The production Compose file reads .env.production through the --env-file
argument. Keep this file private and out of Git. After changing values, recreate
the affected services using the same Compose command.
Required settings
| Setting | Purpose |
|---|---|
POSTGRES_USER, POSTGRES_DB, POSTGRES_PASSWORD | Credentials for bundled PostgreSQL |
DATABASE_URL | Database URL using the same credentials and Compose host postgres:5432 |
REDIS_PASSWORD, REDIS_URL | Redis password and matching URL using Compose host redis:6379 |
BETTER_AUTH_SECRET | Unique authentication signing secret of at least 32 characters |
API_BASE_URL | Public HTTPS API origin, such as https://api.example.com |
WEB_ORIGIN | Public HTTPS application origin, such as https://app.example.com |
RESEARCH_CHAT_MODE | Required AI mode: openai or gateway |
AI_MODEL | Model available to your account; Gateway uses provider/model-id |
OPENAI_API_KEY or AI_GATEWAY_API_KEY | Credentials for the selected AI mode |
EMAIL_DELIVERY_MODE | Required production email mode: smtp or resend |
EMAIL_FROM | Sender authorized by your email provider |
SMTP_HOST or RESEND_API_KEY | Selected transport credentials; SMTP can also require port, TLS, username, and password |
The API rejects missing AI configuration and incomplete production email configuration. These checks establish that settings are present; they do not verify provider credentials, quota, billing, or email deliverability.
Origins and cookies
For sibling app and API hostnames, set AUTH_COOKIE_DOMAIN to the shared parent
domain, for example example.com. For a single public HTTPS origin, set
WEB_ORIGIN and API_BASE_URL to that origin and omit AUTH_COOKIE_DOMAIN.
For same-origin routing, send /trpc and application /api/ requests to the API.
Route the following exceptions to the web service before the general API rule:
/api/avatarand/api/avatar/**/api/healthand/api/health/ready/api/ready
Send other pages and assets to the web service. The production Compose file sets the internal server API URL and the public browser API URL separately.
Proxy trust
Forwarded client IPs are ignored by default. Set API_TRUSTED_PROXY_CIDRS only
to actual ingress peer addresses and configure the proxy to sanitize forwarded
headers. Alternatively, API_TRUSTED_INGRESS=true supports isolated ingress
that always overwrites X-Real-IP. Do not enable both modes.
Optional capabilities
| Capability | Settings |
|---|---|
| Live web research | RESEARCH_WEB_SEARCH_MODE=firecrawl, FIRECRAWL_API_KEY |
| Property listings | RESEARCH_LISTING_SEARCH_MODE=rentcast, RENTCAST_API_KEY |
| Property records | RESEARCH_PROPERTY_INTELLIGENCE_MODE=rentcast, RENTCAST_API_KEY |
| Connected apps | COMPOSIO_API_KEY and authorization by each user |
| Google sign-in | GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET; production email is still required |
| Queue isolation | QUEUE_PREFIX, shared by the API and worker |
| Automated ingestion | INGESTION_AUTOMATION_SCOPE_PROFILE_KEY and the source-specific settings for that scope |
A provider key alone does not enable a research mode. Set both the mode and its credentials. Self-hosted mode disables Unearth plan and credit limits; external provider charges and quotas still apply.
Managed PostgreSQL and Redis
The runtime accepts provider-neutral PostgreSQL and Redis URLs. The supplied production Compose file includes both services and depends on their health checks. To use managed services, adapt those service dependencies and pass URLs reachable from the containers. Changing a URL alone does not remove the bundled services from the Compose topology.
For a pooled database connection, configure a direct migration connection when required. See database migrations.
For all supported settings, consult the application environment example and README.