Real PostgreSQL connection string. Unset means the file-backed PGlite store, which is a single-process, single-host database.

`memory` forces an ephemeral in-memory store. Used by tests; never set in production.

Public base URL of this deployment. OAuth redirect URIs are built from it; without it they are guessed from the request's forwarded origin.

systemd user unit name, used to read this service's own journal. Defaults to `paxx-web`.

Minimum level this process logs. Defaults to `info` in production, `debug` otherwise.

Optional log file to tail when journald is unavailable.

Where the ops scripts write the deployment and backup journals. Defaults to ~/.paxx/state.

Age after which the newest successful database backup counts as stale. Defaults to 48.

Set by the deploy script so the running process reports the commit it deployed.

Set by the deploy script to identify the release directory this process runs from.

Turns off the per-request connector read cache, so every read reaches its provider. An escape hatch, not a tuning knob — set only if a provider's data looks stale within a single page render, which would be a bug in the read allowlist.

Logs one line per connector read (HIT/MISS/PASSTHROUGH/UNKEYED). Diagnostic only, and deliberately noisy — it exists to count provider reads per render.

Seals integration credentials at rest. Without it no Connect flow can store anything — sealing fails rather than writing plaintext.

Seals Google OAuth tokens and PKCE verifiers. Without it the real Google connector is never selected and both account slots run the mock.

Where the two managed encryption keys are written when they are created from the Integration Hub rather than set above. Defaults to `packages/db/.paxx-keys`, which is inside the release directory a deploy replaces — so it becomes required once PAXX_RELEASE_ID shows this process runs from a release, unless both keys come from the environment. Losing it loses every credential sealed with those keys, and nothing software-side can repair that.

Read-only PAT, and an override: since M10 this can also be stored from the Integration Hub, so `unset` here does not by itself mean the connector is on mock data — the Hub is authoritative for that.

Read-only API token, and an override — like GITHUB_TOKEN, it can instead be stored from the Integration Hub.

Paperclip read credentials. Both this and PAPERCLIP_COMPANY_ID are needed before the real, read-only connector is selected.

Paperclip company scope. Pairs with PAPERCLIP_API_KEY.

Overrides Paperclip's API base URL. Defaults to its local API on this host.

Headless alternative to connecting Obsidian from the browser. A stored credential overrides it.

Obsidian Local REST API key, for the headless path only.

Operator ceiling on vault paths. Every grant the app issues is capped by it; unset means the whole vault.

Operator-provisioned OAuth client. Without it the Spotify Connect button is not offered.

Pairs with SPOTIFY_CLIENT_ID.

Overrides the derived Spotify callback URL. Spotify matches it byte-for-byte.

`open-meteo` (keyless, the default) or `mock` to force fixtures.

Weather snapshot cache TTL. Defaults to 600.

Operator-provisioned OAuth client. Needed, with its secret and PAXX_TOKEN_ENCRYPTION_KEY, before the real Google connector is selected.

Pairs with GOOGLE_OAUTH_CLIENT_ID.

Overrides the derived Google callback URL. Google matches it exactly; a mismatch is the usual reason consent fails.

Separate opt-in for Paperclip writes. Without `true` the provisioning pipeline can plan and dry-run but never execute.

The only directory provisioning may create or remove anything in. Must exist, be writable, and not be a symlink; the executor never creates it.

Pins provisioned projects to a Paperclip environment. Unset means Paperclip picks.

Overrides where Paperclip puts per-task worktrees. Leave unset to use its own default.