Skip to content

CoreAPI environment variables

Generated inventory — regenerate rather than hand-edit.
Extracted from source 2026-09-09: every os.Getenv / envStr / envOr / envBool / envInt64 call in the CoreAPI module.

81 distinct variables across 30 files.

Grouped by prefix. default is the in-code fallback; (none) means an unset variable yields the empty string, which is rarely what you want.

AUTHAPI

variable default read at
AUTHAPI_BASE_URL http://authapi:3002 pkg/config/config.go:173
AUTHAPI_FRONTEND_URL (none) pkg/config/config.go:180
AUTHAPI_JWKS_URL http://authapi:3002/.well-known/jwks.json pkg/config/config.go:174

CONCIERGE

variable default read at
CONCIERGE_GUEST_JWT_SECRET dev-only-insecure-concierge-guest-secret domain/concierge/config.go:41
pkg/config/config.go:118

COREAPI

variable default read at
COREAPI_AUTHAPI_PSK (none) cmd/migrate-zitadel/main.go:19
pkg/middleware/auth_middleware.go:417
pkg/config/config.go:175
pkg/authapi/client.go:32
COREAPI_CLIENT_ID (none) pkg/config/config.go:161
COREAPI_CLIENT_SECRET (none) pkg/config/config.go:162
COREAPI_EMAIL_FROM (none) pkg/config/config.go:159
COREAPI_EMAIL_HOST (none) pkg/config/config.go:155
COREAPI_EMAIL_PASSWORD (none) pkg/config/config.go:158
COREAPI_EMAIL_USERNAME (none) pkg/config/config.go:157
COREAPI_EMAIL_USE_SSL (none) pkg/config/config.go:160
COREAPI_PLATFORM_EMAIL_ACCOUNT_ID (none) pkg/config/config.go:168
COREAPI_PLATFORM_EMAIL_CLIENT_ID (none) pkg/config/config.go:166
COREAPI_PLATFORM_EMAIL_CLIENT_SECRET (none) pkg/config/config.go:167
COREAPI_PLATFORM_EMAIL_FROMADDRESS (none) pkg/config/config.go:170
COREAPI_PLATFORM_EMAIL_SERVERINFO https://accounts.zoho.com pkg/config/config.go:169
COREAPI_REFRESH_TOKEN (none) pkg/config/config.go:163
COREAPI_SECRETS_ENCRYPTION_KEY (none) pkg/config/config.go:179

DB

variable default read at
DB_HOST (none) pkg/db/db.go:44
pkg/db/db.go:54
DB_NAME (none) pkg/db/db.go:48
DB_PASS (none) pkg/db/db.go:47
pkg/db/db.go:57
DB_PORT (none) pkg/db/db.go:45
pkg/db/db.go:55
DB_USER (none) pkg/db/db.go:46
pkg/db/db.go:56

MEDIA

variable default read at
MEDIA_HARD_RESET (none) infra.go:32
MEDIA_PROXY_BASE_URL (none) domain/provisioning/handler_broadcast.go:191
domain/provisioning/helper.go:125
domain/provisioning/helper.go:133
domain/provisioning/helper.go:141
…+3 more
MEDIA_SERVER_URL (none) domain/provisioning/handler_composite.go:944

MINIO

variable default read at
MINIO_ACCESS_KEY (none) pkg/storage/storage.go:21
MINIO_BUCKET playtelly domain/media/config.go:70
MINIO_ENDPOINT (none) pkg/storage/storage.go:16
MINIO_SECRET_KEY (none) pkg/storage/storage.go:22
MINIO_TEMP_BUCKET (none) pkg/storage/storage.go:49
MINIO_USE_SSL (none) pkg/storage/storage.go:23

NATS

variable default read at
NATS_URL (none) pkg/natsclient/natsclient.go:14

REDIS

variable default read at
REDIS_HOST redis pkg/config/config.go:131
REDIS_PASSWORD (none) pkg/config/config.go:133
REDIS_PORT 6379 pkg/config/config.go:132

SEAWEED

variable default read at
SEAWEEDFS_FILER http://seaweedfs:8888 domain/media/config.go:71

SPATIO

variable default read at
SPATIO_TICKETING_WORKSPACE_ID (none) pkg/config/config.go:177

STG

variable default read at
STG_API_IP (none) domain/provisioning/helper.go:91
domain/catalogue/helper.go:69
pkg/config/config.go:205
STG_MEDIA_IP (none) domain/provisioning/helper.go:100
domain/catalogue/helper.go:78
domain/media/helper.go:225
pkg/config/config.go:213
STG_SEAWEED_IP (none) domain/provisioning/helper.go:117
domain/media/helper.go:233

TICKETING

variable default read at
TICKETING_CLICKHOUSE_BASE_URL https://clickhouse.kcake.tv pkg/config/config.go:137
TICKETING_CLICKHOUSE_PASSWORD (none) pkg/config/config.go:139
TICKETING_CLICKHOUSE_USERNAME analytics pkg/config/config.go:138
TICKETING_DB_NAME (none) pkg/db/db.go:58
TICKETING_JWT_SECRET_KEY insecureTicketingJWTFallback pkg/config/config.go:145
TICKETING_OTEL_COLLECTOR_URL https://collector.johor.gov.my pkg/config/config.go:142

