Environment Variables

This document lists all environment variables used by the application, organized by service.

Infrastructure Management

Environment variables are managed through Terraform and SOPS-encrypted files:

File	Purpose
infra/staging/, infra/production/, infra/reviews/	Non-sensitive config vars per environment, through infra/modules/app
infra/ga-reports-common.env	Secrets shared across all environments
infra/ga-reports.env	Production-only secrets
infra/ga-reports-staging.env	Secrets for staging and the review apps

Plaintext config vars come from the shared app module plus the extra_env each root passes; secrets come from the SOPS files, which every environment reads, so a secret is rotated in one place.

Core Application

Variable	Description	Source
SECRET_KEY_BASE	Rails secret key for sessions and attr_encrypted	SOPS (env-specific)
ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY	Active Record encryption primary key	SOPS (env-specific)
ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY	Active Record encryption deterministic key	SOPS (env-specific)
ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT	Active Record encryption key derivation salt	SOPS (env-specific)
DATABASE_URL	PostgreSQL connection string	CloudNativePG addon
REDIS_URL	Redis connection string	Dragonfly addon
REDIS_TIMEOUT	Redis read/write timeout in seconds, and the connect timeout for Sidekiq (default: 3). The request-path pools cap their connect timeout at 1s — see lib/reports/redis.rb	Optional
MEMCACHED_SERVERS	Memcached servers for the production cache store	memcached addon
LOG_LEVEL	Application log level	Terraform (common)
RAILS_SERVE_STATIC_FILES	Serve static files from Rails	Terraform (common)

Payment Processing

Stripe

Variable	Description	Source
STRIPE_PUBLISHABLE_KEY	Stripe public key for frontend	SOPS (env-specific)
STRIPE_SECRET_KEY	Stripe API secret key	SOPS (env-specific)
STRIPE_WEBHOOK_SECRET_V2	Webhook signing secret	SOPS (env-specific)
STRIPE_API_VERSION	Pinned Stripe API version (default: 2019-03-14)	Optional

PayPal

Variable	Description	Source
PAYPAL_ACCOUNT	Default PayPal receiver email	Terraform (env-specific)
PAYPAL_ACCOUNT_SI	Slovenian PayPal account	Terraform (env-specific)

Donations Module

Variable	Description	Source
DONATIONS_HOST	Hostname for donations emails	Terraform (env-specific)
DONATIONS_PROPERTY	Google Analytics property ID	Terraform (env-specific)
DONATIONS_SUBDOMAIN	Subdomain routing constraint for the donations module (default: subscriptions)	Terraform (staging only)

External Services

AWS (S3 Storage)

Variable	Description	Source
AWS_REGION	AWS region	SOPS (common)
AWS_ACCESS_KEY_ID	AWS access key	SOPS (common)
AWS_SECRET_ACCESS_KEY	AWS secret key	SOPS (common)

SendGrid (Email)

Variable	Description	Source
SENDGRID_API_KEY	SendGrid API key	SOPS (env-specific)
SENDGRID_PASSWORD	SendGrid SMTP password	SOPS (production)
SENDGRID_USERNAME	SendGrid SMTP username (always "apikey")	Terraform (common)
EMAIL_SENDER	Default sender email address	Terraform (common)

OneSignal (Push Notifications)

Variable	Description	Source
ONE_SIGNAL_ORG_KEY	OneSignal organization API key (used by OrgAPI to list apps and provision v2 keys)	SOPS (common)

Slack

Variable	Description	Source
SLACK_CAMPAIGNS_WEBHOOK	Webhook for campaign notifications	SOPS (common)

Open Exchange Rates

Variable	Description	Source
OXR_API_KEY	Open Exchange Rates API key	SOPS (common)

Dailymotion (production only)

Variable	Description	Source
DAILYMOTION_CLIENT_ID	Dailymotion API client ID	SOPS (production)
DAILYMOTION_CLIENT_SECRET	Dailymotion API client secret	SOPS (production)

IP Info

Variable	Description	Source
IP_INFO_TOKEN	IP geolocation API token	SOPS (common)

Authentication

Google OAuth

Variable	Description	Source
GOOGLE_OAUTH_CLIENT_ID	Google OAuth client ID	SOPS (common)
GOOGLE_OAUTH_CLIENT_SECRET	Google OAuth client secret	SOPS (common)
GOOGLE_OAUTH_REDIRECT_URI	Overrides the OAuth callback URL. Review apps only: the Google login relay on staging (https://reports-staging.aleteia.org/oauth/relay)	infra/reviews
REVIEW_SLUG	The review app's pr-<n> slug, sent as the prefix of the OAuth state so the relay knows where to forward the callback	infra/reviews

Facebook

Used only by FacebookScrapeJob to force Open Graph re-scrapes of published articles via the Graph API. There is no Facebook login. The Meta app can stay in development mode: app-token scrape calls work without a live review.

