET`	S3 bucket name consumed by LobeHub
`S3_ENDPOINT`	Public S3 API origin; it must not contain a path suffix
`KEY_VAULTS_SECRET`	LobeHub key-vault encryption material
`AUTH_SECRET`	Better Auth secret material
`SEARXNG_SECRET`	Runtime override for the tracked SearXNG placeholder `secret_key`
`JWKS_KEY`	Private RSA JWK used for signing
`AUTH_AUTHELIA_SECRET`	Plaintext OIDC client credential paired with Authelia’s stored digest
`OPENAI_API_KEY`	LiteLLM virtual key scoped to alias `lobe` and the three approved models

Do not print assignments, run .env through a renderer, or copy values into this vault.

scratch/gen-env.mjs regenerates the local base environment with fresh values.
KEY_VAULTS_SECRET and AUTH_SECRET are independent random 32-byte values encoded as base64.
PostgreSQL and RustFS password material uses at least 32 random bytes.
SEARXNG_SECRET is 32 fresh random bytes encoded as 64 hexadecimal characters.
JWKS_KEY is an RSA-2048 private JWK with:
- use: sig
- alg: RS256
- a fresh random kid
AUTH_AUTHELIA_SECRET is a fresh 64-character alphanumeric OIDC client secret generated through Authelia tooling.
- plaintext is written only to .env
- the verifier digest is installed at ~/dev/services/authelia/config/secrets/oidc/lobe-client-secret.digest
- the digest file is root-owned and mode 0600
OPENAI_API_KEY is minted as LiteLLM key alias lobe with only fast, oss-120b, and free in its model scope.
.env.example remains tracked and contains placeholders only.

These assignments are declared in docker-compose.yml; secret-bearing values reference protected variable names rather than literals.

Setting	Deployed assignment
application origins	`APP_URL=https://lobe.loca.zone`; `INTERNAL_APP_URL=http://localhost:3210`
database	`DATABASE_URL=postgresql://postgres:${POSTGRES_PASSWORD}@postgresql:5432/${LOBE_DB_NAME}`
S3 endpoint and bucket	`S3_ENDPOINT=${S3_ENDPOINT}`; `S3_BUCKET=${RUSTFS_LOBE_BUCKET}`
S3 addressing	`S3_ENABLE_PATH_STYLE=1`; `S3_SET_ACL=0`
S3 credentials	`S3_ACCESS_KEY=${RUSTFS_ACCESS_KEY}`; `S3_ACCESS_KEY_ID=${RUSTFS_ACCESS_KEY}`; `S3_SECRET_ACCESS_KEY=${RUSTFS_SECRET_KEY}`
image handling	`LLM_VISION_IMAGE_USE_BASE64=1`
search	`SEARXNG_URL=http://searxng:8080`
cache	`REDIS_URL=redis://redis:6379`; `REDIS_PREFIX=lobechat`; `REDIS_TLS=0`
model proxy	`OPENAI_PROXY_URL=http://lllm-proxy:4000/v1`
model display allowlist	`OPENAI_MODEL_LIST=-all,+fast,+oss-120b,+free`
OIDC provider	`AUTH_SSO_PROVIDERS=authelia`; `AUTH_AUTHELIA_ID=lobe`; `AUTH_AUTHELIA_ISSUER=https://auth.loca.zone`
local-password control	`AUTH_DISABLE_EMAIL_PASSWORD=1`

PostgreSQL:
- POSTGRES_DB references LOBE_DB_NAME
- POSTGRES_PASSWORD references the protected name of the same spelling
RustFS:
- RUSTFS_CONSOLE_ENABLE=false
- access and secret names are forwarded from .env
SearXNG:
- SEARXNG_SETTINGS_FILE=/etc/searxng/settings.yml
- SEARXNG_SECRET arrives through .env and overrides the tracked placeholder
all secret-bearing services consume .env through Compose env_file; values do not belong in docker-compose.yml

Do not reintroduce removed or incompatible auth modes:

deployment values: ~/dev/lobe/.env, gitignored, mode 0600
public contract: ~/dev/lobe/.env.example, tracked
generator: ~/dev/lobe/scratch/gen-env.mjs, tracked source
Authelia client digest: ~/dev/services/authelia/config/secrets/oidc/lobe-client-secret.digest, root-owned, mode 0600

The only safe Compose validation command for documentation or transcripts is sudo -n docker compose config --quiet.