Developers

Environment configuration

Configure the application by responsibility while keeping secrets out of source control and examples.

Last updated August 7, 2026

The repository does not currently track one complete root .env.example. Deployment-specific examples live under deploy/railway/, while the engine’s Config class reads additional variables.

Core API and database#

ENV=production
DATABASE_URL="$SCRUMPULSE_DATABASE_URL"
ENCRYPTION_KEY=<fernet-key>
FRONTEND_URL=https://<dashboard-host>
CORS_ALLOWED_ORIGINS=https://<dashboard-host>
RUN_TRIGGER_ENABLED=true
ALLOW_INSECURE_DEV_AUTH=false
ALLOW_INSECURE_DEV_CRYPTO=false

Generate the Fernet key in a trusted local shell and store it in the deployment secret manager. Losing or changing the key prevents decryption of stored board tokens.

Web and Clerk#

NEXT_PUBLIC_API_URL=https://<api-host>
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=<clerk-publishable-key>
CLERK_SECRET_KEY=<clerk-secret-key>
NEXT_PUBLIC_CLERK_SIGN_IN_URL=/sign-in
NEXT_PUBLIC_CLERK_SIGN_UP_URL=/sign-up
NEXT_PUBLIC_SITE_URL=https://<dashboard-host>

Values beginning with NEXT_PUBLIC_ are included in the browser build. Never place a secret in one of those variables.

Stripe#

Configure STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_ID_PRO, and STRIPE_PRICE_ID_TEAM in the deployment secret manager. Use the provider values for the intended environment; do not paste them into a committed file or shell history.

Configure all required Stripe values together or keep billing disabled. The readiness audit detects partial billing configuration.

Engine and providers#

Provider and execution variables include board type, provider base URL, project identifiers, provider tokens, write switches, per-action modes, cycle flags, project scope, action caps, cooldowns, and audit paths. Use execution/run_scrum_master_cycle.py as the authoritative engine contract.

Common safe defaults include:

BOARD_TYPE=taiga
PROJECT_SCOPE=single
TAIGA_WRITE_ENABLED=false
TAIGA_ALLOW_TRANSITIONS=false
TAIGA_ALLOW_CLOSE=false
TAIGA_ALLOW_DELETE=false
SCRUM_AI_ENABLED=false

Optional integrations#

Optional groups cover Mattermost, Slack, Teams, SMTP email, OpenAI, Upstash Vector, GitHub, GitLab, n8n, and chat-webhook signing.

Store secrets in the platform credential or secret system. Never put tokens in workflow text fields, committed examples, public documentation, or support logs.