> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrqen.cc/llms.txt
> Use this file to discover all available pages before exploring further.
# Environment variables
> Every variable the CLI, the web application, and the worker read, with defaults and what each one changes.
Never commit real values. `.env` is gitignored; `.env.example` is the committed template and
holds only placeholders. Where a value is a secret, this page shows a placeholder such as
`YOUR_ACCESS_KEY`.
## CLI
Read by `myrqen` on your machine.
| Variable | Default | Effect |
| ---------------------------- | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `MYRQEN_API_BASE_URL` | `https://api.myrqen.cc` (**not deployed**) | Overrides the configured API endpoint for a single command. Takes precedence over `config.json` and `myrqen config set-url`. Since the default does not resolve, set this or `myrqen config set-url` to your own deployment. |
| `MYRQEN_CONFIG_DIR` | platform-specific | Overrides the configuration directory. Useful for keeping an experiment away from your real credential. |
| `MYRQEN_DEVICE_TOKEN` | unset | Supplies a device credential directly, bypassing the keystore. Intended for CI and test harnesses. |
| `MYRQEN_CREDENTIAL_BACKEND` | unset | Set to `file` to force the permission-restricted file backend instead of the OS keystore. |
| `MYRQEN_NON_INTERACTIVE` | unset | Set to `1` to force non-interactive mode. Confirmations then default to deny. |
| `MYRQEN_NO_COLOR` | unset | Set to `1` to disable colour. `NO_COLOR` also works. |
| `MYRQEN_TELEMETRY` | unset | Set to `off` to disable CLI telemetry. `config.json`'s `telemetry.enabled: false` does the same. |
| `MYRQEN_AGENT_NAME` | `unknown` | Host agent name recorded on the report, when not passed as a flag. |
| `MYRQEN_AGENT_VERSION` | unset | Host agent version. |
| `MYRQEN_AGENT_MODEL` | unset | Host model identifier. |
| `MYRQEN_SKILL_SOURCE` | bundled | Overrides where the Agent Skill bundle is read from. |
| `MYRQEN_ASSUME_NO_ISOLATION` | unset | Set to `1` to report no isolated runtime, regardless of what is installed. |
| `MYRQEN_UPDATE_PUBLIC_KEYS` | unset | JSON map of pinned release-signing public keys, used by `myrqen update`. |
### Config directory by platform
| Platform | Directory |
| -------- | -------------------------------------------------------- |
| macOS | `~/Library/Application Support/Myrqen/` |
| Linux | `$XDG_CONFIG_HOME/myrqen/` (default `~/.config/myrqen/`) |
| Windows | `%APPDATA%\Myrqen\` |
## Web application and API
Required, and the process fails fast without them:
| Variable | Effect |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `DATABASE_URL` | PostgreSQL connection string. |
| `REPORT_ENCRYPTION_KEY` | 32 bytes, hex or base64. Report bodies are encrypted with it before reaching object storage. |
| `APP_BASE_URL` | The public origin. Required under `NODE_ENV=production`, because share links and session-cookie security are derived from it. Falls back to `http://localhost:3000` outside production. |
### Object storage
| Variable | Default | Effect |
| -------------------------------- | -------------------- | ---------------------------------------------------------------------------------- |
| `OBJECT_STORAGE_DRIVER` | `filesystem` | `filesystem` or `s3`. Refused as `filesystem` under `NODE_ENV=production`. |
| `OBJECT_STORAGE_LOCAL_ROOT` | `.data/object-store` | Where the filesystem driver writes. |
| `OBJECT_STORAGE_ENDPOINT` | — | Required for `s3`. |
| `OBJECT_STORAGE_BUCKET` | — | Required for `s3`. |
| `OBJECT_STORAGE_ACCESS_KEY` | — | Required for `s3`. Use `YOUR_ACCESS_KEY` as a placeholder. |
| `OBJECT_STORAGE_SECRET_KEY` | — | Required for `s3`. Use `YOUR_SECRET_KEY` as a placeholder. |
| `OBJECT_STORAGE_REGION` | `eu-west-1` | S3 region. |
| `OBJECT_STORAGE_PATH_STYLE` | `true` | Path-style addressing. Set `false` for virtual-hosted style. |
| `OBJECT_STORAGE_ALLOW_EPHEMERAL` | unset | Set `true` only for a throwaway production-mode run, such as the end-to-end suite. |
### Encryption key rotation
| Variable | Effect |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `REPORT_ENCRYPTION_KEY_PREVIOUS` | Retired keys, comma separated, accepted for **reads only**. Move the old `REPORT_ENCRYPTION_KEY` here when rotating, or every stored report stops opening. |
### Networking and proxies
| Variable | Default | Effect |
| -------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `PORT` | `3000` | Injected by most platforms. |
| `HOST` | `0.0.0.0` | Bind address for the production server. |
| `TRUSTED_PROXY_HOPS` | unset (`0`) | How many reverse proxies sit in front of the app. Throttles read the client address that many entries in from the right of `X-Forwarded-For`. Railway and most single-proxy platforms need `1`. |
| `TRUSTED_CLIENT_IP_HEADER` | unset | A header a trusted edge sets with the real client address, checked first. |
Leave `TRUSTED_PROXY_HOPS` unset when nothing proxies the app. The leftmost
`X-Forwarded-For` entry is whatever the caller typed, so keying a throttle on it lets a
caller mint a fresh bucket per request — which is the same as having no throttle.
