Environment Variables & Secrets¶
Configuration is split across three places that are not kept in sync automatically:
the Coolify app environment (VPS), the two Vercel projects, and the local .env used by
the Python pipeline (including the Windows scrape box). See
Deployment for where each of these runs.
Coolify app environment (VPS — outreach daemon & cron jobs)¶
| Variable | Secret? | Purpose |
|---|---|---|
SENDERS_CSV_B64 |
yes | Base64-encoded sender pool CSV; its presence is what switches the container into production (non-shadow) mode |
DATABASE_URL |
yes | Warehouse connection (read-write) |
NVIDIA_API_KEY, GEMINI_API_KEY (also OPENROUTER_API_KEY) |
yes | LLM providers for outreach drafting/reply analysis |
OUTREACH_LLM_PROVIDER, OUTREACH_MODELS |
no | Force a specific provider/model |
BRIGHTDATA_API_KEY, BRIGHTDATA_ZONE (also BRIGHTDATA_PROXY) |
yes | Web-unlocker/proxy access |
BD_BUDGET, BRIGHTDATA_BROWSER_BUDGET, BRIGHTDATA_BROWSER_DEADLINE_SECONDS, BRIGHTDATA_BROWSER_ZONE |
no | Budget/behavior caps for paid fetching |
COMMISSION_CONFIRM_SECRET |
yes | Signs commission-confirmation links sent to contacts |
OUTREACH_MAIL_RELAY_URL, OUTREACH_MAIL_RELAY_KEY |
yes | Points the daemon at internal-api's /mail?resource=relay SMTP-relay workaround (see Internal API and History & Migrations) |
OUTREACH_AREA, OUTREACH_POSTAL, OUTREACH_SENDER_COMPANY |
no | Sender identity fields used in outbound messages |
WARMUP_SEEDS_CSV_B64 |
yes | Base64-encoded seed mailbox list for warmup |
WEBFORM_SUBMIT |
no | 1 = live form submissions, 0 = dry-run |
WEBFORM_LIMIT, WEBFORM_TIER, WEBFORM_SOURCE, WEBFORM_DAILY_CAP, DAILY_CAP, DISCOVER_LIMIT, POLL_INTERVAL, POLL_SINCE, FETCH_CACHE_DIR |
no | Various job tuning knobs |
Vercel — client-api¶
| Variable | Secret? | Purpose |
|---|---|---|
DATABASE_URL_RO |
yes | Read-only warehouse connection, scoped to the client_buildings view |
Vercel — internal-api¶
| Variable | Secret? | Purpose |
|---|---|---|
DATABASE_URL |
yes | Full read-write warehouse connection |
MAIL_ACCOUNTS |
yes | JSON array of mailbox configs (IMAP/SMTP credentials) for the /mail endpoint |
INTERNAL_API_KEY |
yes | The shared secret every internal-api route checks (header X-Internal-Key or ?key=) |
Local .env (Python pipeline — not the same as the Coolify environment)¶
| Variable | Purpose |
|---|---|
NVIDIA_API_KEY / GEMINI_API_KEY / OPENROUTER_API_KEY |
LLM providers |
DATABASE_URL |
Warehouse (read-write, for local pipeline runs) |
LINKEDIN_SESSIONS, WHATSAPP_WEB_SESSIONS, GOOGLE_VOICE_SESSIONS |
Authenticated operator sessions for those outreach channels |
Note
Non-secret configuration (aggregator HTTP settings, proxy backend config, SERP config,
sender pool, retention settings) lives in gitignored files under config/*.yaml/*.json,
each with a checked-in .example template. Only genuine secrets belong in .env/the
Coolify environment.
Windows scrape box uses its own local .env
The scheduled PowerShell jobs (see Scheduled Jobs) read the repo's
local .env file, not the Coolify environment. The two must be kept in sync manually
for any shared variable.