Environment Variables

The Expose server is configured through environment variables. Create a .env file in the deploy/ directory.

Required Variables

Variable	Description	Example
DATABASE_URL	PostgreSQL connection string	postgres://expose:password@postgres:5432/expose
POSTGRES_PASSWORD	Password for the Postgres container	your-secure-password
JWT_SECRET	Secret for signing JWT tokens (32+ chars)	your-32-character-secret-key-here
BASE_DOMAIN	Your root domain	yourdomain.com

Optional Variables

Variable	Description	Default
WEBHOOK_SECRET	Secret for GitHub webhook signatures	Random
RUST_LOG	Log level	info
REGISTRY_URL	Docker registry URL	registry:5000
MAX_UPLOAD_SIZE	Max archive upload size (bytes)	524288000 (500MB)

Example .env File

# Database
DATABASE_URL=postgres://expose:super-secure-password@postgres:5432/expose
POSTGRES_PASSWORD=super-secure-password

# Security
JWT_SECRET=your-very-long-secret-key-at-least-32-characters

# Domain
BASE_DOMAIN=yourdomain.com

# Webhooks (optional)
WEBHOOK_SECRET=another-secure-secret-for-webhooks

# Logging
RUST_LOG=info

# OVH DNS (for Traefik - if using)
OVH_ENDPOINT=ovh-eu
OVH_APPLICATION_KEY=xxx
OVH_APPLICATION_SECRET=xxx
OVH_CONSUMER_KEY=xxx

Generating Secrets

Use OpenSSL to generate secure random secrets:

# Generate JWT secret
openssl rand -hex 32

# Generate webhook secret
openssl rand -hex 32

# Generate database password
openssl rand -base64 24

Security Best Practices

1. Never commit .env files to version control
2. Use strong, unique passwords for each secret
3. Rotate secrets periodically
4. Consider using Docker secrets or a secret manager for production

Traefik Integration

If Traefik needs DNS API credentials for Let’s Encrypt, add them to your Traefik container, not the Expose server:

# In traefik's docker-compose.yml
services:
  traefik:
    environment:
      - OVH_APPLICATION_KEY=${OVH_APPLICATION_KEY}
      - OVH_APPLICATION_SECRET=${OVH_APPLICATION_SECRET}
      - OVH_CONSUMER_KEY=${OVH_CONSUMER_KEY}

Verifying Configuration

After setting environment variables, verify the server starts correctly:

docker compose up -d
docker compose logs expose-server | head -50

Look for:

INFO  expose_server > Starting Expose server on 0.0.0.0:8080
INFO  expose_server > Connected to database
INFO  expose_server > Migrations applied successfully