arizuko › reference › Environment variables

environment variables

Every env var read by an arizuko Go or TypeScript daemon, with the file:line that reads it, type, default, and one-line effect. Generated from a grep of os.Getenv, chanlib.EnvOr/EnvInt/EnvBool/EnvBytes/EnvDur/MustEnv, and process.env[] across the repo. Test-only env vars omitted.

Conventions. chanlib.EnvOr(k, d) returns d when the env var is empty or unset. chanlib.MustEnv(k) calls os.Exit(1) if unset. chanlib.EnvDur(k, d) reads integer milliseconds (legacy encoding) — not Go duration strings. Adapter LISTEN_ADDR code-defaults vary per daemon, but every service fragment in template/services/ pins :8080; the multi-daemon local-dev numbers (9001–9010) appear here only because that's what the source defaults to.

core — consumed by every Go daemon via `core.LoadConfig`

These are read in core/config.go through chanlib.EnvOr / EnvInt / EnvDur and the resolveTimezone() helper. Every daemon that calls core.LoadConfig() (routd, onbod, webd, …) inherits this surface.

API_PORT

Listening port for routd's HTTP API.

Read by	core / `core/config.go:135` → routd
Type	int
Default	`8080`
Example	`8080`

ARIZUKO_DEV

Dev mode — bind-mounts ant/src into spawned agent containers for live-reload of the in-container runner.

Read by	core / `core/config.go:168`, container / `container/runner.go:498`
Type	bool (`"true"` or `"1"`)
Default	unset = production mode
Example	`1`

ASSISTANT_NAME

Bot display name and mention trigger; also baked into the data-dir basename and compose container_name. Must contain no whitespace or shell metachars.

Read by	core / `core/config.go:102`, webd / `webd/main.go:42`, teled / `teled/main.go:63`, discd / `discd/main.go:70`, whapd / `whapd/src/main.ts:41`
Type	string
Default	`Andy` (core); `assistant` in webd; empty in teled/discd
Example	`Andy`

AUTH_BASE_URL

Public base URL used to build OAuth redirect callbacks and onboarding invite links. HTTPS prefix toggles secure-cookie flag.

Read by	core / `core/config.go:115`
Type	URL
Default	`""`
Example	`https://krons.arizuko.com`

AUTH_SECRET

At-rest sealing key. Comma-separated to rotate: the first key seals new writes, the rest decrypt-only (retired keys kept so values sealed under an old key still read during rotation). This is not the JWT signing key — JWTs are signed with ES256 via authd’s keypair, not HMAC.

Read by	core / `core/config.go:173`
Type	string (hex/random)
Default	`""`
Example	`a3f1...c0de`

CONTAINER_IMAGE

Docker image used to spawn per-group agent containers.

Read by	core / `core/config.go:107`
Type	string
Default	`arizuko-ant:latest`
Example	`arizuko-ant:v0.35.0`

CONTAINER_TIMEOUT

Hard kill timeout per agent run, in milliseconds.

Read by	core / `core/config.go:108`
Type	int (milliseconds, via `EnvDur`)
Default	`3600000` (60 min)
Example	`1800000`

DATA_DIR

Root of this instance's data directory (store/, groups/, ipc/, web/). When set in compose, also passes through to dashd, timed, and several adapters as their working/storage root.

Read by	core / `core/config.go:99`, dashd / `dashd/main.go:67`, timed / `timed/main.go:26`, teled / `teled/main.go:54`, bskyd / `bskyd/main.go:60`, reditd / `reditd/main.go:75`, emaid / `emaid/main.go:66`, linkd / `linkd/main.go:68`, whapd / `whapd/src/main.ts:42`, twitd / `twitd/src/main.ts:28`
Type	path
Default	cwd (core); `/srv/data/<daemon>` per adapter
Example	`/srv/data/arizuko_krons`

DEX_ISSUER

OIDC issuer URL of a Dex instance. With DEX_CLIENT_ID it mounts /auth/dex on authd: Dex authenticates the person against its connectors, authd reads federated_claims off the ID token and mints the session for <connector_id>:<user_id> — the principal the native callback for that provider would mint. The folder claim and scope snapshot stay authd's. Unset leaves the login page as it is.

Read by	authd / `core/config.go`
Type	URL
Default	`""`
Example	`https://auth.example.com/dex`

DEX_CLIENT_ID

The static client id authd presents to Dex; the ID token's audience must equal it. Pair with DEX_CLIENT_SECRET for a confidential client; a public client with PKCE needs no secret.

Read by	authd / `core/config.go`
Type	string
Default	`""`
Example	`arizuko`

DEX_CLIENT_SECRET

Secret for DEX_CLIENT_ID, sent on the code exchange. Optional.

Read by	authd / `core/config.go`
Type	string
Default	`""`
Example	`a-long-random-secret`

DISCORD_CLIENT_ID

OAuth client id for the Discord login provider in proxyd's auth flow (distinct from the bot token used by discd).

Read by	core / `core/config.go:118`
Type	string
Default	`""`
Example	`1234567890`

DISCORD_CLIENT_SECRET

OAuth client secret for the Discord login provider.

Read by	core / `core/config.go:119`
Type	string
Default	`""`
Example	`abc...def`

EGRESS_IMAGE

Image holding the egress binary. This is the master switch — name an image and runed starts one proxy container per spawn from it with that folder’s allowlist baked in, killing it with the turn; leave it empty and spawns run unfiltered. There is no separate enable flag. Build it with make images.

Read by	core / `core/config.go:263`, runed / `container/egress.go`
Type	string (docker image ref)
Default	`""` (egress isolation off)
Example	`arizuko-egress:latest`

EGRESS_NETWORK_PREFIX

Prefix for the per-folder docker networks runed creates at spawn (<prefix>_<folder>). Each is created --internal, so a spawn on it has no route out except its own proxy. Must be unique per instance so two instances on one docker host cannot collide.

Read by	core / `core/config.go:262`, compose generation / `compose/compose.go:737`
Type	string
Default	`""`; when `EGRESS_IMAGE` is set, `arizuko generate` writes `<app>_<flavor>`
Example	`arizuko_krons`

EGRESS_SUBNET

Parent CIDR carved into per-folder /24s. Each spawn takes two addresses out of its folder’s /24 — one for the agent, one for its proxy. Must be /8 to /23.

