Environment variables & secrets

Read all your config from environment variables. Plain values go in the dashboard. Secrets go under Settings, then Secrets.

Your app should read its configuration from environment variables, never from a committed .env file (that file is not deployed). There are two places to set them, depending on how sensitive the value is.

Plain variables

For non-sensitive config (feature flags, a public URL, a log level), add a variable in your app's dashboard. It is injected into your app at runtime.

Secrets

For anything sensitive, an API key, a token, a password, save asecret. Secrets are encrypted at rest with a key unique to your account, and they are only ever available to the apps you choose.

Add the secret under Settings, then Secrets.
It is encrypted and isolated to your account.
Connect it to the apps that need it, under any variable name you like. You can do that from the secret itself or from the app's Variables tab.
It shows up as an environment variable in just those apps.

Dockhold does not inject every secret into every app. You connect each secret to specific apps. If one app is ever compromised, it can only see the secrets you connected to it, nothing else.

Reading them in your app

Bound secrets and variables are plain environment variables. Read them the usual way:

import os

# Set in the dashboard or connected from Secrets
OPENAI_API_KEY = os.getenv("OPENAI_API_KEY")
DATABASE_URL = os.getenv("DATABASE_URL")  # injected by Dockhold

What Dockhold sets for you

Some variables are already there. You do not set them and you cannot change them.

PORT is the port to listen on. Read it, don't hardcode a number.
DOCKHOLD_APP_URL is your app's own address withhttps:// on the front, likehttps://my-app-a1b2c3.dockhold.app. Use it to build links back to itself.
DOCKHOLD_APP_HOSTNAME is the same address without thehttps://, like my-app-a1b2c3.dockhold.app. Some frameworks want a bare hostname, usually for a list of hostnames they will answer to.
DATABASE_URL appears when you add a managed database, andDATA_DIR when you turn on app storage.

Your app cannot work its own address out on its own. Inside a container the system hostname is an id assigned when the container starts, not the name people type in a browser, so reading it gets you something likec654b80c733d. That is why we hand the real one over.

Moving an app here from somewhere else? You do not have to change your code. Whatever variable your app already reads, add it in the dashboard and set its value to $(DOCKHOLD_APP_URL) (or$(DOCKHOLD_APP_HOSTNAME) for the bare form) and we will fill it in at start-up. Laravel apps set APP_URL that way; an app arriving from another host can keep reading that host's variable name.

A note for front-end builds

A build can't see your dashboard variables, and a browser bundle is public. So never put a secret behind a public build-time prefix. For a front-end single-page app, read browser config at runtime fromwindow.__APP_CONFIG__ rather than baking it into the build. SeeMissing environment variablesif a value isn't showing up.

Every change is logged

Every read of a secret is written to a tamper-evident audit trail. The trail is integrity-checked nightly, and you are alerted if a platform administrator ever touches your secrets.