Configuration reference
Every environment variable the self-host bundle reads. Defaults are
shown — only override what you need.
Edition
| Variable | Default | Notes |
|---|
EDITION | selfhost | Required selfhost here. Setting to cloud makes no sense in this compose. |
NEXT_PUBLIC_EDITION | selfhost | Exposes the edition to the browser bundle so client React can branch. |
LLM
| Variable | Default | Notes |
|---|
AI_LLM_PROVIDER | (empty → ollama) | ollama, openai, anthropic. Empty falls through to the edition default (ollama on selfhost). |
AI_OLLAMA_BASE_URL | http://ollama:11434/v1 | Inside compose. Use http://localhost:11434/v1 if running ai-services on the host. |
AI_OLLAMA_MODEL | llama3.1:8b-instruct-q4_K_M | Any Ollama model tag. |
AI_ANTHROPIC_API_KEY | (empty) | Only when AI_LLM_PROVIDER=anthropic. |
AI_OPENAI_API_KEY | (empty) | Only when AI_LLM_PROVIDER=openai (or for managed embeddings). |
OLLAMA_KEEP_ALIVE | 5m | How long Ollama keeps a model warm. Lower = less idle RAM; higher = faster first-token after pause. |
Embeddings
| Variable | Default | Notes |
|---|
AI_EMBEDDINGS_PROVIDER | (empty → ollama) | ollama or openai. Independent of AI_LLM_PROVIDER. |
AI_OLLAMA_EMBEDDINGS_MODEL | nomic-embed-text | 768-dim. Falls back to fuzzy matching against the 1536-dim graph column. |
AI_OPENAI_API_KEY | (empty) | Reused — set it for either LLM or embeddings; one key works for both. |
File projector
| Variable | Default | Notes |
|---|
CCD_HOME | ~/.ccd (POSIX) / %APPDATA%/ccd (Windows) | Where memory.md / skills/ / tasks.md / user.md live. |
PROJECTOR_INTERVAL_SECONDS | 30 | Sync cycle interval. Lower = faster file ↔ graph round-trip; higher = less PostgREST chatter. |
PROJECTOR_DISABLED | (empty) | Set to 1 to turn the projector off entirely on selfhost. Escape hatch. |
Database + backing services
| Variable | Default | Notes |
|---|
DATABASE_URL | (set by Supabase OSS bundle) | Postgres connection string. |
REDIS_URL | (set by Redis service) | BullMQ + rate limiting + circuit breakers. |
NEXT_PUBLIC_SUPABASE_URL | (set by Supabase OSS bundle) | Browser uses for direct PostgREST calls. |
SUPABASE_SERVICE_ROLE_KEY | (set by Supabase OSS bundle) | Server-side calls bypass RLS. |
Web app
| Variable | Default | Notes |
|---|
NEXT_PUBLIC_APP_URL | http://localhost:3000 | Used in absolute URL construction (e.g. password reset links). |
NEXT_PUBLIC_REALTIME_WS_URL | (empty → no realtime) | Set to your Supabase OSS realtime URL. |
Auth + secrets
| Variable | Default | Notes |
|---|
SERVICE_SECRET | (required in prod) | Shared HMAC secret for service-to-service calls. Generate with openssl rand -hex 32. |
ENCRYPTION_MASTER_KEY | (empty → encryption off; fatal in prod) | Master key for per-tenant DEK derivation — encrypts PII fields, OAuth refresh tokens, integration credentials, MCP credentials. Must be 32 bytes hex (64 chars). Generate with openssl rand -hex 32. NEVER touches the database; env only. Lose this key → permanent loss of all encrypted data on this install. Rotate via /api/admin/compliance/encryption/rotate (cloud-only UI today). |
CRON_SECRET | (empty → cron disabled) | Bearer token for Vercel-style cron endpoints. Generate with openssl rand -hex 32. |
Putting it all together
A complete .env for the simplest self-host config (bundled Ollama, no
encryption, single-node):
EDITION=selfhost
NEXT_PUBLIC_EDITION=selfhost
# LLM
AI_OLLAMA_BASE_URL=http://ollama:11434/v1
AI_OLLAMA_MODEL=llama3.1:8b-instruct-q4_K_M
AI_OLLAMA_EMBEDDINGS_MODEL=nomic-embed-text
# Auth secrets
SERVICE_SECRET=<openssl rand -hex 32>
CRON_SECRET=<openssl rand -hex 32>
# Backing services (filled in by the bundle's docker-compose)
DATABASE_URL=postgresql://postgres:postgres@db:5432/postgres
REDIS_URL=redis://redis:6379
NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000
SUPABASE_SERVICE_ROLE_KEY=<from Supabase OSS bootstrap>
NEXT_PUBLIC_SUPABASE_ANON_KEY=<from Supabase OSS bootstrap>
The installer fills the secrets in for you.