Read by	core / `core/config.go:265`
Type	CIDR string
Default	`10.99.0.0/16`
Example	`10.42.0.0/16`

EGRESS_UPLINK_NETWORK

The docker network that gives each spawn’s proxy its route to the internet, and gives runed a path to poll that proxy’s /health before starting the agent. The agent is never attached to it. Derived, not hand-set.

Read by	core / `core/config.go:264`, compose generation / `compose/compose.go:744`
Type	string
Default	`""`; when `EGRESS_IMAGE` is set, `arizuko generate` writes `<project>_default`
Example	`arizuko_krons_default`

GITHUB_ALLOWED_ORG

If set, restricts GitHub OAuth sign-in to members of this org.

Read by	core / `core/config.go:123`
Type	string
Default	`""`
Example	`kronael`

GITHUB_CLIENT_ID

OAuth client id for the GitHub login provider.

Read by	core / `core/config.go:116`
Type	string
Default	`""`
Example	`Iv1.abc123`

GITHUB_CLIENT_SECRET

OAuth client secret for the GitHub login provider.

Read by	core / `core/config.go:117`
Type	string
Default	`""`
Example	`ghs_xxxxx`

GOOGLE_ALLOWED_EMAILS

CSV allowlist of email addresses permitted to complete Google OAuth.

Read by	core / `core/config.go:122`
Type	CSV string
Default	`""`
Example	`alice@example.com,bob@example.com`

GOOGLE_CLIENT_ID

OAuth client id for the Google login provider.

Read by	core / `core/config.go:120`
Type	string
Default	`""`
Example	`abc.apps.googleusercontent.com`

GOOGLE_CLIENT_SECRET

OAuth client secret for the Google login provider.

Read by	core / `core/config.go:121`
Type	string
Default	`""`
Example	`GOCSPX-xxx`

HOST_APP_DIR

Path on the host that contains the arizuko binaries and ant/src; used when bind-mounting the dev runner.

Read by	core / `core/config.go:101`, compose / `compose/compose.go:461`
Type	path
Default	directory of the running executable
Example	`/home/onvos/app/arizuko`

HOST_CODEX_DIR

Host path bind-mounted into agent containers at /home/node/.codex so the oracle skill can reuse the operator's codex login state.

Read by	core / `core/config.go:133`
Type	path
Default	`""` (mount disabled; falls back to the `CODEX_API_KEY`/`OPENAI_API_KEY` env-profile keys)
Example	`/home/onvos/.codex`

HOST_DATA_DIR

Host-side path used when constructing volume mounts for spawned containers. Differs from DATA_DIR only when arizuko runs inside a container itself.

Read by	core / `core/config.go:100`
Type	path
Default	`DATA_DIR`
Example	`/srv/data/arizuko_krons`

IDLE_TIMEOUT

How long an idle agent container is kept around before recycling, in milliseconds.

Read by	core / `core/config.go:109`
Type	int (milliseconds)
Default	`3600000` (60 min)
Example	`600000`

MAX_CONCURRENT_CONTAINERS

Max agent containers running at once before runed queues spawns.

Read by	core / `core/config.go:110`
Type	int
Default	`5`
Example	`10`

MAX_TURN_RETRY

How many times routd re-runs a turn whose container died without delivering any bot message — SIGKILL, out-of-memory, or the RUNED_RUN_TIMEOUT run ceiling. Each attempt waits 10s, then spawns a fresh container with a <system-note> telling the agent it is retry N of M and to be conservative with resources. A turn that already replied is never retried, even partially. Set 0 to disable. Instance-wide — no per-folder override. See retries.

Read by	core / `core/config.go:250` → routd
Type	int
Default	`3`
Example	`5`

MEDIA_ENABLED

Enables inbound media download and forwarding to the agent. Adapters fall back to URL-only references when off.

Read by	core / `core/config.go:143`
Type	bool (`"true"`)
Default	`false`
Example	`true`

MEDIA_MAX_FILE_BYTES

Per-attachment byte cap on inbound media; adapter ProxyFile streams up to this size before truncation.

Read by	core / `core/config.go:144`, teled / `teled/main.go:65`, discd / `discd/main.go:71`, bskyd / `bskyd/main.go:61`, reditd / `reditd/main.go:76`, emaid / `emaid/main.go:67`, slakd / `slakd/main.go:63`
Type	int (bytes)
Default	`20971520` (20 MiB)
Example	`52428800`

ONBOARDING_ENABLED

Master switch for the onboarding flow. Affects both routd behaviour and whether compose generates the onbod service.

Read by	core / `core/config.go:137`, onbod / `onbod/main.go:55` (`"0"` → exit 0), compose / `compose/compose.go:326`
Type	bool (core: `"true"`; onbod: `"0"` disables)
Default	`false`
Example	`true`

ONBOARDING_PLATFORMS

CSV of platforms (e.g. telegram,discord) for which onboarding admissions are enabled.

Read by	core / `core/config.go:138`
Type	CSV string
Default	`""`
Example	`telegram,whatsapp`

OBSERVE_WINDOW_MESSAGES

How many trailing #observe-mode messages routd folds into context when a trigger turn fires. Per-route override via routes.observe_window_messages.

Read by	core / `core/config.go:151`, routd
Type	int
Default	`10`
Example	`25`

OBSERVE_WINDOW_CHARS

Character cap on the #observe context window for a single trigger turn. Per-route override via routes.observe_window_chars.

Read by	core / `core/config.go:152`, routd
Type	int (chars)
Default	`4000`
Example	`8000`

ENGAGEMENT_TTL

How long a (chat, topic) stays “engaged” after the bot’s last reply. Engaged pairs fire a turn on every inbound message without needing a fresh @mention, and override #observe routing. Each bot reply pushes the deadline out again; user messages do not. See engagement.

Read by	routd / `routd/cmd/routd/main.go:203`
Type	duration (e.g. `10m`, `30m`)
Default	`30m`
Example	`30m`

SECRETS_KEY

AES-256-GCM key for the secrets table — secrets are encrypted at rest. Required: routd refuses to start without it, and there is no plaintext mode and no AUTH_SECRET fallback. The value is a comma-separated keyring: the first key seals new writes, the rest are decrypt-only (retired keys kept around so values sealed under an old key still read during rotation). On boot routd migrates any legacy-plaintext rows in place under the active key. arizuko create generates a random key into the new instance’s .env; the arizuko secret CLI uses the same keyring. Stored values carry a v2: prefix.

