Deployment Environment Variables

Complete reference for all deployment-related environment variables

🔐 Deployment Environment Variables

All environment variables required for deployment infrastructure

Local Development (`.env.local`)

# =============================================================================
# GitLab Integration
# =============================================================================
GITLAB_URL=https://gitlab.com
GITLAB_API_TOKEN=glpat-xxxxxxxxxxxxx

# =============================================================================
# Cloudflare Integration
# =============================================================================
CLOUDFLARE_ACCOUNT_ID=xxxxxxxxxxxxxxx
CLOUDFLARE_API_TOKEN=xxxxxxxxxxxxxxx

# =============================================================================
# Railway (optional - for CLI deployment)
# =============================================================================
RAILWAY_TOKEN=xxxxxxxxxxxxxxx

# =============================================================================
# MongoDB
# =============================================================================
MONGODB_CONNECTION_STRING=mongodb+srv://user:[email protected]/database

Railway Service Variables

All Services

Variable	Required	Description	Example
`NODE_ENV`	Yes	Environment mode	`production`
`PORT`	Auto	Port (set by Railway)	`3000`
`JWT_SECRET`	Yes	JWT signing key	`your-secret-key`
`MONGODB_CONNECTION_STRING`	Yes	MongoDB Atlas URI	`mongodb+srv://...`
`ALLOWED_ORIGINS`	Yes	CORS origins	`https://gograb.space,...`

backend-api Specific

Variable	Required	Description
`JWT_SECRET`	Yes	JWT signing secret
`JWT_EXPIRATION`	No	Token expiry (default: 1d)
`BCRYPT_ROUNDS`	No	Password hash rounds (default: 10)

backend-ai-api Specific

Variable	Required	Description
`ANTHROPIC_API_KEY`	Yes	Claude API key
`OPENAI_API_KEY`	No	OpenAI API key
`GITLAB_URL`	Yes	GitLab instance URL
`GITLAB_API_TOKEN`	Yes	GitLab API access token
`CLOUDFLARE_ACCOUNT_ID`	Yes	Cloudflare account
`CLOUDFLARE_API_TOKEN`	Yes	Cloudflare API token
`REDIS_URL`	No	Redis for distributed locking

backend-docs-api Specific

Variable	Required	Description
`MONGODB_CONNECTION_STRING_TEST_MODULES`	Yes	Test modules DB
`SYSTEM_TOKEN`	Yes	Internal API token

GitLab CI Variables

Set in GitLab Project → Settings → CI/CD → Variables:

Variable	Protected	Masked	Description
`CLOUDFLARE_ACCOUNT_ID`	✅	✅	Cloudflare account ID
`CLOUDFLARE_API_TOKEN`	✅	✅	Cloudflare API token

Setting Variables via API

# Add CI variable to GitLab project
curl -X POST -H "PRIVATE-TOKEN: $GITLAB_API_TOKEN" \
  "https://gitlab.com/api/v4/projects/gograbspace%2Fproject-name/variables" \
  -d "key=CLOUDFLARE_API_TOKEN" \
  -d "value=your-token" \
  -d "protected=true" \
  -d "masked=true"

ALLOWED_ORIGINS Configuration

Full list for Railway services:

https://gograb.space,https://app.gograb.space,https://api.gograb.space,https://ai-api.gograb.space,https://docs-api.gograb.space,http://localhost:5200,http://localhost:5701,http://localhost:4200,http://localhost:3000

Token Permissions

GitLab API Token

Required scopes:

api - Full API access
read_repository - Clone/pull repositories
write_repository - Push to repositories

Create at: https://gitlab.com/-/user_settings/personal_access_tokens

Cloudflare API Token

Required permissions:

Cloudflare Pages:Edit - Manage Pages projects
Account:Read - Read account info

Create at: https://dash.cloudflare.com/profile/api-tokens

Template: "Edit Cloudflare Pages"

Environment Loading

Using env-loader.js

import { getEnvVar, requireEnvVar, getMongoDBConnectionString } from './env-loader.js';

// Optional with default
const gitlabUrl = getEnvVar('GITLAB_URL', 'https://gitlab.com');

// Required (throws if missing)
const apiToken = requireEnvVar('GITLAB_API_TOKEN');

// MongoDB helper
const mongoUri = getMongoDBConnectionString();

In NestJS Services

@Injectable()
export class MyService {
  constructor(private configService: ConfigService) {}
  
  getGitLabToken(): string {
    return this.configService.getOrThrow('GITLAB_API_TOKEN');
  }
}

Security Best Practices

Never commit secrets - Use .env.local (gitignored)
Use masked variables - In GitLab CI, enable masking
Rotate tokens regularly - Every 90 days recommended
Minimum permissions - Only grant required scopes
Separate environments - Different tokens for dev/prod

Validation

Check Required Variables

# Quick validation script
for var in GITLAB_API_TOKEN CLOUDFLARE_ACCOUNT_ID CLOUDFLARE_API_TOKEN; do
  if [ -z "${!var}" ]; then
    echo "❌ Missing: $var"
  else
    echo "✅ Set: $var"
  fi
done

Test Connections

yarn test:gitlab      # Tests GITLAB_API_TOKEN
yarn test:cloudflare  # Tests CLOUDFLARE_* vars