Skip to content
Ordermatic Docs

Environment Variables Reference

This document lists all environment variables required by each app and package in the ERP-Unlocked monorepo.

📁 Apps

Section titled “📁 Apps”

🖥️ Webapp (apps/webapp)

Section titled “🖥️ Webapp (apps/webapp)”

Required Environment Variables:

Terminal window
# Authentication (Clerk)
PUBLIC_CLERK_PUBLISHABLE_KEY=pk_...
CLERK_SECRET_KEY=sk_...


# Database
DATABASE_URL=postgresql://...


# Encryption
ENCRYPTION_KEY=your-encryption-key


# Redis
REDIS_URL=redis://...


# App Configuration
APP_ENV=development|staging|production
DEBUG_LOGGING=true|false


# Stripe Configuration (Usage-Based Billing)
STRIPE_SECRET_KEY=sk_...
STRIPE_PUBLISHABLE_KEY=pk_...
STRIPE_WEBHOOK_SECRET=whsec_...
STRIPE_API_VERSION=2026-02-25.clover
# Base subscription price ID ($500/month)
STRIPE_BASE_PRICE_ID=price_...
# Metered usage price ID (per line item charges)
STRIPE_USAGE_PRICE_ID=price_...


# Feature Flags (Flagsmith)
FLAGSMITH_ENVIRONMENT_KEY=ser...
FLAGSMITH_API_URL=https://flagsmith.yourdomain.com/api/v1


# R2 Storage (Cloudflare)
PUBLIC_R2_ACCOUNT_ID=your-account-id
PUBLIC_R2_BUCKET_NAME=your-bucket-name
R2_ENDPOINT_URL=https://<account-id>.r2.cloudflarestorage.com
R2_ACCESS_KEY_ID=your-access-key-id
R2_SECRET_ACCESS_KEY=your-secret-access-key
R2_BUCKET_NAME=your-bucket-name


# Email (Resend)
RESEND_API_KEY=re_...


# Inbound email (shared with the Cloudflare email worker and the Temporal pull path).
# Verifies X-Inbound-Email-Signature on /api/webhook/inbound-email, /api/alias/lookup,
# /api/email/triage and external attachment uploads to POST /api/pdf-documents.
# Unset, those routes return 503 and email ingestion stops.
INBOUND_EMAIL_SECRET=your-shared-hmac-secret


# GitHub Integration
GITHUB_TOKEN=ghp_...
GITHUB_REPO_OWNER=your-org
GITHUB_REPO_NAME=ordermatic


# Dagster / Temporal
DAGSTER_URL=http://localhost:3000
DAGSTER_GRAPHQL_URL=https://your-dagster-graphql-endpoint/graphql
DAGSTER_GRAPHQL_TOKEN=your_dagster_graphql_token
TEMPORAL_ADDRESS=localhost:7233
TEMPORAL_NAMESPACE=default


# Operational alerting (Better Stack incidents; routing lives in Better Stack)
BETTERSTACK_API_TOKEN=your_betterstack_api_token

Optional Environment Variables:

Terminal window
# Database Pool Configuration
DB_POOL_MAX=10
DB_POOL_IDLE_TIMEOUT=30000
DB_CONNECTION_TIMEOUT=10000

🛡️ Internal Admin Portal (apps/internal)

Section titled “🛡️ Internal Admin Portal (apps/internal)”

Required Environment Variables (/runtime/internal):

Terminal window
# Authentication (Clerk)
PUBLIC_CLERK_PUBLISHABLE_KEY=pk_...
CLERK_SECRET_KEY=sk_...


# Database & Redis
DATABASE_URL=postgresql://...
REDIS_URL=redis://...


# Temporal / Dagster
TEMPORAL_ADDRESS=localhost:7233
TEMPORAL_NAMESPACE=default
DAGSTER_URL=http://localhost:3000

⚙️ Python Temporal Worker (apps/temporal-worker)

Section titled “⚙️ Python Temporal Worker (apps/temporal-worker)”

Required Environment Variables (/runtime/temporal-worker):

Terminal window
# Temporal Server
TEMPORAL_ADDRESS=localhost:7233
TEMPORAL_NAMESPACE=default
TEMPORAL_TASK_QUEUE=pdf-extraction-queue


# Database & Redis
DATABASE_URL=postgresql://...
REDIS_URL=redis://...


# Cloudflare R2 Storage
R2_ENDPOINT_URL=https://<account-id>.r2.cloudflarestorage.com
R2_ACCESS_KEY_ID=your-access-key-id
R2_SECRET_ACCESS_KEY=your-secret-access-key
R2_BUCKET_NAME=your-bucket-name


# AI / OCR Services
GEMINI_API_KEY=your-gemini-key
GOOGLE_CLOUD_PROJECT=ordermatic-prod
LANGFUSE_PUBLIC_KEY=pk-lf-...
LANGFUSE_SECRET_KEY=sk-lf-...