Variable	Description	Source
FACEBOOK_APP_ID	Facebook application ID	SOPS (env-specific)
FACEBOOK_APP_SECRET	Facebook application secret	SOPS (env-specific)

TikTok

Variable	Description	Source
TIKTOK_CLIENT_KEY	TikTok client key	SOPS (common)
TIKTOK_CLIENT_SECRET	TikTok client secret	SOPS (common)

Firebase

Variable	Description	Source
GOOGLE_APPLICATION_CREDENTIALS	Firebase service account JSON	Terraform (env-specific)
FIREBASE_CONTINUE_URL	OAuth redirect URL	Terraform (env-specific)

WordPress Integration

Variable	Description	Source
WP_PRE_SHARED_KEY	Pre-shared key for JWT auth (falls back to secret_key_base)	SOPS (common)
WORDPRESS_USERNAME	WordPress API username	SOPS (common)
WORDPRESS_PASSWORD	WordPress API password	SOPS (env-specific)
WORDPRESS_USE_PRODUCTION	Force production WordPress backends outside production (staging backends are used by default in dev/staging)	Optional

Monitoring

Rollbar

Variable	Description	Source
ROLLBAR_ACCESS_TOKEN	Server-side access token	SOPS (common)
ROLLBAR_CLIENT_TOKEN	Client-side access token	SOPS (common)
ROLLBAR_ENV	Environment name	Terraform (staging)

Datadog

Variable	Description	Source
DD_API_KEY	Datadog API key	SOPS (common)
DD_ENV	Environment name	Terraform (env-specific)
DD_TRACE_ENABLED	Enable APM tracing	Terraform (production)
DD_SERVICE	Service name	Terraform (common)
DD_SITE	Datadog site (datadoghq.eu)	Terraform (common)

Note: The cluster agent adds the standard unified-service tags on top of these.

Performance

Variable	Description	Source
WEB_CONCURRENCY	Number of Puma workers	Terraform (env-specific)
WORKER_CONCURRENCY	Sidekiq worker threads	Terraform (production)
RAILS_MAX_THREADS	Puma threads per worker	Terraform (staging)
RAILS_MIN_THREADS	Puma minimum threads (default: same as RAILS_MAX_THREADS)	Optional

Application Settings

Variable	Description	Source
CORS_DOMAIN	Allowed CORS domain	Terraform (common)
ALLOWED_SCRAPER_DOMAIN	Domain for scraper access	Terraform (common)
ASSETS_HOST	CDN hostname for assets; read at runtime only, never while assets are compiled — see Vite Frontend	Terraform (env-specific)
MAILER_HOST	Host for links in emails and download URLs (default: downloads.aleteia.org)	Terraform (env-specific)
RACK_ATTACK_BLOCKED_IPS	Comma-separated list of IPs blocked at application level (empty by default; set through extra_env when needed)	Optional
RACK_ATTACK_SUBSCRIPTIONS_LIMIT	Throttle limit per IP per minute on POST /subscriptions (default: 5)	Optional
RACK_ATTACK_LOOKUPS_PER_EMAIL	Throttle limit per email address per minute on the subscription lookup endpoints (default: 12)	Optional
RACK_ATTACK_LOOKUPS_PER_MINUTE	Throttle limit per minute on the subscription lookup endpoints as a whole (default: 120)	Optional
SWAGGER_USER	Basic auth username for /api-docs (default: ale)	Optional
SWAGGER_PASS	Basic auth password for /api-docs (default: teia)	Optional

Development Variables

These are only needed for local development (see example.env):

Variable	Default	Description
POSTGRES_HOST	127.0.0.1	PostgreSQL host
POSTGRES_PORT	5432	PostgreSQL port
POSTGRES_USER	postgres	PostgreSQL user
POSTGRES_PASSWORD	postgres	PostgreSQL password
PGGSSENCMODE	disable	Required on macOS to avoid Spring segfaults