Read by	core / `core/config.go:123` → routd, `arizuko secret` CLI
Type	string (comma-separated keyring; first = active seal key)
Default	none — routd exits if unset; `arizuko create` generates one
Example	`9d4f...new,2a17...retired`

SEND_DISABLED_CHANNELS

CSV of channel names where outbound sends are dropped (read-only mode).

Read by	core / `core/config.go:140`
Type	CSV string
Default	`""`
Example	`slack,bluesky`

SEND_DISABLED_GROUPS

CSV of group folders where outbound sends are dropped (read-only mode).

Read by	core / `core/config.go:141`
Type	CSV string
Default	`""`
Example	`solo/inbox,corp/eng`

TELEGRAM_BOT_TOKEN

Bot token for the Telegram channel adapter.

Read by	core / `core/config.go:106`, teled / `teled/main.go:58` (MustEnv)
Type	string
Default	`""` (teled refuses to start)
Example	`12345:ABC-DEF1234ghIkl-zyx57W2v1u123ew11`

TTS_BASE_URL

OpenAI-compatible /v1/audio/speech base URL the agent's send_voice path hits.

Read by	core / `core/config.go:151`
Type	URL
Default	`http://ttsd:8880`
Example	`http://ttsd:8880`

TTS_ENABLED

Enables TTS rendering of agent replies as voice messages.

Read by	core / `core/config.go:150`
Type	bool (`"true"`)
Default	`false`
Example	`true`

TTS_MODEL

Default model name passed in the TTS request body.

Read by	core / `core/config.go:153`
Type	string
Default	`kokoro`
Example	`kokoro`

TTS_TIMEOUT

Per-request timeout when calling the TTS backend, in milliseconds.

Read by	core / `core/config.go:154`
Type	int (milliseconds)
Default	`15000` (15 s)
Example	`30000`

TTS_VOICE

Instance-default voice id; agent may override per-call via send_voice args or per-group via PERSONA.md frontmatter.

Read by	core / `core/config.go:152`
Type	string
Default	`af_bella`
Example	`af_sky`

TZ

IANA timezone for log timestamps, cron evaluation in timed, and Config.Timezone consumers.

Read by	core / `core/config.go:192`, timed / `timed/main.go:36`, compose / `compose/compose.go:490`
Type	string (IANA name)
Default	`UTC`
Example	`Europe/Bratislava`

VIDEO_TRANSCRIPTION_ENABLED

Enables Whisper transcription of inbound video.

Read by	core / `core/config.go:147`
Type	bool (`"true"`)
Default	`false`
Example	`true`

VOICE_TRANSCRIPTION_ENABLED

Enables Whisper transcription of inbound voice messages.

Read by	core / `core/config.go:146`
Type	bool (`"true"`)
Default	`false`
Example	`true`

WEB_HOST

Public hostname the instance serves; used to build chat-link, webhook, and onboarding URLs in agent prompts.

Read by	core / `core/config.go:114`
Type	string
Default	`""`
Example	`krons.arizuko.com`

WHISPER_BASE_URL

Base URL of the Whisper-compatible transcription endpoint.

Read by	core / `core/config.go:145`
Type	URL
Default	`http://localhost:8080`
Example	`http://whisper:9000`

WHISPER_MODEL

Model name passed to Whisper.

Read by	core / `core/config.go:148`
Type	string
Default	`turbo`
Example	`large-v3`

container — agent spawn (read by runed when building runs)

Model keys are env-profile keys. ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, OPENAI_API_KEY, and CODEX_API_KEY pick which model a spawn talks to, so they are user-scoped credentials, not folder secrets — the store rejects them at folder scope. A user sets their own in a dedicated dashboard section at /dash/me/env, and that value overrides the operator default for their spawns. The host .env value below is the instance-wide default forwarded when a user has set nothing. See secrets. With the litellm package the forwarding stops: the gateway reads the credential from .env and the container gets MODEL_GATEWAY_KEY instead.

ANTHROPIC_API_KEY

Instance default forwarded into every spawned agent container so Claude Code can authenticate, unless the triggering user has set their own at /dash/me/env.

Read by	container / `container/runner.go:617`
Type	string
Scope	user (env-profile key; rejected at folder scope)
Default	not forwarded if unset
Example	`sk-ant-...`

CLAUDE_CODE_OAUTH_TOKEN

Alternative auth for Claude Code; forwarded into the container alongside ANTHROPIC_API_KEY, same user-override rule.

Read by	container / `container/runner.go:617`
Type	string
Scope	user (env-profile key; rejected at folder scope)
Default	not forwarded if unset
Example	`cc-oauth-...`

LOG_LEVEL

Sets the stderr slog level (debug < info < warn < error) for every daemon, applied by obs.Setup at startup. Additionally, in runed debug/trace dumps full container stderr + mounts after every spawn.

Read by	every daemon via `obs.Setup`; container-run verbose dump / `container/runner.go:891`
Type	string (`debug`/`info`/`warn`/`error`/`trace`)
Default	`info`
Example	`debug`

chanreg

CHANNEL_REGISTER_ALLOW_PUBLIC

Dev override that lets channel adapters register with public IPs. By default chanreg rejects non-private adapter URLs as SSRF risk.

Read by	chanreg / `chanreg/chanreg.go:222`
Type	bool (`"1"`)
Default	unset = enforce private-only
Example	`1`

arizuko CLI (`cmd/arizuko`)

ARIZUKO_DATA_DIR

Override the base directory used to construct instance data paths. When set, instance dir is $ARIZUKO_DATA_DIR/arizuko_<name>.

Read by	cli / `cmd/arizuko/main.go:151`
Type	path
Default	`""` (falls back to `PREFIX`)
Example	`/var/lib/arizuko`

PREFIX

Filesystem prefix for instance data dirs; final path is $PREFIX/data/arizuko_<name>.

Read by	cli / `cmd/arizuko/main.go:154`
Type	path
Default	`/srv`
Example	`/srv`

arizuko run (compose generation)

Read by compose/compose.go at arizuko run time when it generates the docker-compose YAML. These are not consumed by any running daemon — only by the generator that decides which services to emit, which ports to expose, and which proxyd routes to gate.

DAV_PORT

Host port to expose for davd. Empty ⇒ davd not exposed at the docker level.

Read by	compose / `compose/compose.go:564`
Type	string (port)
Default	`""`
Example	`8096`

COMPOSE_PROFILES

Comma-separated docker compose profiles that decide which optional daemons run. Generated, not hand-set: activeProfiles derives it from the instance's feature flags (WEB_PORT → web, WEBDAV_ENABLED → davd, ONBOARDING_ENABLED → onbod; timed is always on) and writes it into the compose-managed block of .env. Every optional service fragment carries a matching profiles: [<name>], so this list is the single gate docker reads.