# Feature Flags & Credentials
FLAGSMITH_ENVIRONMENT_KEY=ser...
FLAGSMITH_API_URL=https://flagsmith.ordermatic.co/api/v1
ENCRYPTION_KEY=your-encryption-key


# Search (Typesense)
TYPESENSE_HOST=localhost
TYPESENSE_PORT=8108
TYPESENSE_API_KEY=your-typesense-key

⚡ TypeScript Temporal Worker (apps/ts-temporal-worker)

Section titled “⚡ TypeScript Temporal Worker (apps/ts-temporal-worker)”

Required Environment Variables (/runtime/ts-temporal-worker):

Terminal window
# Temporal Server
TEMPORAL_ADDRESS=localhost:7233
TEMPORAL_NAMESPACE=default


# Database & Redis
DATABASE_URL=postgresql://...
REDIS_URL=redis://...


# ERP Credentials & Feature Flags
ENCRYPTION_KEY=your-encryption-key
FLAGSMITH_ENVIRONMENT_KEY=ser...
FLAGSMITH_API_URL=https://flagsmith.ordermatic.co/api/v1

🔄 Dagster Data Pipeline (apps/dagster)

Section titled “🔄 Dagster Data Pipeline (apps/dagster)”

Required Environment Variables (/runtime/dagster):

Terminal window
# Database & Encryption
DATABASE_URL=postgresql://...
ENCRYPTION_KEY=your-encryption-key


# Iceberg / Cloudflare R2 Warehouse
R2_ENDPOINT_URL=https://<account-id>.r2.cloudflarestorage.com
R2_ACCESS_KEY_ID=your-access-key-id
R2_SECRET_ACCESS_KEY=your-secret-access-key
R2_BUCKET_NAME=your-bucket-name


# DLT Runtime
RUNTIME__REQUEST_TIMEOUT=120


# Feature Flags & Search
FLAGSMITH_ENVIRONMENT_KEY=ser...
FLAGSMITH_API_URL=https://flagsmith.ordermatic.co/api/v1
TYPESENSE_HOST=localhost
TYPESENSE_PORT=8108
TYPESENSE_API_KEY=your-typesense-key

📦 Packages

Section titled “📦 Packages”

🗄️ Database (packages/db)

Section titled “🗄️ Database (packages/db)”

Required Environment Variables:

Terminal window
# Database Connection
DATABASE_URL=postgresql://...

Optional Environment Variables:

Terminal window
# Database Pool Configuration
DB_POOL_MAX=10
DB_POOL_IDLE_TIMEOUT=30000
DB_CONNECTION_TIMEOUT=10000


# Environment
NODE_ENV=development|production

📄 PDF Shared (packages/pdf-shared)

Section titled “📄 PDF Shared (packages/pdf-shared)”

Required Environment Variables:

Terminal window
# Redis
REDIS_URL=redis://...


# Database
DATABASE_URL=postgresql://...


# R2 Storage
R2_ENDPOINT_URL=https://...
R2_ACCESS_KEY_ID=your-access-key
R2_SECRET_ACCESS_KEY=your-secret-key
R2_BUCKET_NAME=your-bucket-name


# Gemini AI
GEMINI_API_KEY=your-gemini-key


# Logging
LOG_LEVEL=INFO|DEBUG|WARNING|ERROR

Optional Environment Variables:

Terminal window
# PDF Processing
MAX_PARALLEL_CHUNKS=2


# CORS
CORS_ORIGINS=*|comma-separated-origins

🛠️ Utils (packages/utils)

Section titled “🛠️ Utils (packages/utils)”

No environment variables required.

🎨 UI (packages/ui)

Section titled “🎨 UI (packages/ui)”

No environment variables required.