(other)

variable default read at
API_SERVER_URL (none) domain/provisioning/handler_composite.go:459
domain/provisioning/handler_composite.go:746
APP_ENV (none) pkg/logger/logger.go:12
BACKEND_BASE_URL (none) domain/commerce/routes/routes.go:102
domain/commerce/handlers/payment_handler.go:77
BANNER_STORAGE_PATH (none) domain/catalogue/services/banner_service.go:125
domain/catalogue/services/banner_service.go:199
domain/catalogue/services/banner_service.go:235
domain/catalogue/services/banner_service.go:245
…+2 more
COLORBARS_HOST colorbars domain/distribution/config.go:28
CORE_API_PORT 3000 main.go:29
pkg/config/config.go:172
CORS_ORIGIN http://localhost:8001,https://admin.kcake.tv,https://etiket.kcake.tv,http://localhost:8080,http://localhost:5173,https://stag.tellyid.castis.io,http://localhost:13000,http://localhost:13001,http://139.59.253.119:3002,https://etiket.johor.gov.my,http://stagingetiket.johor.gov.my:3002,https://stg-ticketcms.castis.io,http://stagingetiket.johor.gov.my:3001,https://tiketadmin.johor.gov.my/,https://orgconsole.elk-universe.ts.net/,https://tellyid.elk-universe.ts.net/,https://pc.elk-universe.ts.net/,https://stg.guest.castis.io,https://guest.hotel.castis.io,https://stag.playout.castis.io routes.go:61
DISABLED_INITIATE_ORDER_CHECK_SCHEDULER (none) ticketing.go:133
DISABLED_PENDING_ORDER_CHECK_SCHEDULER (none) ticketing.go:136
DISABLE_REPORT_EMAIL_RETRY_SCHEDULER (none) ticketing.go:130
DISABLE_REPORT_SCHEDULER (none) ticketing.go:127
DISABLE_TICKET_EMAIL_RETRY_SCHEDULER (none) ticketing.go:124
DISTRIBUTION_HARD_RESET (none) infra.go:57
FORCE_SCHEMA_CHECK (none) pkg/db/migrate.go:1186
FRONTEND_BASE_URL (none) domain/commerce/handlers/payment_handler.go:76
GENERAL_STORAGE_PATH (none) domain/tenancy/services/general_service.go:119
domain/tenancy/services/general_service.go:146
domain/tenancy/services/general_service.go:156
domain/tenancy/services/general_service.go:187
GROUP_GALLERY_STORAGE_PATH (none) domain/catalogue/services/group_gallery_service.go:30
domain/catalogue/services/ticket_group_service.go:887
domain/catalogue/services/ticket_group_service.go:1243
domain/catalogue/services/ticket_group_service.go:1283
INSTALLER_ASSETS_DIR /castis/installer-assets domain/distribution/config.go:30
INTERNAL_API_URL (none) domain/provisioning/helper.go:108
domain/catalogue/helper.go:86
domain/media/helper.go:245
LIBREOFFICE_PATH (none) domain/analytics/services/report_service.go:2341
MEDIASOUP_SERVICE_URL (none) domain/concierge/config.go:45
MIGRATE_ADMINS (none) pkg/config/config.go:178
MIGRATE_CUSTOMERS (none) pkg/config/config.go:178
PLAYBACK_HARD_RESET (none) infra.go:78
PLAYBACK_INTERNAL_BASE_URL (none) domain/provisioning/handler_playout.go:49
PLAYOUT_ALLOW_DRAFT (none) domain/provisioning/handler_playout.go:38
REPORT_STORAGE_PATH (none) domain/analytics/services/report_service.go:1933
TATTLETALE no main.go:15
TEMPO_BASE_URL https://monitor.castis.io/api/datasources/proxy/uid/ceq48aagucqo0d pkg/config/config.go:150
TEMPO_PASSWORD (none) pkg/config/config.go:152
TEMPO_USERNAME (none) pkg/config/config.go:151
TICKET_AVAILABILITY_POLL_INTERVAL (none) domain/catalogue/routes/setup.go:28
TICKET_GROUP_STORAGE_PATH (none) domain/catalogue/services/ticket_group_service.go:719
domain/catalogue/services/ticket_group_service.go:754
domain/catalogue/services/ticket_group_service.go:1064

Notes

  • CONCIERGE_GUEST_JWT_SECRET and TICKETING_JWT_SECRET_KEY have committed fallback values that sign real sessions. config.WarnInsecureDefaults logs a SECURITY: line at boot when either is in effect. Set them everywhere, then make it a hard failure.
  • CoreAPI's prod overlay loads only coreapi-configmap. Staging additionally loads coreapi-ticketing (43 keys) via patches: patch-env.yml; prod has no equivalent, so every TICKETING_* var except TICKETING_DB_NAME falls back to its in-code default in production.
  • Variables read at many sites (MEDIA_PROXY_BASE_URL ×7, BANNER_STORAGE_PATH ×6) are the remaining consolidation targets — see consolidation-plan.md Phase 2b.