Read by	docker compose (written by `compose/compose.go:411`)
Type	CSV string
Default	`timed` (always on)
Example	`davd,onbod,timed,web`

WEB_PORT

Host port the proxyd service is published on; the public entry point for the instance.

Read by	compose / `compose/compose.go:530`
Type	string (port)
Default	`8095`
Example	`443`

WEB_PORT_ALIASES

CSV of additional host ports also published for proxyd (e.g. expose 80 alongside 443).

Read by	compose / `compose/compose.go:536`
Type	CSV string
Default	`""`
Example	`80,8080`

WEBDAV_ENABLED

Whether to emit the davd service and gate its /dav/ proxyd route.

Read by	compose / `compose/compose.go:323` (and as a route gate at `:186`)
Type	bool (`"true"`)
Default	`true`
Example	`false`

routd

Apart from the PROACTIVE_* set below, routd takes every value from core.LoadConfig above. The egress vars are runed’s, since runed owns the docker spawn: it refuses to start if the retired CRACKBOX_ADMIN_API is still set while EGRESS_IMAGE is empty, so an upgraded instance cannot spawn unfiltered while looking healthy.

The PROACTIVE_* vars tune proactive interjection — the agent speaking without being addressed. They are read once at startup by routd.LoadProactiveConfig, called from routd/cmd/routd/main.go:165. All of them do nothing unless PROACTIVE_ENABLED is on. Per-group opt-in is separate: a proactive: block in the group’s CLAUDE.md frontmatter, not an env var.

PROACTIVE_ENABLED

Master switch for proactive interjection. Unset or false and routd builds no scanner at all — the whole feature is absent, not idle. No shipped template sets it, so every instance is off until an operator opts in. Turning it on starts the scan; each group still has to declare mode: lurk before anything fires.

Read by	routd / `routd/proactive.go:39`
Type	bool (`1`, `true`, `yes`, `on`)
Default	unset — off
Example	`true`

PROACTIVE_SCAN_INTERVAL

Minimum gap between proactive sweeps. The sweep is driven by routd’s own loop, not a timer, so a long turn simply delays the next one — missed ticks are dropped, never replayed as a burst.

Read by	routd / `routd/proactive.go:40`
Type	duration (Go syntax, e.g. `30s`, `2m`)
Default	`30s`
Example	`1m`

PROACTIVE_SILENCE_MIN

How long a chat must have been quiet before an interjection is considered. Below this the conversation is still live and cutting in is rude. Measured from the last real inbound — bot replies and prior proactive messages do not reset the clock.

Read by	routd / `routd/proactive.go:41`
Type	duration
Default	`90s`
Example	`5m`

PROACTIVE_SILENCE_MAX

Upper edge of the same band. Past this the chat is dormant — nobody is there to read the message — so the scan skips it.

Read by	routd / `routd/proactive.go:42`
Type	duration
Default	`12h`
Example	`4h`

PROACTIVE_COOLDOWN

How long a chat is barred from a second interjection after one fires. Mandatory — state-triggered firing without a cooldown loops. Recorded per chat in routd.db’s chat_proactive table, written in the same transaction that queues the turn, so a crash mid-dispatch costs at most one missed turn and never a double-fire. There is no per-group override.

Read by	routd / `routd/proactive.go:43`
Type	duration
Default	`24h`
Example	`48h`

PROACTIVE_BOT_QUIET

How long after its own last message the bot stays out of a chat. Stops a proactive turn from landing on the heels of a reply the agent just made.

Read by	routd / `routd/proactive.go:44`
Type	duration
Default	`15m`
Example	`30m`

PROACTIVE_RECENT_ACTIVITY_MIN

How many inbound messages must have arrived in the last hour for the room to count as busy enough to be worth speaking into. Below the threshold the scan skips the chat.

Read by	routd / `routd/proactive.go:45`
Type	int (messages per hour)
Default	`3`
Example	`5`

proxyd

PROXYD_HMAC_SECRET retired

Retired. The HMAC identity-header model is gone. proxyd no longer signs an X-User-Sig header; it proves the channel to each backend with an authd-minted ES256 bearer pinned to service:proxyd, verified by auth.ProxydTransit in auth/middleware.go. No shared secret to set. See auth concept.

PROXYD_LISTEN

Port proxyd binds to. Plain numbers get a : prefix.

Read by	proxyd / `proxyd/main.go:42`
Type	string (port or `:port`)
Default	`8080`
Example	`8080`

PUB_REDIRECT_URL

If set, proxyd redirects /pub/* requests to this base URL instead of serving them locally — lets a CDN front the static docs.

Read by	proxyd / `proxyd/main.go:57`
Type	URL
Default	`""` (proxyd serves /pub/ itself)
Example	`https://docs.arizuko.com`

TRUSTED_PROXIES

CSV of CIDRs (or bare IPs) trusted to set X-Forwarded-For. Empty ⇒ no client trusted, XFF always replaced with the connection peer.

Read by	proxyd / `proxyd/main.go:60`
Type	CSV string (CIDRs / IPs)
Default	`""`
Example	`10.0.0.0/8,172.16.0.0/12`

VITE_ADDR

Backend address proxyd forwards /pub/* (and chat widget) traffic to.

Read by	proxyd / `proxyd/main.go:56`
Type	URL
Default	`http://vited:8080`
Example	`http://vited:8080`

webd

ROUTER_URL

Base URL of routd; webd posts inbound web chat and webhook messages to $ROUTER_URL/v1/messages.

Read by	webd / `webd/main.go:38` — see also `ROUTER_URL` in adapters
Type	URL
Default	`http://routd:8080`
Example	`http://routd:8080`

WEBD_LISTEN

Address webd binds to.

Read by	webd / `webd/main.go:36`
Type	listen addr (`:port` or `host:port`)
Default	`:8080`
Example	`:8080`

WEBD_URL

Public URL webd advertises to routd when registering as a channel.

Read by	webd / `webd/main.go:37`
Type	URL
Default	`http://webd:8080`
Example	`http://webd:8080`

onbod

ONBOARD_POLL_INTERVAL

Cadence at which onbod scans for unprompted users / admission queue entries.

Read by	onbod / `onbod/main.go:147`
Type	Go duration string (`time.ParseDuration`)
Default	`10s`
Example	`30s`

ONBOARDING_GREETING

Custom greeting string injected into onboarding prompts in place of the default copy.

