Operations
Environment variables
Wrangler vars, secrets, and bindings the deployed Worker reads, and what the Go version dropped.
Tasuku's runtime configuration lives entirely in the root wrangler.jsonc — as vars (plain, committed values), secrets (set with wrangler secret put or prompted by the Deploy button), and resource bindings. There is no .env file in production.
Vars
Every TASUKU_* var declared in wrangler.jsonc, with its default:
| Variable | Default | Purpose |
|---|---|---|
TASUKU_ENV | production | development, test, or production. Only development allows the plain (non-Secure) tasuku_session cookie fallback used by wrangler dev on http://localhost. |
TASUKU_PUBLIC_URL | (empty) | Fallback only, used at bootstrap: if the bootstrap request's Origin header isn't a valid public URL, this value is captured into instance_settings.public_url instead. Once persisted, the stored value always wins — setting or changing this var afterward has no effect. See Public URL. |
TASUKU_AUTO_SIGNUP_DOMAINS | (empty) | Comma-separated, exact verified-email domains allowed to self-signup. Empty disables new signup. |
TASUKU_MASTER_KEY_VERSION | 1 | The active key version recorded with newly sealed secrets. Bumped as part of master-key rotation; paired with the TASUKU_MASTER_KEY secret and the TASUKU_PREVIOUS_MASTER_KEYS secret below. |
TASUKU_MAX_CONCURRENT_AGENTS | 2 | Agent-work lane cap enforced by the Scheduler Durable Object. |
TASUKU_MAX_CONCURRENT_REVIEWS | 2 | Pull-request-review lane cap, so reviews never queue behind long-running agent work. |
TASUKU_GLOBAL_MAX_RUNNING | 4 | Ceiling across both lanes combined. Keep at or below what max_instances and any Daytona/external capacity can actually run — see Deployment. |
TASUKU_AGENT_EXECUTION_TIMEOUT | 30m | Maximum wall-clock time for one agent execution attempt. |
TASUKU_AGENT_PROGRESS_TIMEOUT | 10m | Maximum time without observed progress before an attempt fails and retries. |
TASUKU_MAX_EXECUTION_TIMEOUT | 60m | Upper bound a repository or instance configuration cannot exceed when it overrides the execution timeout. |
TASUKU_WORKFLOW_MAX_EVENTS | 10000 | Maximum stored events per workflow run. |
TASUKU_WORKFLOW_MAX_EVENT_BYTES | 1048576 | Maximum size of a single stored workflow event (1 MiB). |
TASUKU_WORKFLOW_MAX_TOTAL_EVENT_BYTES | 33554432 | Maximum total stored event bytes per workflow run (32 MiB). |
TASUKU_SLACK_PROGRESS | true | Enables live Slack progress cards for agent work. |
TASUKU_RUNTIME_IMAGE | docker.io/amalshaji/tasuku-agent-runtime:0.1.0 | Agent runtime image reference. One of five places the runtime image tag is pinned — must agree with containers[].image, runtime/package.json's version, runtime/Dockerfile.cloudflare's FROM line, runtime/deploy/docker-compose.external.yml's image, and runtime/src/version.ts — checked by bun run check:pins. See Deployment. |
ARTIFACT_PUBLIC_BASE_URL | (empty) | Optional second hostname for serving artifact HTML under Content-Security-Policy: sandbox isolation, instead of the instance's own origin. |
Secrets
Set with wrangler secret put <name>, or prompted by the Deploy to Cloudflare button from .dev.vars.example:
| Secret | Required | Purpose |
|---|---|---|
TASUKU_MASTER_KEY | Yes | Base64-encoded 32-byte AES-256-GCM key. Encrypts GitHub App credentials and user-managed secrets sealed in D1. |
TASUKU_PREVIOUS_MASTER_KEYS | No, defaults to {} | JSON object mapping older positive key versions to base64-encoded 32-byte decrypt-only keys. Populated during master-key rotation; must not include the active version. |
TASUKU_BOOTSTRAP_TOKEN | Yes | Authorizes POST /api/v1/bootstrap and, before the first user exists, GitHub App manifest registration. |
TASUKU_MASTER_KEY_VERSION (in the vars table above) travels with these but is a plain var, not a secret — it only names which version is active, it isn't itself sensitive.
Bindings
| Binding | Type | Name(s) |
|---|---|---|
DB | D1 | tasuku |
ARTIFACTS | R2 | tasuku-artifacts |
CACHE | KV | — |
INBOX_QUEUE / EFFECTS_QUEUE / REVIEW_BATCH_QUEUE | Queues | tasuku-inbox, tasuku-effects, tasuku-review-batches (each with a dead-letter queue) |
SCHEDULER, RUN_EVENTS, CODEX_DEVICE_AUTH, MUTEX, USAGE_CACHE, MIGRATOR, AGENT_CONTAINER_STANDARD, AGENT_CONTAINER_LARGE | Durable Objects | see Architecture |
RUN_ATTEMPT_WORKFLOW / SECRET_ROTATION_WORKFLOW | Workflows | tasuku-run-attempt, tasuku-secret-rotation |
ASSETS | Static assets | dashboard build (web/dist) |
VERSION | version_metadata | deployment version/timestamp, replaces the old buildinfo ldflags |
Removed from the Go version
These environment variables no longer exist. There is no replacement value to set — the concept they configured doesn't apply on Workers.
| Variable | Why it's gone |
|---|---|
DATABASE_URL | Replaced by the DB binding to D1; there is no connection string. |
TASUKU_LISTEN_ADDRESS | Workers don't bind a port — Cloudflare's edge terminates the request and invokes the Worker. |
TASUKU_WEB_ROOT | The dashboard build is served through the ASSETS binding, not read from a filesystem path. |
TASUKU_WORKER_* (TASUKU_WORKER_SHUTDOWN_GRACE, TASUKU_WORKER_FINALIZE_TIMEOUT) | There is no standalone worker process to drain on shutdown; RunAttemptWorkflow retries and resumes instead. |
TASUKU_ALLOW_INSECURE_HTTP | Workers are always served over HTTPS; there's no plaintext origin to opt into. |
TASUKU_ARTIFACT_S3_* | Bring-your-own S3 artifact storage is dropped — R2 is the only artifact store, see Artifact storage. |
Generate secrets
openssl rand -base64 32 # TASUKU_MASTER_KEY
openssl rand -hex 32 # TASUKU_BOOTSTRAP_TOKENKeep the bootstrap token out of browser-visible configuration and logs. GitHub App credentials are created by the manifest flow and stored in D1; there are no supported GITHUB_APP_* environment inputs.