Environment variable reference

Every Community setting lives in community/.env inside your installation directory. The installer generates it with private permissions (600), creates all secrets, and preserves existing values when you run it again.

Tip: Use helpin configure for URLs, ports, email, and the AI provider key. Edit .env directly for everything else, then run helpin restart to apply your changes.

Public URLs and ports

Variable	Default	Description
`APP_BASE_URL`	`http://localhost:8085`	Public origin of the staff dashboard. Used in emails, links, and the GitHub App manifest.
`PUBLIC_WIDGET_URL`	`http://localhost:8085`	Public origin visitors' browsers use for the chat widget API.
`PUBLIC_SDK_URL`	`http://localhost:8085/sdk/lib.js`	Public URL of the widget loader script.
`PUBLIC_STORAGE_URL`	`http://localhost:9005`	Public origin of object storage. It must be reachable over HTTPS on a public install.
`BIND_ADDRESS`	`127.0.0.1`	Interface the published ports bind to. Keep loopback behind a reverse proxy.
`DASHBOARD_PORT`	`8085`	Dashboard, API, and widget port.
`HELPCENTER_PORT`	`8086`	Public help center port.
`STORAGE_PORT`	`9005`	Object storage port.
`COMMUNITY_TRUSTED_PROXY_CIDR`	`127.0.0.1/32`	Exact address or CIDR of your reverse proxy as the ingress sees it. Never use `0.0.0.0/0`.

Built-in HTTPS proxy

Variable	Default	Description
`HELPIN_PROXY`	Empty (local)	`builtin` runs the bundled Caddy proxy. `external` means you run your own. Set by `helpin configure`.
`ACME_EMAIL`	Empty	Optional email for certificate expiry notices (built-in only).
`PROXY_HTTP_PORT`, `PROXY_HTTPS_PORT`	`80`, `443`	Host ports the built-in proxy listens on. Certificates need 80 or 443 to be reachable from the internet.
`EDGE_SUBNET`	`172.30.255.0/28`	Private network between the proxy and Helpin. Change it only if it collides with an existing network.
`EDGE_IP_RANGE`	`172.30.255.8/29`	Addresses given to the other services on that network.
`EDGE_PROXY_IP`	`172.30.255.2`	The proxy's fixed address, which Helpin trusts. It must be inside `EDGE_SUBNET` and outside `EDGE_IP_RANGE`.

With the built-in proxy, COMMUNITY_TRUSTED_PROXY_CIDR is set to EDGE_PROXY_IP/32 for you.

Product and accounts

Variable	Default	Description
`HELPIN_ENABLED_MODULES`	`support,docs,agents,pm,crm,automation`	Product areas available on this server. Support requires Docs. Workspace roles still apply.
`AUTH_EMAIL_VERIFICATION_REQUIRED`	`false`	Sends verification emails and shows the verification UI. Requires working application email.
`HELPIN_ADMIN_EMAILS`	Empty	Comma-separated addresses that are always server admins once verified.
`SETUP_SUCCESS_ENABLED`	Edition default (on)	Set `false` to hide the workspace Setup guide.
`DEMO_VIEWER_EMAIL`	Empty	Account visitors of `/demo` are signed in as, read-only. Leave empty to disable `/demo`.
`DEMO_REQUIRE_EMAIL`	`false`	Ask demo visitors for their email first.
`DEMO_LEAD_WEBHOOK_URL`	Empty	Receives emails captured on `/demo`.

Application email

Variable	Default	Description
`SMTP_HOST`	Empty	SMTP server. Leave empty to manage email in Settings → System status instead.
`SMTP_PORT`	`587`	SMTP port.
`SMTP_USERNAME`, `SMTP_PASSWORD`	Empty	Set both for authenticated delivery, or neither for a trusted relay.
`SMTP_FROM`	Empty	Sender address. Required when SMTP is set.
`SMTP_TLS_MODE`	`starttls`	`starttls`, `tls` (implicit TLS), or `none` for an unauthenticated local relay only.

See Application email for setup and testing.

