Skip to main content

Environment variables

The environment holds what must not be written in the configuration files — the secrets — and what depends on the host — folders, ports. The configuration files then refer to it.

At a glance​

Installrelease/.env · service env fileEnvironmentLIBERTY_MASTER_KEY · LIBERTY_JWT_SECRETliberty-nextreads them at start${VARIABLE}in a setting value<NAME>_FILEDocker / K8s secretsGeneratedby the installationFile secretsvalue read from a file

References in the TOML files​

Any value of any configuration file can be written ${NAME} or ${NAME:-default}: it is replaced by the environment variable when the file is loaded (the default when the variable is unset or empty).

[pools.reporting]
url = "postgresql+asyncpg://report@${REPORTING_HOST:-db}:5432/reporting"
password = "${REPORTING_PASSWORD}"

Settings shows such a reference as it is written. For a secret field (a password, a key), saving a new value from Settings replaces the reference with an encrypted ENC: value.

Read by the server​

VariableUse
LIBERTY_MASTER_KEYThe key of every ENC: value. Never change it on an existing install.
LIBERTY_JWT_SECRETSigns the sessions. At least 32 characters.
LIBERTY_LICENSE_KEYThe licence key, when it is not pasted in Liberty Next → Administer → App.
ANTHROPIC_API_KEYThe AI assistant's key, when it is not entered in Liberty Next → Administer → App.
LIBERTY_APPS_DIRThe folder of the configuration files (connectors, screens, menus…); the plugins are in ../plugins. See Architecture.
LIBERTY_APP_CONFIGThe path of the application settings file, when it is not config/app.toml.
LIBERTY_ORACLE_CLIENT_LIBThe Oracle Instant Client folder for the thick mode (set in the Docker image).

Database bootstrap​

Read by liberty-admin init-db (run by the container at each start) to write the default pool when it is empty:

VariableUse
POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_HOST, POSTGRES_PORT, POSTGRES_DBA PostgreSQL framework database; the password is stored encrypted. Without POSTGRES_PASSWORD, a SQLite file is used.
LIBERTY_DB_URLThe framework database address used by the containers (SQLite in the light layout).
LIBERTY_ADMIN_PASSWORDThe password of the first admin; otherwise a random one is printed.

Container behaviour​

VariableDefaultUse
LIBERTY_AUTO_MIGRATEoff1: apply the licensed apps' schema migrations at start-up.
LIBERTY_RUN_AS_ROOToff1: keep running as root instead of the liberty user.
LIBERTY_SKIP_INITDBoff1: skip init-db at start-up.
LIBERTY_DB_WAIT_TRIES30Seconds to wait for the framework database before init-db.
<NAME>_FILE—For any LIBERTY_*, POSTGRES_* or PGADMIN_* variable: read its value from this file (Docker, Swarm or Kubernetes secrets).

liberty-ops also reads LIBERTY_SERVICE — the systemd unit name, liberty-next by default.

The Docker .env file​

release/.env, written by ./liberty install, holds the secrets above and the install's choices:

VariableUse
LIBERTY_IMAGE_TAGlatest or a version. Changed by ./liberty upgrade --tag.
COMPOSE_FILEThe compose files in use — changed only by ./liberty ssl and ./liberty apps.
LIBERTY_PORTPort of the light layout (8000).
TRAEFIK_HTTP_PORT, TRAEFIK_HTTPS_PORTPorts of the full layout (80, 443).
POSTGRES_BIND, POSTGRES_PORTWhere PostgreSQL is published (127.0.0.1:5432).
PGADMIN_EMAIL, PGADMIN_PASSWORDpgAdmin's sign-in.
TRAEFIK_DASHBOARD_USERSThe Traefik dashboard's user and password hash.
LIBERTY_DOMAIN, ACME_EMAIL, CERT_HOST_PATHHTTPS settings.
APPS_HOST_PATHThe licensed apps folder on the host.
LIBERTY_ROLLBACK_TAG, LIBERTY_LAST_BACKUP, LIBERTY_LAST_REPORTWritten by ./liberty upgrade for ./liberty rollback.

Edit it only for a port or an address; let the ./liberty commands manage the rest.