Read by	onbod / `onbod/main.go:142`
Type	string
Default	`""`
Example	`Welcome to krons.`

ONBOD_LISTEN_ADDR

Address onbod binds to.

Read by	onbod / `onbod/main.go:144`
Type	listen addr
Default	`:8080`
Example	`:8080`

onbod additionally reads ONBOARDING_ENABLED ("0" → clean exit) and ROUTER_URL via core. It trusts X-User-* headers only behind the proxyd transit bearer (auth.ProxydTransit); on its mixed public/authed invite routes an unproven request is treated as anonymous rather than rejected.

dashd

DASH_PORT

Port dashd binds to. Plain numbers get a : prefix.

Read by	dashd / `dashd/main.go:79`, compose / `compose/compose.go:523`
Type	string
Default	`:8080`
Example	`:8080`

DB_PATH

The file dashd opens for routd's tables when the instance keeps its owners in files. Ignored once DYNAMODB_URL names an endpoint — dashd takes routd's tables from there and opens nothing. Falls back to $DATA_DIR/store/routd/routd.db; ONBOD_DB_PATH is the same for onbod's. Pointing it at a retired database is refused, not served stale.

Read by	dashd / `dashd/main.go:453`
Type	path
Default	`$DATA_DIR/store/routd/routd.db` (refuses to start if both unset)
Example	`/srv/data/arizuko_krons/store/routd/routd.db`

SURROGATE_<NAME>_CLIENT_ID

OAuth app client id for the surrogate “Connect <name>” flow at /dash/me/connections — arizuko authenticating as the user against a third-party API, not a user signing in to arizuko. <NAME> is the provider name upper-cased (-→_); a pair exists for every registered provider, built-in or dropped in at <datadir>/surrogate/*.toml (see how-to: add an OAuth provider). SURROGATE_GITHUB_CLIENT_ID feeds the built-in GitHub connector; it is distinct from GITHUB_CLIENT_ID, the login provider. Unset hides that provider's connection option.

Read by	routd + dashd / `auth/surrogate/engine.go` (`NewEngine`)
Type	string
Default	`""`
Example	`Iv1.def456`

SURROGATE_<NAME>_CLIENT_SECRET

OAuth app client secret paired with SURROGATE_<NAME>_CLIENT_ID. One pair per provider.

Read by	routd + dashd / `auth/surrogate/engine.go` (`NewEngine`)
Type	string
Default	`""`
Example	`ghs_yyyyy`

timed

ROUTER_URL

routd's address. timed opens no database — it reads due tasks and records runs over routd's HTTP API, so scheduled_tasks has exactly one writer path.

Read by	timed / `timed/main.go`
Type	URL
Default	none — required, timed refuses to start without it
Example	`http://routd:8080`

timed also reads AUTHD_URL + AUTHD_SERVICE_KEY (exchanged at boot for the service:timed token routd's gate requires) and TZ (for cron evaluation).

ttsd

TTSD_ADDR

Address ttsd binds to.

Read by	ttsd / `ttsd/main.go:31`
Type	listen addr
Default	`:8880`
Example	`:8880`

TTS_BACKEND_URL

Upstream Kokoro/OpenAI-compatible TTS server ttsd proxies to.

Read by	ttsd / `ttsd/main.go:32`
Type	URL
Default	`http://kokoro:8880`
Example	`http://kokoro:8880`

ttsd also reads LOG_LEVEL.

litellm (model gateway package)

A third-party image, so it has no generated env file: template/services/litellm.yml names the .env keys docker interpolates into it, and compose/fragments_test.go pins that set. Component page: components/litellm.

MODEL_GATEWAY_KEY

The virtual key. litellm accepts it as its master key; runed hands it to every spawn, where the claude harness sends it as ANTHROPIC_AUTH_TOKEN. packages add litellm mints it into .env (the package's manifest declares it generate), and a later generate mints a new one if the line is gone. The fragment still interpolates it as required (${MODEL_GATEWAY_KEY:?}), so a hand-copied fragment with no key refuses to start rather than start a gateway that accepts every caller.

Read by	litellm via `template/services/litellm.yml` (`LITELLM_MASTER_KEY`); runed for the spawn env
Type	string
Default	none — required once the package is installed
Example	`$(openssl rand -hex 24)`

MODEL_GATEWAY_URL

Where runed points every spawn’s model client (ANTHROPIC_BASE_URL for claude). Unset means the container keeps the credential and talks to the vendor directly, which is the default.

Read by	runed for the spawn env
Type	URL
Default	`""` = no gateway
Example	`http://litellm:4000`

litellm also reads ANTHROPIC_API_KEY (or, when that is empty, CLAUDE_CODE_OAUTH_TOKEN) as the credential it forwards upstream, TZ, and the three OTLP keys under observability.

Adapter common surface

Every channel adapter shares the same set of plumbing env vars:

CHANNEL_NAME

Name the adapter registers with routd; routing uses this verbatim. Has a per-daemon default.

Read by	teled `:55`, discd `:64`, bskyd `:52`, reditd `:64`, emaid `:55`, linkd `:59`, slakd `:56`
Type	string
Default	matches the platform (`telegram`, `discord`, `slack`, …)
Example	`telegram-prod`

LISTEN_ADDR

Address the adapter binds for its outbound-send HTTP server (routd → adapter).

Read by	teled `:61` (`:9001`), discd `:68` (`:9002`), whapd `:156` (`:9002`), emaid `:64` (`:9003`), bskyd `:58` (`:9005`), reditd `:73` (`:9006`), linkd `:66` (`:9010`), slakd `:61` (`:8080`), twitd `:43` (`:8080`)
Type	listen addr
Default	varies (see column above; `:8080` when pinned by the service fragment)
Example	`:8080`

LISTEN_URL

URL the adapter advertises to routd on registration so routd can reach it.

Read by	teled `:62`, discd `:69`, whapd `:157`, emaid `:65`, bskyd `:59`, reditd `:74`, linkd `:67`, slakd `:62`, twitd `:44`
Type	URL
Default	`http://<daemon>:<port>`
Example	`http://teled:9001`

ROUTER_URL

Base URL of routd where the adapter posts inbound messages.

