Configuration

Rerun reads its settings from .env at the root of your clone. .env.example lists every variable with a comment, in the groups below. Four values are required, three are generated for you by node scripts/self-host-check.mjs, and the rest are optional.

Variables starting with NEXT_PUBLIC_ are read by the browser, so they are baked into the app when its image is built. After changing one, run docker compose up -d --build. Any other change only needs docker compose up -d.

The address people open

Variable	Default	What it does
`NEXT_PUBLIC_APP_URL`	`http://localhost:3000`	Required. The address people open in their browser, without a trailing slash. Sign-in links, invitations and the servers you pair all point there.
`RERUN_APP_PORT`	`3000`	The port of this machine docker compose publishes the app on.

Supabase

Variable	Default	What it does
`NEXT_PUBLIC_SUPABASE_URL`	empty	Required. The project URL from Project settings > API, or `http://localhost:54421` for the local stack.
`NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY`	empty	Required. The publishable key (anon key on older projects). Safe in the browser.
`SUPABASE_SECRET_KEY`	empty	Required. The secret key (service_role on older projects). It never reaches the browser.

The engine of your first workspace

Variable	Default	What it does
`RERUN_ENGINE_API_KEY`	generated	The key shared by the app and the engine docker compose starts next to it. The app calls the engine with it, and the engine calls the app back with it.
`RERUN_ENGINE_PORT`	`3001`	The port docker compose publishes that engine on, on this machine.
`RERUN_ENGINE_BROWSER_URL`	`http://localhost:3001`	The address a browser reaches that engine at, to watch a coworker’s screen. On a server, its `https` domain. See On a server.

AI

Variable	Default	What it does
`OPENROUTER_API_KEY`	empty	Runs the Foreman, the helpers behind it (company research, naming, ideas) and the Rerun models every coworker starts on. Without it, the Foreman does not answer and coworkers need another AI provider.
`RERUN_EMBED_API_KEY`	empty	An OpenRouter key for embeddings. It turns on semantic search of the services catalog and of the coworkers’ memories. Without it, both fall back to keyword search.

Admins

Variable	Default	What it does
`ADMIN_EMAILS`	empty	Comma-separated emails that see the admin switches in the app. Empty means nobody. See Administration.

Secrets

The two secrets are generated by self-host-check.mjs when empty. Keep them stable: changing one invalidates what it already signed.

Variable	Default	What it does
`FOREMAN_HUB_TOKEN_SECRET`	generated	Signs the token the Foreman calls the app with.
`FOREMAN_HUB_TOKEN_REQUIRED`	`1`	Makes the app refuse a Foreman call without a valid token. `0` lets such a call through and logs it. Leave it at `1`.
`BOARD_IMAGE_SECRET`	generated	Signs the board images the app captures for sharing.

Optional services

Each one switches a feature on. Empty means the feature is off, and the rest of Rerun works.

Variable	Default	What it does
`COMPOSIO_API_KEY`	empty	Connects 2,000+ apps by OAuth through Composio. See Composio.
`BRAVE_SEARCH_API_KEY`	empty	Web search for the coworkers, through the Brave Search API.
`FIRECRAWL_API_KEY`	empty	Reading websites through Firecrawl, including your company site when the Foreman builds the Brain.
`APIFY_TOKEN`	empty	LinkedIn and Google Maps research during onboarding, through Apify.
`NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN`	empty	Product analytics with PostHog. Off when empty, and the cookie banner only shows when it is set.

Set by docker compose

docker-compose.yml sets these itself. You do not put them in .env.

Variable	Value	What it does
`RERUN_ENGINE_URL`	`http://engine:3000`	Where the app reaches the engine of the first workspace, inside Docker.
`RERUN_HUB_BASE_URL`	`http://app:3000`	Where that engine calls the app back.
`RERUN_LOG_LEVEL`	`info`	How much the engine logs: `fatal`, `error`, `warn`, `info`, `debug` or `trace`. You can set it in `.env`.

Variable	Default	What it does
`NEXT_PUBLIC_OAUTH_PROVIDERS`	empty	`google`, `apple` or `google,apple` adds those buttons to the sign-in page. Configure each provider on your Supabase project first.
`NEXT_PUBLIC_TURNSTILE_SITE_KEY`	empty	The site key of a Cloudflare Turnstile captcha on sign-up.
`TURNSTILE_SECRET_KEY`	empty	Its secret key. Without it, no captcha.

The two NEXT_PUBLIC_ values are baked into the app when it is built: rebuild with docker compose up -d --build after changing them.

Embeddings

Also not in .env.example, and rarely needed.

Variable	Default	What it does
`RERUN_EMBED_BASE_URL`	`https://openrouter.ai/api/v1`	Any OpenAI-compatible endpoint for embeddings.
`RERUN_EMBED_MODEL`	`openai/text-embedding-3-small`	The embedding model. The seeded catalog is embedded with this one, in 1536 dimensions: keep it unless you re-embed the catalog.

Engine variables

An engine started by hand, on a server, reads these.

Variable	Default	What it does
`RERUN_HUB_URL`	empty	The address of your app. With a pairing token, the server attaches itself there.
`RERUN_PAIR_TOKEN`	empty	The one-time token from Servers > Add server.
`RERUN_PUBLIC_URL`	empty	The address the app reaches this server at. Without it, the app uses the address the request came from, on port 3000.
`RERUN_API_KEY`	generated	The engine’s key. When empty, a paired server makes one up and keeps it in `/data/engine.key`.
`RERUN_DATA_DIR`	`/data` in the image	Where the engine keeps everything. Mount a volume there.
`RERUN_PORT`	`3000`	The port the engine listens on.
`RERUN_DESKTOP`	on	`off` turns off the desktop screen and the computer tools.
`RERUN_LOG_LEVEL`	`info`	How much the engine logs.

Get started

Run it

Reference

The address people open

Supabase

The engine of your first workspace

AI

Admins

Secrets

Optional services

Set by docker compose

Embeddings

Engine variables

​The address people open

​Supabase

​The engine of your first workspace

​AI

​Admins

​Secrets

​Optional services

​Set by docker compose

​Sign-in

​Embeddings

​Engine variables

The address people open

Supabase

The engine of your first workspace

AI

Admins

Secrets

Optional services

Set by docker compose

Sign-in

Embeddings

Engine variables