AI and knowledge search

Agent connections are configured per workspace in Settings → AI, not here. These server keys are optional.

Variable	Default	Description
`OPENAI_API_KEY`	Empty	Server-wide key for knowledge embeddings. It also appears as a shared AI connection in every workspace.
`OPENAI_BASE_URL`	Empty	OpenAI-compatible API base, including `/v1`.
`OPENAI_EMBEDDING_MODEL`	`text-embedding-3-small`	Embedding model. It must return 1,536 dimensions.
`OPENROUTER_API_KEY`	Empty	Server-wide OpenRouter key. Used for embeddings when `OPENAI_API_KEY` is empty.
`ANTHROPIC_API_KEY`	Empty	Server-wide Anthropic key, shared with every workspace. Anthropic has no embeddings API.
`CHATGPT_CONNECTIONS_ENABLED`, `AGENT_RUNTIME_CHATGPT_ENABLED`	`false`	Allow ChatGPT sign-in connections. Enable both together.

External tools (MCP) for agents

Variable	Default	Description
`AGENT_RUNTIME_MCP_ALLOW_HTTP`	`false`	Allow plain-HTTP MCP servers.
`AGENT_RUNTIME_MCP_ALLOW_PRIVATE_NETWORKS`	`false`	Allow MCP servers on private or LAN addresses.
`AGENT_RUNTIME_MCP_ALLOWED_HOSTS`	Empty	Explicit host allowlist for MCP servers.

GitHub

Variable	Description
`GITHUB_APP_ID`, `GITHUB_APP_SLUG`, `GITHUB_APP_PRIVATE_KEY`, `GITHUB_APP_WEBHOOK_SECRET`	Pin an existing GitHub App instead of creating one from the app. The private key may be PEM, escaped PEM, or base64.
`GITHUB_APP_CLIENT_ID`, `GITHUB_APP_CLIENT_SECRET`	Optional OAuth credentials for a pinned App.

Limits and observability

Variable	Default	Description
`AUTHENTICATED_RATE_LIMIT_PER_MINUTE`	`1200`	Authenticated API and MCP requests per user per minute. `0` disables the limit.
`EXPENSIVE_RATE_LIMIT_PER_MINUTE`	`120`	Expensive actions per minute, such as agent runs, re-indexing, and generation. `0` disables the limit.
`SENTRY_DSN`	Empty	Opt in to error reporting to your own Sentry project. Nothing is sent by default.

Secrets and encryption keys

The installer generates these. Don't change or lose them.

Variable	Protects
`JWT_SECRET`	Session tokens
`INTERNAL_API_SECRET`, `AGENT_RUNTIME_SERVICE_TOKEN`	Private service-to-service calls
`AI_CONNECTION_ENCRYPTION_KEY`	Stored AI provider keys
`AGENT_RUNTIME_MODEL_CREDENTIAL_ENCRYPTION_KEY`, `AGENT_RUNTIME_MCP_CREDENTIAL_ENCRYPTION_KEY`	Credentials held by Agent Runtime
`CRM_ENCRYPTION_KEY`	Mail and calendar tokens, the SMTP password saved in the app, 2FA and import secrets
`GIT_OAUTH_ENCRYPTION_KEY`	Git provider tokens and GitHub App secrets
`POSTGRES_PASSWORD`, `*_DB_PASSWORD`, `REDIS_PASSWORD`	Database and cache access
`GARAGE_ACCESS_KEY`, `GARAGE_SECRET_KEY`, `GARAGE_RPC_SECRET`	Object storage

Warning: If you rotate an encryption key only in .env, everything already encrypted with it becomes unreadable. Back up .env with your data, and never regenerate keys to fix a connectivity problem.

Release pins

HELPIN_VERSION, AGENT_RUNTIME_VERSION, and COMPOSE_PROJECT_NAME are managed by the CLI. Changing a version here doesn't upgrade anything. Use helpin upgrade instead. Keep COMPOSE_PROJECT_NAME unchanged, because it identifies your data volumes.

Was this article helpful?