The deployment .env file lives in the deployment directory and is created from .env.example by soln install with mode 0600. Keep it at 0600 and never commit it.
Deployment Identity
| Variable | Meaning |
|---|
SOLN_DEPLOYMENT_TARGET | local for this-computer deployments, server for server deployments |
SOLN_DEPLOYMENT_MODE | singleMachine or externalServices |
CP_URL | Control Plane URL used for registration, releases, and tokens |
CONTROL_PLANE_ISSUER | issuer expected in Control Plane tokens |
TENANT_ID, RUNTIME_ID, AGENT_ID | Runtime registration identity |
RUNTIME_ORIGIN | exact HTTPS Origin of the Runtime |
AGENT_SECRET | Runtime registration credential, shown once in the Control Plane |
AGENT_CONFIG_PATH | path of the Agent configuration file |
Product Help
| Variable | Meaning |
|---|
HELP_CENTER_BASE_URL | origin of the Soln Help Center site. Set it when the Help Center is hosted on another origin so help answers cite absolute links; empty keeps citations site-relative. |
Local Storage
| Variable | Meaning |
|---|
SOLN_DATA_AT_REST_ENCRYPTED | must be true once storage encryption is enabled |
SOLN_DATA_ROOT | absolute, non-root, protected directory for tenant data |
RUNTIME_BIND_ADDRESS | 127.0.0.1 for this-computer deployments |
RUNTIME_BIND_PORT | Installer-selected loopback port; prefers 8443 on this computer and 8080 on servers. This-computer port must match RUNTIME_ORIGIN. |
Data Services
| Variable | Meaning |
|---|
DATABASE_URL | PostgreSQL connection string; external databases require sslmode=verify-full |
TEMPORAL_ADDRESS | Temporal endpoint used by the Workflow Worker |
FILES_STORAGE_BACKEND | minio for the bundled or external S3-compatible storage |
FILES_MINIO_ENDPOINT, FILES_MINIO_BROWSER_ENDPOINT | server and browser endpoints |
FILES_MINIO_BUCKET, FILES_MINIO_ACCESS_KEY, FILES_MINIO_SECRET_KEY | bucket and credentials |
FILES_MINIO_SERVER_SIDE_ENCRYPTION | required as AES256 for external storage; configure tenant MinIO KES with Google Cloud KMS |
Secrets Generated by the Installer
Missing or placeholder values are generated automatically during installation:
RUNTIME_SESSION_ENCRYPTION_KEYSOLN_BACKUP_ENCRYPTION_KEYTENANT_RUNTIME_INTERNAL_SECRETLUNA_TOOL_APPROVAL_SECRET- the bundled PostgreSQL and MinIO passwords in
singleMachine mode
soln doctor validates the length and separation of the encryption keys, the internal secret length, the environment file permissions, and every placeholder left behind.
Tunnel
| Variable | Meaning |
|---|
TUNNEL_CONNECTOR | none or cloudflare |
CLOUDFLARE_TUNNEL_ID | UUID of the Named Tunnel |
CLOUDFLARE_METRICS_BIND_ADDRESS, CLOUDFLARE_METRICS_PORT | loopback metrics endpoint |
SOLN_DOCKER_IMAGE_STORE_PATH: the actual host path of Docker’s containerd image store, used for upgrade capacity checks. It does not configure Docker. See Storage and Capacity Management.