Debug Toggles

Set any of these (any non-empty value) to enable verbose output while debugging:

Variable	Description
NETWORK_DEBUG	HTTParty debug output for JSON API clients
OAUTH_DEBUG	HTTParty debug output for Dailymotion and TikTok OAuth flows
FACEBOOK_DEBUG	Koala (Facebook Graph API) debug output
AUTH_DEBUG	Log level for the Avo AuthorizationService
BACKTRACE	Show full unsilenced backtraces

Deprecated Variables

The following variables have been removed:

Variable	Reason
CLOUDINARY_CLOUD_NAME	Cloudinary integration removed
CLOUDINARY_API_KEY	Cloudinary integration removed
CLOUDINARY_API_SECRET	Cloudinary integration removed
GENDER_API_KEY	Gender API integration removed
LOCALEAPP_KEY	LocaleApp integration removed
NEW_RELIC_LICENSE_KEY	New Relic agent disabled
NEW_RELIC_DISTRIBUTED_TRACING_ENABLED	New Relic agent disabled
NEW_RELIC_LOG	New Relic agent disabled
SENDINBLUE_API_KEY	Sendinblue integration removed
TOPTEN_PROFILE	TopTen integration removed
TOPTEN_PROFILE_ALETEIA	TopTen integration removed
TOPTEN_PROFILE_FORHER	TopTen integration removed
OPTIMIZER_CONTAINER	Google Optimizer removed
RECAPTCHA_V3_SITE_KEY	reCAPTCHA integration removed
RECAPTCHA_V3_SECRET_KEY	reCAPTCHA integration removed
RECAPTCHA_SITE_KEY	reCAPTCHA integration removed
RECAPTCHA_SECRET_KEY	reCAPTCHA integration removed
MAILCHIMP_API_KEY	Mailchimp integration removed
FACEBOOK_REALTIME_VERIFY_TOKEN	Facebook webhook verification removed
IGNORE_SCRAPE_ERRORS	Flag removed — Facebook scrape errors are now always swallowed
SIDEKIQ_USERNAME	Sidekiq Web UI auth removed
SIDEKIQ_PASSWORD	Sidekiq Web UI auth removed
RAILS_MASTER_KEY	Rails encrypted credentials no longer used — all secrets come from environment variables
ONE_SIGNAL_APP_ID	OneSignal v1 client removed — only ONE_SIGNAL_ORG_KEY is read
ONE_SIGNAL_REST_KEY	OneSignal v1 client removed — only ONE_SIGNAL_ORG_KEY is read
ONE_SIGNAL_USER_KEY	OneSignal v1 client removed — only ONE_SIGNAL_ORG_KEY is read
HEROKU_APP_NAME	Heroku removed — the asset host comes from ASSETS_HOST alone
MEMCACHIER_SERVERS	Heroku addon removed — the cluster sets MEMCACHED_SERVERS
MEMCACHIER_USERNAME	Heroku addon removed — the in-cluster memcached takes no credentials
MEMCACHIER_PASSWORD	Heroku addon removed — the in-cluster memcached takes no credentials
RAILS_SERVE_STATIC_FILES	Redundant — production.rb enables public_file_server unconditionally
MAGNIFICAT_WEBSERVICE_OWNER	Magnificat error notification replaced by logging
MAGNIFICAT_URL	Magnificat daily prayers integration removed
PRAYER_POST_UPDATES	Magnificat daily prayers integration removed
MAILCHIMP_CONFIRM_ADDRESS	Mailchimp integration removed
SKIP_REDIS_NAMESPACE	Migration flag for dropping redis-namespace
WORDPRESS_USE_SSL	Unused constant removed

Migration from Rails Secrets

As of this version, the application uses environment variables instead of config/secrets.yml.enc.

Key Changes

1. All Rails.application.secrets.key! calls replaced with ENV.fetch('KEY')
2. attr_encrypted models use Rails.application.secret_key_base.first(32) for encryption
3. Optional secrets use ENV['KEY'] without fetch

Encryption Key Compatibility

The SECRET_KEY_BASE must remain consistent across deployments to decrypt existing attr_encrypted data. If changed, encrypted fields in the following models will become unreadable:

• Tiktok::Account.access_token and refresh_token

Likewise, the ACTIVE_RECORD_ENCRYPTION_* keys must remain consistent to decrypt Active Record encrypted attributes (e.g. OneSignalApplication.v2_api_key).