Environment Variables

Setting Environment Variables

Environment variables can be configured in two places:

1. During tenant creation: Step 4 of the wizard lets you add variables via a key/value editor or by pasting a .env file
2. After creation: The Shared Env tab on the tenant detail page lets you add, edit, or remove variables for all services

Changes to environment variables take effect on the next deployment. You'll need to redeploy your service after updating variables.

Secret Variables

Mark any variable as secret to encrypt it at rest using AES-256-GCM. Secret variables are:

• Encrypted in the database, not stored as plaintext
• Redacted in the UI, shown as •••••• after creation
• Decrypted only at deploy time when injected into the container

Use secrets for database passwords, API keys, access tokens, and any other sensitive configuration.

Platform-Injected Variables

Staxa automatically injects several environment variables into every service. You don't need to add these manually:

Database variables (when a database is configured):

• DATABASE_URL: Full connection string
• DB_HOST: Database hostname
• DB_PORT: Database port
• DB_USER: Database username
• DB_PASSWORD: Database password
• DB_NAME: Database name

Service URL variables (for multi-service tenants):

• STAXA_SERVICE_{NAME}_URL: Public URL of each sibling service
• STAXA_SERVICE_{NAME}_INTERNAL_URL: Internal Kubernetes URL of each sibling service

Bulk Import

The .env file import supports standard .env format:

• KEY=value pairs, one per line
• Lines starting with # are treated as comments and ignored
• Empty lines are skipped
• Quoted values (KEY="value") are supported, and quotes are stripped
• Variables with = in the value are handled correctly (only the first = is used as the delimiter)