Environment Variable Audit Report

1. Overview

This audit analyzed the codebase, .env.example files, and configuration files to identify all environment variables in use. The goal is to standardize naming and identify secrets for the 1Password vault.

2. Inconsistencies & Consolidation Recommendations

Cloudflare R2 (Object Storage)

Current State:

• R2_ENDPOINT vs R2_ENDPOINT_URL (Both used, sometimes with fallback logic)
• R2_ACCESS_KEY vs R2_ACCESS_KEY_ID
• R2_SECRET_KEY vs R2_SECRET_ACCESS_KEY
• Buckets: PUBLIC_R2_BUCKET_NAME, R2_BUCKET_NAME, R2_DATA_CATALOG_BUCKET, R2_PRODUCT_IMAGES_BUCKET

Recommendation:

• Standardize on AWS SDK compatible naming:
  • R2_ENDPOINT_URL (matches Pydantic settings)
  • R2_ACCESS_KEY_ID
  • R2_SECRET_ACCESS_KEY
• Buckets should be explicit:
  • R2_BUCKET_NAME (Default/Main bucket)
  • R2_DATA_CATALOG_BUCKET (Specific for Iceberg/Data)
  • R2_PRODUCT_IMAGES_BUCKET (Specific for Images)

Observability

Current State:

• LOGTAIL_SOURCE_TOKEN vs BETTER_STACK_SOURCE_TOKEN (Better Stack acquired Logtail)
• SIGNOZ_API_KEY vs SIGNOZ_INGESTION_KEY (in docs/plans)
• OTEL_EXPORTER_OTLP_ENDPOINT (Standard)

Recommendation:

• Use LOGTAIL_SOURCE_TOKEN as it’s currently in code, or migrate all to BETTER_STACK_SOURCE_TOKEN.
• Stick to standard OTEL variables (OTEL_EXPORTER_OTLP_*).

API Keys

Current State:

• TRIGGER_SECRET_KEY, TRIGGER_API_KEY, TRIGGER_API_TOKEN (Inconsistent naming)
• EMAIL_API_URL (Internal service URL)

Recommendation:

• Standardize on TRIGGER_SECRET_KEY (matches SDK usually) or TRIGGER_API_KEY.

3. Secret Inventory (for 1Password)

Infrastructure

Variable	Description
HETZNER_API_TOKEN	Hetzner Cloud API Token
SSH_PRIVATE_KEY	SSH Private Key for servers
SSH_PUBLIC_KEY	SSH Public Key for servers
COOLIFY_API_TOKEN	Coolify API Token
CLOUDFLARE_API_TOKEN	Cloudflare API Token (DNS/R2)

Production / Shared

Variable	Description
DATABASE_URL	PostgreSQL Connection String
ENCRYPTION_KEY	Key for encrypting ERP credentials in DB
REDIS_URL	Redis Connection String
CLERK_SECRET_KEY	Clerk Auth Secret
PUBLIC_CLERK_PUBLISHABLE_KEY	Clerk Auth Public Key
R2_ACCESS_KEY_ID	R2 Storage Access Key
R2_SECRET_ACCESS_KEY	R2 Storage Secret Key
R2_ENDPOINT_URL	R2 Storage Endpoint
R2_BUCKET_NAME	Default Bucket Name
GEMINI_API_KEY	Google Gemini AI Key
RESEND_API_KEY	Resend Email API Key
PDF_PROCESSOR_TOKEN	Internal Token for PDF Service Auth
OTEL_EXPORTER_OTLP_ENDPOINT	OpenTelemetry Endpoint
OTEL_EXPORTER_OTLP_HEADERS	OpenTelemetry Headers (Auth)
LOGTAIL_SOURCE_TOKEN	Logtail/BetterStack Ingestion Token
TYPESENSE_ADMIN_API_KEY	Typesense Admin Key (ETL operations)
TYPESENSE_SEARCH_API_KEY	Typesense Search Key (read-only, webapp)
TYPESENSE_HOST	Typesense Host
LANGFUSE_PUBLIC_KEY	Langfuse Public Key
LANGFUSE_SECRET_KEY	Langfuse Secret Key
TRIGGER_SECRET_KEY	Trigger.dev API Key
STRIPE_SECRET_KEY	Stripe Secret Key
STRIPE_WEBHOOK_SECRET	Stripe Webhook Secret

App Specific

Variable	App	Description
GITHUB_TOKEN	Webapp	GitHub PAT for integration
SLACK_WEBHOOK_URL	Webapp	Slack Webhook for alerts
P21_API_URL	Dagster	Prophet21 API URL (Optional override)
P21_CLIENT_ID	Dagster	Prophet21 Client ID (Optional override)
P21_CLIENT_SECRET	Dagster	Prophet21 Client Secret (Optional override)

4. Environment Variable Matrix

Variable	Webapp	PDF API	PDF Worker	Dagster	Notes
DATABASE_URL	✅	✅	✅	✅	Shared
REDIS_URL	✅	-	✅	-	Shared
R2_ACCESS_KEY_ID	✅	✅	✅	✅	Inconsistent naming in places
CLERK_SECRET_KEY	✅	-	-	-
GEMINI_API_KEY	✅	✅	✅	-
PDF_PROCESSOR_TOKEN	✅	✅	✅	-	Internal Auth