Environment variables

Environment variables configure the Hub stack. Most are set in .env (generated by the installer or cihub wizard) and are not intended to be edited manually. Use custom settings or custom environment variables for user-facing changes.

The variables below are internal to the Hub stack. Editing them incorrectly can break your installation. Always stop the stack before editing and restart with cihub up prod --detached.

Core

Variable	Description	Default
`CI_HUB_VERSION`	Hub version string. Set automatically at build time — do not override.	(build-time)
`CI_HUB_ENVIRONMENT`	Runtime environment: `production`, `staging`, or `development`.	`production`
`INTERNAL_IP`	LAN IP of the host machine. Used to generate local dashboard links.	(auto-detected)
`ARCHITECTURE`	Host CPU architecture: `amd64` or `arm64`.	`amd64`
`ROOT_FOLDER_HOST`	Absolute path on the host used for Docker volume mounts.	(required)
`JWT_SECRET`	Secret used to sign authentication tokens.	(required)
`NODE_ENV`	Node.js environment: `production`, `development`, or `staging`.	`production`
`LOG_LEVEL`	Log verbosity: `debug`, `info`, `warn`, or `error`.	`info`
`TZ`	Timezone passed to apps that respect it.	`UTC`
`DEVICE_ID`	Device identifier assigned during CI Account pairing. Set automatically.	(set on pairing)

Docker

Variable	Description	Default
`DOCKER_SOCKET_PATH`	Host path to the Docker socket that Hub mounts to manage app containers. Set this when running Docker Desktop on Linux or a rootless daemon, where the socket is not at the default location. Give the path only — no `unix://` prefix.	`/var/run/docker.sock`
`DOCKER_GID`	Group ID of the host `docker` group, so the Hub container can read the mounted socket. Detected automatically at startup.	(auto-detected)

Hub resolves the socket automatically: it honours DOCKER_HOST, then checks Docker Desktop’s Linux locations ($XDG_RUNTIME_DIR/docker.sock, ~/.docker/run/docker.sock), then falls back to /var/run/docker.sock. Set DOCKER_SOCKET_PATH only if that detection picks the wrong one — see Install Docker.

Networking

Variable	Description	Default
`DOMAIN`	Public domain used for Traefik routing and exposed apps.	(required)
`LOCAL_DOMAIN`	LAN domain for locally-accessible app URLs. Apps are served at `<app-name>.<LOCAL_DOMAIN>`. When unset, Hub falls back to `DOMAIN`, then to `localhost`. See Finding Your App’s URL.	(falls back to `DOMAIN`, then `localhost`)
`HTTP_PORT`	Host port Traefik listens on for HTTP traffic.	`80`
`HTTPS_PORT`	Host port Traefik listens on for HTTPS traffic.	`443`
`API_PORT`	Port the Hub backend API is exposed on.	`5002`
`ACME_EMAIL`	Email address for Let’s Encrypt certificate notifications.	(optional)
`LOCAL`	Set to `true` to skip HTTPS requirements in dev setups.	`false`

Database (PostgreSQL)

Variable	Description	Default
`POSTGRES_HOST`	Database hostname inside the Docker network.	`ci-hub-db`
`POSTGRES_DBNAME`	Database name.	`companiondb`
`POSTGRES_USERNAME`	Database user.	`companion`
`POSTGRES_PASSWORD`	Database password.	(required)
`POSTGRES_PORT`	Database port.	`6543`

Message queue (RabbitMQ)

Variable	Description	Default
`RABBITMQ_HOST`	RabbitMQ hostname inside the Docker network.	`ci-os-hub-queue`
`RABBITMQ_USERNAME`	RabbitMQ user.	`companion`
`RABBITMQ_PASSWORD`	RabbitMQ password.	`admin`
`RABBITMQ_PORT`	RabbitMQ AMQP port.	`5672`
`QUEUE_TIMEOUT_IN_MINUTES`	Minutes before a queued action (install, update) times out.	`5`

