Operations
Environment variables
Required Tasuku process settings, defaults, ports, and security-sensitive values.
The server and worker read the same runtime configuration unless noted.
| Variable | Required | Default | Purpose |
|---|---|---|---|
DATABASE_URL | Yes | — | Postgres connection used by server, worker, and migrations. |
TASUKU_MASTER_KEY | Yes | — | Base64-encoded 32-byte key for GitHub App and user-managed secret encryption. |
TASUKU_MASTER_KEY_VERSION | No | 1 | Positive active key version recorded with new encrypted values. |
TASUKU_PREVIOUS_MASTER_KEYS | No | {} | JSON object mapping older positive versions to base64-encoded 32-byte decrypt-only keys. Must not include the active version. |
TASUKU_PUBLIC_URL | Yes | — | Public origin used for webhook, setup, and OAuth callback URLs. Trailing slash is removed. |
TASUKU_BOOTSTRAP_TOKEN | Yes | — | First-run organization and manifest authorization. |
TASUKU_ENV | No | development | Must be development, test, or production. |
TASUKU_LOG_LEVEL | No | info | Structured log verbosity; use debug during investigation. |
TASUKU_AUTO_SIGNUP_DOMAINS | No | empty | Exact comma-separated verified-email domains; empty disables new signup. |
TASUKU_LISTEN_ADDRESS | No | :8080 | Server bind address. The worker does not listen on it. |
TASUKU_MAX_CONCURRENT_AGENTS | No | 1 | Worker-only global ceiling for running agent jobs across every replica sharing the database. Must be a positive integer. |
TASUKU_WEB_ROOT | No | /app/web | Vite build served by the Go server in production. |
TASUKU_ARTIFACT_S3_ENDPOINT | No | empty | S3-compatible origin reachable by the server and worker. Set the complete artifact group to enable HTML publication. |
TASUKU_ARTIFACT_S3_PUBLIC_ENDPOINT | No | empty | S3-compatible origin used in browser-facing signed URLs. Production requires HTTPS and a hostname different from TASUKU_PUBLIC_URL. |
TASUKU_ARTIFACT_S3_REGION | No | us-east-1 | Signing region for the artifact bucket. |
TASUKU_ARTIFACT_S3_BUCKET | No | empty | Private bucket for generated artifacts. |
TASUKU_ARTIFACT_S3_PREFIX | No | empty | Optional relative object-key prefix. |
TASUKU_ARTIFACT_S3_FORCE_PATH_STYLE | No | true | Use path-style bucket URLs. Required by the bundled MinIO setup. |
TASUKU_ARTIFACT_S3_ACCESS_KEY_ID | No | empty | Access key for the environment-default artifact destination. |
TASUKU_ARTIFACT_S3_SECRET_ACCESS_KEY | No | empty | Secret key for the environment-default artifact destination. |
Compose also accepts operator interpolation values:
| Variable | Default | Purpose |
|---|---|---|
POSTGRES_PASSWORD | tasuku | Password used in the bundled Postgres service and composed DATABASE_URL. |
TASUKU_PORT | 8080 | Host port mapped to the server container's port 8080. |
DOCKER_GID | 0 | Group added to the worker for Docker socket access. |
MINIO_ROOT_USER | tasuku | Development-only MinIO root/access key. |
MINIO_ROOT_PASSWORD | tasuku-development-secret | Development-only MinIO root/secret key. |
Generate secrets
openssl rand -base64 32 # TASUKU_MASTER_KEY
openssl rand -hex 32 # suitable random bootstrap tokenKeep the bootstrap token out of browser-visible configuration and logs. GitHub App credentials are created by the manifest flow and stored in Postgres; there are no supported GITHUB_APP_* environment inputs.