Read by	teled `:59` (MustEnv), discd `:66` (MustEnv), whapd `:154`, emaid `:62` (MustEnv), bskyd `:56` (MustEnv), reditd `:71` (MustEnv), linkd `:64` (MustEnv), slakd `:59` (MustEnv), twitd `:41`, webd :38, onbod `:143`
Type	URL
Default	required in most adapters (`MustEnv`); webd/onbod default to `http://routd:8080`
Example	`http://routd:8080`

All adapters additionally read AUTHD_SERVICE_KEY and AUTHD_URL — they exchange that key for a service:<daemon> ES256 token and present it on every routd call. Most also read MEDIA_MAX_FILE_BYTES.

teled (Telegram)

Reads TELEGRAM_BOT_TOKEN (MustEnv), ASSISTANT_NAME, DATA_DIR, plus the adapter common surface. No teled-specific env vars beyond these.

discd (Discord)

DISCORD_BOT_TOKEN

Bot token. Required unless DISCORD_USER_TOKEN is set instead.

Read by	discd / `discd/main.go:52`
Type	string
Default	`""` (refuses to start if both bot/user tokens empty)
Example	`MTAxNTM4...`

DISCORD_USER_TOKEN

User-account token; selects user-mode operation, bypassing bot intents. Mutually exclusive with the bot token.

Read by	discd / `discd/main.go:53`
Type	string
Default	`""`
Example	`mfa.xxxxx`

whapd (WhatsApp)

WHATSAPP_AUTH_DIR

Directory where Baileys multi-file auth state (creds, keys) is persisted.

Read by	whapd / `whapd/src/main.ts:44`
Type	path
Default	`$DATA_DIR/store/whatsapp-auth` or `/srv/data/store/whatsapp-auth`
Example	`/srv/data/arizuko_krons/store/whatsapp-auth`

whapd also reads ASSISTANT_NAME, DATA_DIR, ROUTER_URL, LISTEN_ADDR, LISTEN_URL.

bskyd (Bluesky)

BLUESKY_IDENTIFIER

AT Protocol handle or DID the adapter logs in as.

Read by	bskyd / `bskyd/main.go:53` (MustEnv)
Type	string
Default	required
Example	`arizuko.bsky.social`

BLUESKY_PASSWORD

App password for the Bluesky account.

Read by	bskyd / `bskyd/main.go:54` (MustEnv)
Type	string
Default	required
Example	`xxxx-xxxx-xxxx-xxxx`

BLUESKY_SERVICE

PDS endpoint to authenticate against.

Read by	bskyd / `bskyd/main.go:55`
Type	URL
Default	`https://bsky.social`
Example	`https://bsky.social`

reditd (Reddit)

REDDIT_CLIENT_ID

OAuth client id of the registered Reddit app.

Read by	reditd / `reditd/main.go:65` (MustEnv)
Type	string
Default	required
Example	`abc123`

REDDIT_CLIENT_SECRET

OAuth client secret of the registered Reddit app.

Read by	reditd / `reditd/main.go:66` (MustEnv)
Type	string
Default	required
Example	`xyz789`

REDDIT_PASSWORD

Password for the bot account (script OAuth flow).

Read by	reditd / `reditd/main.go:68` (MustEnv)
Type	string
Default	required
Example	`hunter2`

REDDIT_POLL_INTERVAL

How often reditd polls subreddits for new posts/comments.

Read by	reditd / `reditd/main.go:77`
Type	Go duration string
Default	`5m`
Example	`2m`

REDDIT_SUBREDDITS

CSV of subreddit names to monitor.

Read by	reditd / `reditd/main.go:58`
Type	CSV string
Default	`""`
Example	`selfhosted,homelab`

REDDIT_USER_AGENT

User-Agent string used in Reddit API calls (Reddit policy requires a descriptive UA).

Read by	reditd / `reditd/main.go:70`
Type	string
Default	`arizuko/1.0`
Example	`arizuko-krons/1.0 by u/op`

REDDIT_USERNAME

Username of the bot account.

Read by	reditd / `reditd/main.go:67` (MustEnv)
Type	string
Default	required
Example	`arizuko_bot`

emaid (Email)

EMAIL_ACCOUNT

Email address / IMAP+SMTP login username.

Read by	emaid / `emaid/main.go:58` (MustEnv)
Type	string
Default	required
Example	`bot@example.com`

EMAIL_IMAP_HOST

IMAP server hostname.

Read by	emaid / `emaid/main.go:56` (MustEnv)
Type	string
Default	required
Example	`imap.gmail.com`

EMAIL_IMAP_PORT

IMAP server port.

Read by	emaid / `emaid/main.go:60`
Type	string (port)
Default	`993`
Example	`993`

EMAIL_PASSWORD

Read by	emaid / `emaid/main.go:59` (MustEnv)
Type	string
Default	required
Example	`xxxx xxxx xxxx xxxx`

EMAIL_SMTP_HOST

SMTP server hostname.

Read by	emaid / `emaid/main.go:57` (MustEnv)
Type	string
Default	required
Example	`smtp.gmail.com`

EMAIL_SMTP_PORT

SMTP server port.

Read by	emaid / `emaid/main.go:61`
Type	string (port)
Default	`587`
Example	`587`

EMAIL_STRICT_AUTH

Reject inbound mail outright when SPF/DKIM/DMARC fails (fail-closed). When unset (default), failed-auth messages still reach the agent but flagged untrusted in the envelope. Spec 11/17.

Read by	emaid / `emaid/auth.go:64`
Type	bool (truthy strings: `1`, `true`, `yes`, `on`)
Default	`false`
Example	`true`

EMAIL_TRUSTED_AUTHSERV

Hostname of the upstream MTA whose Authentication-Results header emaid will trust (e.g. mx.google.com for Gmail). When unset, every inbound is classified untrusted (fail-closed default per spec 11/17). Added v0.40.5.

Read by	emaid / `emaid/auth.go:63`
Type	string (hostname, lowercased)
Default	unset
Example	`mx.google.com`

EMAIL_TRUSTED_DOMAINS

Comma-separated allowlist of sender domains that count as trusted (matched against the From-address domain after DMARC alignment). Empty entries ignored. Both this and EMAIL_TRUSTED_AUTHSERV must agree for a message to be trusted. Added v0.40.5.

Read by	emaid / `emaid/auth.go:68`
Type	comma-separated list
Default	unset (no domain allowlist)
Example	`example.com, partner.org`

twitd (X / Twitter)

TWITTER_2FA_SECRET

TOTP shared secret used to mint 2FA codes during automated login.

