Environment configuration
Configure the application by responsibility while keeping secrets out of source control and examples.
The repository does not currently track one complete root .env.example. Deployment-specific examples live under deploy/railway/, while the engine’s Config class reads additional variables.
Core API and database#
ENV=production
DATABASE_URL="$SCRUMPULSE_DATABASE_URL"
ENCRYPTION_KEY=<fernet-key>
FRONTEND_URL=https://<dashboard-host>
CORS_ALLOWED_ORIGINS=https://<dashboard-host>
ALLOWED_BASE_URL_HOSTS=api.taiga.io,<tenant>.atlassian.net
RUN_TRIGGER_ENABLED=true
ALLOW_INSECURE_DEV_AUTH=false
ALLOW_INSECURE_DEV_CRYPTO=false
ENABLE_IN_PROCESS_SCHEDULER=false
MAX_REQUEST_BODY_BYTES=1048576
Generate the Fernet key in a trusted local shell and store it in the deployment secret manager. Losing or changing the key prevents decryption of stored board tokens.
Web and Clerk#
NEXT_PUBLIC_API_URL=https://<api-host>
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=<clerk-publishable-key>
CLERK_SECRET_KEY=<clerk-secret-key>
CLERK_JWT_ISSUER=https://<clerk-issuer>
CLERK_AUTHORIZED_PARTIES=https://<dashboard-host>
NEXT_PUBLIC_CLERK_SIGN_IN_URL=/sign-in
NEXT_PUBLIC_CLERK_SIGN_UP_URL=/sign-up
NEXT_PUBLIC_SITE_URL=https://<dashboard-host>
Values beginning with NEXT_PUBLIC_ are included in the browser build. Never place a secret in one of those variables.
Production startup fails closed when provider hosts are not allowlisted or the Clerk issuer cannot be pinned. List only the exact Jira and Taiga API hostnames the deployment must contact. Serverless runtimes disable the in-process scheduler automatically; use the external scheduler described in the deployment guide.
SES bounce protection#
Hosted production requires SES_SNS_TOPIC_ARN to pin the public SNS webhook to one AWS topic and a randomly generated SCRUM_SUPPRESSION_API_KEY of at least 32 characters. Store the system key in the API and execution-engine secret stores; do not expose it to browsers or tenant administrators. Keep SES_WEBHOOK_VERIFY_DISABLED=false outside isolated local tests.
The engine reads the central list only when SCRUM_SUPPRESSION_API_URL and SCRUM_SUPPRESSION_API_KEY are both configured. Point the URL to /api/email/suppressions on the API host.
Stripe#
Configure STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_ID_PRO, and STRIPE_PRICE_ID_TEAM in the deployment secret manager. Use the provider values for the intended environment; do not paste them into a committed file or shell history.
Configure all required Stripe values together or keep billing disabled. The readiness audit detects partial billing configuration.
Engine and providers#
Provider and execution variables include board type, provider base URL, project identifiers, provider tokens, write switches, per-action modes, cycle flags, project scope, action caps, cooldowns, and audit paths. Use execution/run_scrum_master_cycle.py as the authoritative engine contract.
Common safe defaults include:
BOARD_TYPE=taiga
PROJECT_SCOPE=single
TAIGA_WRITE_ENABLED=false
TAIGA_ALLOW_TRANSITIONS=false
TAIGA_ALLOW_CLOSE=false
TAIGA_ALLOW_DELETE=false
SCRUM_AI_ENABLED=false
Optional integrations#
Optional groups cover Mattermost, Slack, Teams, SMTP email, OpenAI, Upstash Vector, GitHub, GitLab, n8n, and chat-webhook signing.
Store secrets in the platform credential or secret system. Never put tokens in workflow text fields, committed examples, public documentation, or support logs.