> For the complete documentation index, see [llms.txt](https://docs.alpha-security.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.alpha-security.app/reference/environment-vars.md).

# Environment Variables

Complete reference for all environment variables. See also the [deployment guide](/deployment/environment.md) for practical setup instructions.

## Server

### Required

| Variable             | Description                                                                   |
| -------------------- | ----------------------------------------------------------------------------- |
| `ALPHA_DATABASE_URL` | PostgreSQL connection string (e.g. `postgres://al:pass@localhost:5432/alpha`) |
| `ALPHA_JWT_SECRET`   | Signing key for auth tokens. Minimum 16 characters.                           |

### Optional

| Variable                      | Default          | Description                                                                       |
| ----------------------------- | ---------------- | --------------------------------------------------------------------------------- |
| `NODE_ENV`                    | `development`    | `development`, `production`, or `test`                                            |
| `ALPHA_HOST`                  | `0.0.0.0`        | Server bind address                                                               |
| `ALPHA_PORT`                  | `8080`           | Server bind port                                                                  |
| `ALPHA_JWT_EXPIRES_IN`        | `8h`             | Auth token TTL (e.g. `1h`, `30m`, `7d`)                                           |
| `ALPHA_RETENTION_CHECK_HOURS` | `6`              | Interval for retention policy checks (hours)                                      |
| `ALPHA_TOTP_ISSUER`           | `Alpha`          | MFA issuer name shown in authenticator apps                                       |
| `ALPHA_TOTP_ENCRYPTION_KEY`   | -                | 32-byte hex (64 chars) for encrypting TOTP secrets. Required only if MFA is used. |
| `ALPHA_OBJECT_STORE`          | `fs`             | Artifact backend: `fs` or `s3`                                                    |
| `ALPHA_OBJECT_STORE_PATH`     | `./data/objects` | Local path when using `fs` backend                                                |
| `ALPHA_S3_ENDPOINT`           | -                | S3-compatible endpoint (required for `s3` backend)                                |
| `ALPHA_S3_ACCESS_KEY`         | -                | S3 access key                                                                     |
| `ALPHA_S3_SECRET_KEY`         | -                | S3 secret key                                                                     |

## Docker Compose

These are used by the Postgres container in `docker-compose.prod.yml`:

| Variable            | Description                                                                   |
| ------------------- | ----------------------------------------------------------------------------- |
| `POSTGRES_PASSWORD` | Postgres container password. Must match the password in `ALPHA_DATABASE_URL`. |