Read by	twitd / `twitd/src/main.ts:38`
Type	string (base32 TOTP secret)
Default	unset (login may fail when 2FA prompted)
Example	`JBSWY3DPEHPK3PXP`

TWITTER_AUTH_DIR

Persistent dir for cookies + cursor state across restarts.

Read by	twitd / `twitd/src/main.ts:30`
Type	path
Default	`$DATA_DIR/store/twitter-auth` or `/srv/data/store/twitter-auth`
Example	`/srv/data/arizuko_krons/store/twitter-auth`

TWITTER_EMAIL

Email associated with the X account; sometimes required as a fallback identifier during login.

Read by	twitd / `twitd/src/main.ts:37`
Type	string
Default	unset
Example	`bot@example.com`

TWITTER_PASSWORD

Password for the X account.

Read by	twitd / `twitd/src/main.ts:36`
Type	string
Default	unset
Example	`hunter2`

TWITTER_POLL_INTERVAL

Mentions/DM poll cadence. Accepts plain seconds (90), Ns, or Nm.

Read by	twitd / `twitd/src/main.ts:45`
Type	seconds (int or `Ns`/`Nm`)
Default	`90`
Example	`5m`

TWITTER_USERNAME

Username/handle for the X account.

Read by	twitd / `twitd/src/main.ts:35`
Type	string
Default	unset
Example	`arizuko_bot`

linkd (LinkedIn)

LINKEDIN_ACCESS_TOKEN

Pre-acquired OAuth access token; if unset, linkd runs an interactive auth flow.

Read by	linkd / `linkd/main.go:62`
Type	string
Default	`""`
Example	`AQX...`

LINKEDIN_API_BASE

Base URL of the LinkedIn REST API.

Read by	linkd / `linkd/main.go:69`
Type	URL
Default	`https://api.linkedin.com`
Example	`https://api.linkedin.com`

LINKEDIN_AUTO_PUBLISH

Allow the agent to publish posts without explicit operator confirmation.

Read by	linkd / `linkd/main.go:72`
Type	bool (`"true"`)
Default	`false`
Example	`true`

LINKEDIN_CLIENT_ID

OAuth client id of the registered LinkedIn app.

Read by	linkd / `linkd/main.go:60` (MustEnv)
Type	string
Default	required
Example	`77abcde`

LINKEDIN_CLIENT_SECRET

OAuth client secret of the registered LinkedIn app.

Read by	linkd / `linkd/main.go:61` (MustEnv)
Type	string
Default	required
Example	`xyz123`

LINKEDIN_OAUTH_BASE

Base URL for the LinkedIn OAuth endpoints.

Read by	linkd / `linkd/main.go:70`
Type	URL
Default	`https://www.linkedin.com`
Example	`https://www.linkedin.com`

LINKEDIN_POLL_INTERVAL

Cadence at which linkd polls for new messages.

Read by	linkd / `linkd/main.go:71`
Type	Go duration string
Default	`300s`
Example	`60s`

LINKEDIN_REFRESH_TOKEN

Refresh token used to mint new access tokens.

Read by	linkd / `linkd/main.go:63`
Type	string
Default	`""`
Example	`AQR...`

slakd (Slack)

SLACK_BOT_TOKEN

Slack xoxb- bot token used by the Web API and Events API client.

Read by	slakd / `slakd/main.go:57` (MustEnv)
Type	string
Default	required
Example	`xoxb-...`

SLACK_SIGNING_SECRET

Shared secret Slack uses to sign incoming event webhooks; slakd verifies X-Slack-Signature against it.

Read by	slakd / `slakd/main.go:58` (MustEnv)
Type	string
Default	required
Example	`8f742231...`

SLAKD_USERS_CACHE_TTL

TTL (seconds) of the Slack user-info cache; lower values cost more API quota.

Read by	slakd / `slakd/main.go:64`
Type	int (seconds)
Default	`900` (15 min)
Example	`3600`

split daemons (routd / runed / authd)

Three daemons split the work: routd (routing + message loop), runed (container spawn), and authd (auth + identity) — specs 5/E + 5/P. These vars wire them together.

AUTHD_URL

In-network base URL of authd. routd, runed, webd, and proxyd reach it for service-token exchange and JWKS. dashd uses it for both of those and as the backend for its /dash/authd/ page — the signing-key and session tables it reads over HTTP rather than by opening auth.db.

Read by	compose / `compose/compose.go:434` → routd, runed, webd, proxyd, dashd
Type	URL
Default	`http://authd:8080`
Example	`http://authd:8080`

AUTHD_SERVICE_KEY

Per-daemon shared secret a service daemon presents to authd to authenticate. Provisioned once per daemon and persisted to env/<daemon>.env; authd recognises them via AUTHD_SERVICE_KEYS.

Read by	compose / `compose/compose.go:428` → routd, runed
Type	string (secret)
Default	auto-provisioned at compose time
Example	`<random hex>`

AUTHD_SERVICE_KEYS

The principal=secret pairs authd accepts, one per service daemon. Rotating a key here invalidates that daemon's in-flight service tokens.

Read by	compose / `compose/compose.go:432` → authd
Type	string (comma-separated `principal=secret`)
Default	auto-built from the provisioned service keys
Example	`service:routd=...,service:runed=...`

RUNED_URL

In-network base URL of runed (the container-runner plane). routd dispatches runs to it.

Read by	routd / `routd/cmd/routd/main.go:40`
Type	URL
Default	`http://runed:8080`
Example	`http://runed:8080`

ROUTD_SERVICE_TOKEN

Service token routd presents to runed on each run dispatch.

Read by	routd / `routd/cmd/routd/main.go:78`
Type	string (token)
Default	minted against `AUTHD_URL` using `AUTHD_SERVICE_KEY`
Example	`<jwt>`

RUNED_SERVICE_TOKEN

Service token runed presents to authd when its broker authenticates.

Read by	runed / `runed/cmd/runed/main.go:74`
Type	string (token)
Default	minted against `AUTHD_URL` using `AUTHD_SERVICE_KEY`
Example	`<jwt>`

the store server

Every owner's tables live on one DynamoDB-protocol server per instance — ExtendDB over PostgreSQL, shipped as the extenddb package. Each daemon reads the five keys below and signs as itself, so the server's policy can bound what each one reaches. A daemon without DYNAMODB_URL refuses to start: there is no file to fall back to. Bring-up, including the one-off extenddb init run that mints the keys, is in INSTALL.md § The store server.

