Environment variables
Configure runtime behavior and supply credentials without putting them in your source code.
Add configuration before startup
Section titled “Add configuration before startup”Enter variables in the deployment form, or open application environment settings to change them later. Use the exact names expected by the application; names are case-sensitive.
Keep .env.example in the repository to document names and safe defaults. Real tokens, passwords, signing secrets, and API keys belong in environment settings. Deplexo encrypts stored environment values, but the running application can access variables supplied to it.
PORT=3000NODE_ENV=productionTELEGRAM_BOT_TOKEN=<set-in-deplexo>For web apps, run.port in deplexo.yaml overrides the runtime PORT value and makes it read-only in environment settings. Edit the YAML and redeploy to change it. Removing run.port restores the saved dashboard value on the next redeployment. See the YAML port reference.
Understand when variables are available
Section titled “Understand when variables are available”Deplexo passes application variables to the running container. Dependency installation and Dockerfile RUN commands do not automatically receive them during the build.
Make public build configuration explicit. Avoid embedding secrets in Dockerfile ARG or ENV instructions, image layers, frontend bundles, or repository build commands. Restructure server code to read secrets at runtime when possible.
Apply a configuration change
Section titled “Apply a configuration change”After saving environment changes, redeploy or restart through the dashboard so a new container receives the configuration. A running process keeps its old environment until it is replaced.
Verify the change through application behavior and logs. A public frontend variable embedded during a build also requires rebuilding with the intended build configuration.
Rotate and redact secrets
Section titled “Rotate and redact secrets”Rotate credentials with the issuing provider, update the corresponding variable, and redeploy. If the provider lets both credentials remain active, test the replacement before revoking the old one.
Do not print the entire process environment. Log whether a required value is present rather than its contents. Remove tokens, passwords, authorization headers, and sensitive customer data before sharing logs or screenshots.