Variables and secrets

Per-environment variables, references between services, sealed variables and history.

Edit variables

The Variables tab of a service lists its variables for the selected environment. Raw mode accepts a .env file (comments and the export prefix are ignored). Names follow [A-Z_][A-Z0-9_]*.

A change applies to the next deployment: after saving, the “Redeploy” button restarts the service.

References between services

A value can reference a variable of another service of the project: ${postgres.DATABASE_URL} (the ${{postgres.DATABASE_URL}} syntax is accepted too). References are resolved at deploy time, up to 5 levels deep; a loop is reported with the name of the variable at fault.

DATABASE_URL=${postgres.DATABASE_URL}
REDIS_URL=${redis.REDIS_URL}

The shared variables of an environment (Project settings → Variables) are injected into all its services, a service’s own variable winning; reference one with ${shared.NAME}. The service name shared is reserved.

Sealed variables, history, copy

  • Sealed: the value is never shown again in the console (write-only). A sealed variable cannot be unsealed.
  • History: every change is kept; a previous value can be restored.
  • Copy: the variables of one environment can be copied to another.

Values are encrypted (AES-256-GCM) in the database and decrypted at deploy time.

Variables provided by Kapapra

  • PORT: the service port (8080 by default), cannot be overridden by a variable;
  • KAPAPRA_SERVICE_NAME, KAPAPRA_ENVIRONMENT_NAME, KAPAPRA_DEPLOYMENT_ID;
  • KAPAPRA_PUBLIC_DOMAIN (web services), KAPAPRA_PRIVATE_DOMAIN, KAPAPRA_GIT_COMMIT_SHA when they exist.
Variables and secrets — Kapapra docs