Inference

Variable	Description	Default
`OLLAMA_URL`	URL Hub uses to reach a running Ollama instance.	`http://host.docker.internal:11434`
`VLLM_URL`	URL for a vLLM inference server (when available).	`http://ci-hub-vllm:8000`
`LEMONADE_URL`	URL for Lemonade cloud-fallback inference.	`http://ci-hub-lemonade:13305`

Cloud & CI Account

Variable	Description	Default
`CI_CLOUD_URL`	URL of the hub.ci.computer backend. Used for device registration, app store, and sync.	(required)

Tailscale (private VPN)

Variable	Description	Default
`TAILSCALE_AUTHKEY`	Pre-authentication key from tailscale.com for unattended login. Optional; interactive setups can sign in from Hub instead.	(optional)
`HUB_TAILSCALE_EXTRA_ARGS`	Overrides the arguments passed to `tailscale up`. The default accepts routes and advertises `172.18.0.0/16`.	(optional)
`PRIVATE_VPN_USER_DISABLED`	Set to `true` to opt out of the default `private-vpn` sidecar profile.	`false`

Feature flags

Variable	Description	Default
`DEMO_MODE`	Enables demo mode with a limited, read-only feature set.	`false`
`GUEST_DASHBOARD`	Allows unauthenticated access to the dashboard.	`false`
`DISABLE_PASSWORD_RESET`	Disables password reset flows.	`true`
`ALLOW_ERROR_MONITORING`	Sends anonymous crash reports to the CI team.	`true`
`ALLOW_AUTO_THEMES`	Enables seasonal theme changes based on time of year.	`true`
`PERSIST_TRAEFIK_CONFIG`	Prevents Hub from overwriting Traefik config on restart.	`false`
`ADVANCED_SETTINGS`	Exposes advanced settings in the dashboard UI.	`false`
`EXPERIMENTAL_INSECURE_COOKIE`	Uses insecure cookies. Only for HTTP-only dev setups.	`false`
`MAX_BACKUPS`	Maximum number of backups to retain. `0` = unlimited.	`0`

Error monitoring (Sentry)

All Sentry variables are optional. Leave unset to disable error reporting.

Variable	Description
`SENTRY_DSN`	Backend Sentry DSN.
`SENTRY_ENV`	Sentry environment tag (e.g. `production`).
`SENTRY_RELEASE`	Backend release identifier (e.g. `ci-hub-backend@4.5.0`).
`VITE_SENTRY_DSN`	Frontend Sentry DSN.
`VITE_SENTRY_RELEASE`	Frontend release identifier (e.g. `ci-hub-frontend@4.5.0`).
`SENTRY_DESKTOP_DSN`	Desktop app Sentry DSN.

Legacy variables

These variables are still accepted for backward compatibility but should not be used in new installations.

Variable	Replaced by	Notes
`DNS_IP`	(removed)	Legacy DNS override, no longer used by the stack.
`NGINX_PORT`	`HTTP_PORT`	Hub uses Traefik, not nginx. Variable still read by the config schema.
`NGINX_PORT_SSL`	`HTTPS_PORT`	Hub uses Traefik, not nginx. Variable still read by the config schema.
`HEADSCALE_PREAUTH_KEY`	`TAILSCALE_AUTHKEY`	Old VPN naming from an earlier release.

App-specific variables

Every installed app receives the system variables above plus these app-scoped ones, resolved at install time:

Variable	Description
`APP_PORT`	The port the app listens on.
`APP_ID`	The app’s unique identifier.
`APP_DATA_DIR`	Path where the app’s persistent data is stored.
`APP_EXPOSED`	`true` if the app is exposed via Traefik.
`APP_DOMAIN`	App’s FQDN if exposed, otherwise `ip:port`.
`APP_EXPOSED_DOMAIN`	Domain the user configured for public exposure, if set.
`APP_LOCAL_DOMAIN`	Local domain the app is reachable on.
`APP_HOST`	Same as `APP_DOMAIN` but without the port in non-exposed scenarios.
`APP_PROTOCOL`	`http` or `https`.