🔧 CI/CD Environment Variables

Section titled “🔧 CI/CD Environment Variables”

GitHub Secrets & Infisical CI Paths

Section titled “GitHub Secrets & Infisical CI Paths”

GitHub Actions stores only 3 bootstrap secrets (INFISICAL_UNIVERSAL_AUTH_CLIENT_ID, INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET, INFISICAL_PROJECT_ID) plus the ordermatic-release-bot GitHub App credentials (RELEASE_APP_ID, RELEASE_APP_PRIVATE_KEY). All other CI secrets are fetched dynamically from Infisical under /ci/* paths (infrastructure/infisical/secrets-map.json).

See Infisical CI Secrets for the full /ci/* path-to-workflow mapping:

Terminal window
# 3 Bootstrap GitHub Repository Secrets:
INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=...
INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=...
INFISICAL_PROJECT_ID=...


# Fetched from Infisical /ci/* paths at workflow runtime:
# /ci/shared       -> TURBO_TOKEN
# /ci/cloudflare   -> CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_PAGES_API_TOKEN
# /ci/gcp          -> GCP_SA_KEY
# /ci/clerk        -> PUBLIC_CLERK_PUBLISHABLE_KEY, CLERK_SECRET_KEY
# /ci/posthog      -> PUBLIC_POSTHOG_KEY, PUBLIC_POSTHOG_HOST
# /ci/eval         -> EVAL_SERVICE_TOKEN, LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, R2_*
# /ci/flagsmith    -> FLAGSMITH_API_URL, FLAGSMITH_ADMIN_EMAIL, FLAGSMITH_ADMIN_PASSWORD, FLAGSMITH_ENVIRONMENT_KEY
# /ci/e2e          -> STAGING_TEST_EMAIL, STAGING_TEST_PASSWORD, E2E_FLAG_OVERRIDE_SECRET
# /ci/database     -> DATABASE_URL
# /ci/integrations -> LINEAR_API_KEY, GEMINI_API_KEY, STAGING_WEBAPP_URL

🚀 Deployment Environment Variables

Section titled “🚀 Deployment Environment Variables”

Cloudflare Pages (Docs Site)

Section titled “Cloudflare Pages (Docs Site)”

Production:

Terminal window
PUBLIC_WEBAPP_URL=https://app.ordermatic.co

Staging:

Terminal window
PUBLIC_WEBAPP_URL=https://staging.ordermatic.co

📋 Environment Setup Checklist

Section titled “📋 Environment Setup Checklist”

Development Setup

Section titled “Development Setup”
  • Copy .env.example to .env (and apps/webapp/.env.example to apps/webapp/.env)
  • Set up PostgreSQL database
  • Set up Redis instance
  • Configure R2 storage credentials (R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_ENDPOINT_URL, R2_BUCKET_NAME)
  • Get Gemini API key
  • Set up Clerk authentication
  • Configure Dagster and Temporal (TEMPORAL_ADDRESS)

Production Setup

Section titled “Production Setup”
  • Set all required environment variables in Infisical (/runtime/*) for the target environment (infrastructure/infisical/secrets-map.json)
  • Configure the 3 INFISICAL_* bootstrap secrets in GitHub Secrets (Infisical CI Secrets)
  • Set up Cloudflare Pages environment variables
  • Verify all webhook URLs are correct
  • Test database connections
  • Verify Redis connectivity
  • Test R2 storage access

Staging Setup

Section titled “Staging Setup”
  • Populate staging environment variables in Infisical (/runtime/* and /ci/*)
  • Update URLs to point to *.ordermatic.co staging services
  • Configure staging-specific API keys
  • Test all integrations

🔍 Troubleshooting

Section titled “🔍 Troubleshooting”

Common Issues

Section titled “Common Issues”
  1. Missing DATABASE_URL: Check PostgreSQL connection string
  2. Redis Connection Failed: Verify Redis URL and connectivity
  3. PDF Processing Errors: Check GEMINI_API_KEY and TEMPORAL_ADDRESS
  4. Authentication Issues: Verify Clerk keys are correct
  5. R2 Storage Errors: Check R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, and bucket permissions

Validation Commands

Section titled “Validation Commands”
Terminal window
# Test database connection
psql $DATABASE_URL -c "SELECT 1;"


# Test Redis connection
redis-cli -u $REDIS_URL ping


# Test R2 access
aws s3 ls s3://$R2_BUCKET_NAME --endpoint-url $R2_ENDPOINT_URL


# Validate environment variables
node -e "console.log(process.env.DATABASE_URL ? 'DB OK' : 'DB MISSING')"