DYNAMODB_URL

The endpoint this instance is served from, and the switch: set, every daemon opens its owner there and none opens a file. On an instance whose rows are still in files, set it only after those rows have been copied across — the daemons would otherwise boot onto empty tables and look healthy.

Read by	every daemon / `objstore/dynstore/env.go`
Type	URL (TLS; the server refuses to start without it)
Default	`https://extenddb:18443` once the package is added; unset = files
Example	`https://extenddb:18443`

STORE_CA

The endpoint's certificate, base64-encoded, because a daemon has its environment and no file of its own. extenddb init generates it; a value that is not base64 is refused at boot rather than surfacing later as a handshake failure against a name nobody typed.

Read by	every daemon / `objstore/dynstore/env.go`
Type	string (base64 PEM)
Default	`""` = the system roots
Example	`LS0tLS1CRUdJTiBDRVJUSUZJ...`

AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY

One key pair per daemon, written into env/<daemon>.env and carried forward by every later arizuko generate. The pair is what the server's policy binds: routd reaches routd.*, dashd reaches routd's, onbod's and runed's, an adapter reaches its own prefix. A shared pair would make that boundary meaningless.

Read by	every daemon / `objstore/dynstore/env.go`, carried by `compose/compose.go`
Type	string (secret)
Default	none — an endpoint with no credential is refused at boot
Example	`<minted by extenddb manage>`

AWS_REGION

The region the request is signed for. Any value works against a self-hosted server as long as every daemon uses the same one; it matters only if the endpoint is Amazon's own.

Read by	every daemon / `objstore/dynstore/env.go`
Type	string
Default	`us-east-1`
Example	`us-east-1`

STORE_DB_PASSWORD / STORE_APP_PASSWORD

The two passwords the package mints: the first owns the instance's PostgreSQL role, the second is the role the server itself connects with. Neither has a meaning a human could supply, so arizuko packages add extenddb generates both into .env.

Read by	the `extenddb` compose fragment / `template/services/extenddb.yml`
Type	string (secret)
Default	generated on `packages add`
Example	`<random hex>`

observability — OTLP export

slog to journald is always on. Setting the OTLP endpoint additionally fans every slog event out to an OpenTelemetry collector (spec 5/O, library obs/). Unset = zero overhead. The litellm gateway reads the same three keys (OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_PROTOCOL, OTEL_EXPORTER_OTLP_HEADERS) and, when the endpoint is set, sends one span per model request to <endpoint>/v1/traces with token counts and cost — message content excluded.

OTEL_EXPORTER_OTLP_ENDPOINT

OTLP/HTTP collector endpoint. When set, every daemon's obs.Setup sends slog events to stderr and the collector; records carrying turn_id get a deterministic TraceID so one turn's events group. When empty, only the stderr JSON handler runs.

Read by	obs / `obs/obs.go:36` (every daemon's `main`)
Type	URL
Default	`""` = OTLP disabled
Example	`http://collector:4318`

Not documented here

davd — the daemon binary is upstream sigoden/dufs wrapped in alpine for the healthcheck (davd/Dockerfile). Its config is CLI args and dufs's own env vars, not arizuko's.
vited — static-file server image with no arizuko Go/TS code. Generated at compose time.
Test-only env vars — e.g. TEST_*, SMOKE_INSTANCE (Makefile-only). Omitted by scope.
the egress binary’s own flags — EGRESS_LISTEN, EGRESS_ALLOW, EGRESS_CLIENT are read by the proxy process, which runed configures with command-line flags rather than env. See components/egress.
local-development tooling — CRACKBOX_LIBEXEC and CRACKBOX_DATA_DIR are read by crackbox run --kvm, which production never runs.

environment variables

core — consumed by every Go daemon via core.LoadConfig

API_PORT

ARIZUKO_DEV

ASSISTANT_NAME

AUTH_BASE_URL

AUTH_SECRET

CONTAINER_IMAGE

CONTAINER_TIMEOUT

DATA_DIR

DEX_ISSUER

DEX_CLIENT_ID

DEX_CLIENT_SECRET

DISCORD_CLIENT_ID

DISCORD_CLIENT_SECRET

EGRESS_IMAGE

EGRESS_NETWORK_PREFIX

EGRESS_SUBNET

EGRESS_UPLINK_NETWORK

GITHUB_ALLOWED_ORG

GITHUB_CLIENT_ID

GITHUB_CLIENT_SECRET

GOOGLE_ALLOWED_EMAILS

GOOGLE_CLIENT_ID

GOOGLE_CLIENT_SECRET

HOST_APP_DIR

HOST_CODEX_DIR

HOST_DATA_DIR

IDLE_TIMEOUT

MAX_CONCURRENT_CONTAINERS

MAX_TURN_RETRY

MEDIA_ENABLED

MEDIA_MAX_FILE_BYTES

ONBOARDING_ENABLED

ONBOARDING_PLATFORMS

OBSERVE_WINDOW_MESSAGES

OBSERVE_WINDOW_CHARS

ENGAGEMENT_TTL

SECRETS_KEY

SEND_DISABLED_CHANNELS

SEND_DISABLED_GROUPS

TELEGRAM_BOT_TOKEN

TTS_BASE_URL

TTS_ENABLED

TTS_MODEL

TTS_TIMEOUT

TTS_VOICE

TZ

VIDEO_TRANSCRIPTION_ENABLED

VOICE_TRANSCRIPTION_ENABLED

WEB_HOST

WHISPER_BASE_URL

WHISPER_MODEL

container — agent spawn (read by runed when building runs)

ANTHROPIC_API_KEY

CLAUDE_CODE_OAUTH_TOKEN

LOG_LEVEL

chanreg

CHANNEL_REGISTER_ALLOW_PUBLIC

arizuko CLI (cmd/arizuko)

ARIZUKO_DATA_DIR

PREFIX

arizuko run (compose generation)

DAV_PORT

COMPOSE_PROFILES

WEB_PORT

WEB_PORT_ALIASES

WEBDAV_ENABLED

routd

PROACTIVE_ENABLED

PROACTIVE_SCAN_INTERVAL

PROACTIVE_SILENCE_MIN

PROACTIVE_SILENCE_MAX

PROACTIVE_COOLDOWN

PROACTIVE_BOT_QUIET

PROACTIVE_RECENT_ACTIVITY_MIN

proxyd

PROXYD_HMAC_SECRET retired

PROXYD_LISTEN

PUB_REDIRECT_URL

core — consumed by every Go daemon via `core.LoadConfig`

arizuko CLI (`cmd/arizuko`)