### Event bus and streams
| Variable | Default | Effect |
| ------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `EVENT_BUS_DRIVER` | `postgres` | `postgres` uses `LISTEN`/`NOTIFY` and works across instances; `memory` is single-process. |
| `SSE_MAX_STREAM_MS` | `300000` | How long a live-progress stream may stay open before the browser is asked to reconnect. Bounded so no stream can hold a container through a deploy. |
### Rate limiting
| Variable | Default | Effect |
| ----------- | ------- | -------------------------------------------------------------------------------------------------------------- |
| `REDIS_URL` | unset | Shared rate-limit backend. Empty means process-local counters, which lets N replicas allow N times each limit. |
### Database tuning
| Variable | Default | Effect |
| ------------------------------- | ----------------------------------------- | ----------------------------------------------------------------- |
| `DATABASE_POOL_MAX` | `10` | Maximum pool connections. |
| `DATABASE_STATEMENT_TIMEOUT_MS` | `10000` | Per-statement ceiling. |
| `DATABASE_LOCK_TIMEOUT_MS` | `3000` | Lock-acquisition ceiling, so one lock cannot pin every pool slot. |
| `TEST_DATABASE_URL` | `postgresql://localhost:5432/myrqen_test` | Used by the database integration tests and `pnpm test:e2e`. |
### Limits
| Variable | Default | Effect |
| ------------------ | ------------------- | ---------------------------------------------------- |
| `MAX_REPORT_BYTES` | `12582912` (12 MiB) | Maximum report body accepted by the upload endpoint. |
### Administration
| Variable | Default | Effect |
| ---------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `PLATFORM_ADMIN_EMAIL` | unset | The one address that receives platform administrator rights **at signup**. Nobody is promoted implicitly; unset means the deployment has no administrator. |
### Signed updates
| Variable | Default | Effect |
| ---------------------- | ------------------------------ | -------------------------------------------------------------------------------- |
| `UPDATE_PUBLIC_KEYS` | `{}` | Pinned release-signing public keys as `{"keyId":"-----BEGIN PUBLIC KEY-----…"}`. |
| `UPDATE_MANIFEST_PATH` | `release/manifest.signed.json` | The signed manifest served verbatim by `GET /api/v1/updates/manifest`. |
### Payments (Polar)
All four are required **together** or the application refuses to start.
| Variable | Effect |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `POLAR_ACCESS_TOKEN` | Provider API token. Placeholder: `YOUR_POLAR_TOKEN`. |
| `POLAR_ENVIRONMENT` | `sandbox` until the account is live. A sandbox token cannot charge anyone. |
| `POLAR_WEBHOOK_SECRET` | The `polar_whs_…` value exactly as the dashboard shows it; it is base64-encoded for you before the signature is computed. |
| `POLAR_PRODUCTS` | Plan id to product id, as JSON: `{"pro":"prod_…","team":"prod_…"}`. |
Left unset, the deployment sells nothing — the pricing page still renders and says checkout
is unavailable.
## Worker
| Variable | Default | Effect |
| -------------------- | -------- | --------------------------------------------------------- |
| `WORKER_INTERVAL_MS` | `300000` | How often the worker runs its retention and pruning jobs. |
The worker also reads `DATABASE_URL`, the object-storage variables, and
`REPORT_ENCRYPTION_KEY`, because deleting an expired report means deleting its stored
object too.
## Scripts
| Variable | Used by | Effect |
| --------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `MYRQEN_DEMO_ALLOW_REMOTE` | `pnpm demo:seed` | Set to `1` **on that command line** to allow seeding a non-loopback database. Without it, the seeder refuses and says so. |
| `MYRQEN_RELEASE_PRIVATE_KEY_FILE` | `pnpm release:sign` | Path to the release signing key. |
| `MYRQEN_RELEASE_PRIVATE_KEY` | `pnpm release:sign` | The key inline, as an alternative to the file. |
| `MYRQEN_RELEASE_KEY_ID` | `pnpm release:sign` | Key id recorded in the signed manifest. |
Release private keys are secrets. `*.private.pem` is gitignored. Generate them offline with
`node scripts/generate-release-key.mjs ` and never place one in `.env`.
## Mintlify (documentation tooling only)
| Variable | Effect |
| ------------------------ | ------------------------------------------------------------------------------------------- |
| `MINTLIFY_ADMIN_API_KEY` | Mintlify admin API key. A secret. Never needed to create or validate documentation locally. |
| `MINTLIFY_PROJECT_ID` | Mintlify project id, for server-side Mintlify operations. |
Neither is read by Myrqen itself, and neither belongs in `docs.json` or any MDX page.