> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rerun.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> Every variable of .env, what it does, and what happens when it is empty.

Rerun reads its settings from `.env` at the root of your clone. `.env.example` lists every variable with a comment, in the groups below. Four values are required, three are generated for you by `node scripts/self-host-check.mjs`, and the rest are optional.

> [!NOTE]
>
> Variables starting with `NEXT_PUBLIC_` are read by the browser, so they are baked into the app when its image is built. After changing one, run `docker compose up -d --build`. Any other change only needs `docker compose up -d`.

## The address people open

| Variable | Default | What it does |
| - | - | - |
| `NEXT_PUBLIC_APP_URL` | `http://localhost:3000` | **Required.** The address people open in their browser, without a trailing slash. Sign-in links, invitations and the servers you pair all point there. |
| `RERUN_APP_PORT` | `3000` | The port of this machine docker compose publishes the app on. |

## Supabase

| Variable | Default | What it does |
| - | - | - |
| `NEXT_PUBLIC_SUPABASE_URL` | empty | **Required.** The project URL from **Project settings > API**, or `http://localhost:54421` for the local stack. |
| `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY` | empty | **Required.** The publishable key (anon key on older projects). Safe in the browser. |
| `SUPABASE_SECRET_KEY` | empty | **Required.** The secret key (service\_role on older projects). It never reaches the browser. |

## The engine of your first workspace

| Variable | Default | What it does |
| - | - | - |
| `RERUN_ENGINE_API_KEY` | generated | The key shared by the app and the engine docker compose starts next to it. The app calls the engine with it, and the engine calls the app back with it. |
| `RERUN_ENGINE_PORT` | `3001` | The port docker compose publishes that engine on, on this machine. |
| `RERUN_ENGINE_BROWSER_URL` | `http://localhost:3001` | The address a browser reaches that engine at, to watch a coworker's screen. On a server, its `https` domain. See [On a server](https://docs.rerun.build/self-host/install.md#on-a-server). |

## AI

| Variable | Default | What it does |
| - | - | - |
| `OPENROUTER_API_KEY` | empty | Runs the Foreman, the helpers behind it (company research, naming, ideas) and the [Rerun models](https://docs.rerun.build/self-host/models.md) every coworker starts on. Without it, the Foreman does not answer and coworkers need another AI provider. |
| `RERUN_EMBED_API_KEY` | empty | An OpenRouter key for embeddings. It turns on semantic search of the services catalog and of the coworkers' memories. Without it, both fall back to keyword search. |

## Admins

| Variable | Default | What it does |
| - | - | - |
| `ADMIN_EMAILS` | empty | Comma-separated emails that see the admin switches in the app. Empty means nobody. See [Administration](https://docs.rerun.build/self-host/administration.md). |

## Secrets

The two secrets are generated by `self-host-check.mjs` when empty. Keep them stable: changing one invalidates what it already signed.

| Variable | Default | What it does |
| - | - | - |
| `FOREMAN_HUB_TOKEN_SECRET` | generated | Signs the token the Foreman calls the app with. |
| `FOREMAN_HUB_TOKEN_REQUIRED` | `1` | Makes the app refuse a Foreman call without a valid token. `0` lets such a call through and logs it. Leave it at `1`. |
| `BOARD_IMAGE_SECRET` | generated | Signs the board images the app captures for sharing. |

## Optional services

Each one switches a feature on. Empty means the feature is off, and the rest of Rerun works.

| Variable | Default | What it does |
| - | - | - |
| `COMPOSIO_API_KEY` | empty | Connects 2,000+ apps by OAuth through [Composio](https://composio.dev). See [Composio](https://docs.rerun.build/self-host/services.md#composio). |
| `BRAVE_SEARCH_API_KEY` | empty | Web search for the coworkers, through the [Brave Search API](https://brave.com/search/api). |
| `FIRECRAWL_API_KEY` | empty | Reading websites through [Firecrawl](https://firecrawl.dev), including your company site when the Foreman builds the Brain. |
| `APIFY_TOKEN` | empty | LinkedIn and Google Maps research during onboarding, through [Apify](https://apify.com). |
| `NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN` | empty | Product analytics with [PostHog](https://posthog.com). Off when empty, and the cookie banner only shows when it is set. |

## Set by docker compose

`docker-compose.yml` sets these itself. You do not put them in `.env`.

| Variable | Value | What it does |
| - | - | - |
| `RERUN_ENGINE_URL` | `http://engine:3000` | Where the app reaches the engine of the first workspace, inside Docker. |
| `RERUN_HUB_BASE_URL` | `http://app:3000` | Where that engine calls the app back. |
| `RERUN_LOG_LEVEL` | `info` | How much the engine logs: `fatal`, `error`, `warn`, `info`, `debug` or `trace`. You can set it in `.env`. |

## Sign-in

| Variable | Default | What it does |
| - | - | - |
| `NEXT_PUBLIC_OAUTH_PROVIDERS` | empty | `google`, `apple` or `google,apple` adds those buttons to the sign-in page. Configure each provider on your Supabase project first. |
| `NEXT_PUBLIC_TURNSTILE_SITE_KEY` | empty | The site key of a Cloudflare Turnstile captcha on sign-up. |
| `TURNSTILE_SECRET_KEY` | empty | Its secret key. Without it, no captcha. |

The two `NEXT_PUBLIC_` values are baked into the app when it is built: rebuild with `docker compose up -d --build` after changing them.

## Embeddings

Also not in `.env.example`, and rarely needed.

| Variable | Default | What it does |
| - | - | - |
| `RERUN_EMBED_BASE_URL` | `https://openrouter.ai/api/v1` | Any OpenAI-compatible endpoint for embeddings. |
| `RERUN_EMBED_MODEL` | `openai/text-embedding-3-small` | The embedding model. The seeded catalog is embedded with this one, in 1536 dimensions: keep it unless you re-embed the catalog. |

## Engine variables

An engine started by hand, on a [server](https://docs.rerun.build/self-host/servers.md), reads these.

| Variable | Default | What it does |
| - | - | - |
| `RERUN_HUB_URL` | empty | The address of your app. With a pairing token, the server attaches itself there. |
| `RERUN_PAIR_TOKEN` | empty | The one-time token from **Servers > Add server**. |
| `RERUN_PUBLIC_URL` | empty | The address the app reaches this server at. Without it, the app uses the address the request came from, on port 3000. |
| `RERUN_API_KEY` | generated | The engine's key. When empty, a paired server makes one up and keeps it in `/data/engine.key`. |
| `RERUN_DATA_DIR` | `/data` in the image | Where the engine keeps everything. Mount a volume there. |
| `RERUN_PORT` | `3000` | The port the engine listens on. |
| `RERUN_DESKTOP` | on | `off` turns off the desktop screen and the computer tools. |
| `RERUN_LOG_LEVEL` | `info` | How much the engine logs. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.