Environment Variables

Environment variables let you configure your apps without changing code. They're stored as a file on the server (/deployments/{app}/env), uploaded fresh on every deploy, and passed to the container via docker run --env-file — never as plain -e flags, so values never show up in the process list.

Setting variables

teploy env set DATABASE_URL=postgres://...
teploy env set API_KEY=secret123

Set multiple at once:

teploy env set DATABASE_URL=postgres://... REDIS_URL=redis://...

Changes take effect on the next teploy deploy — env vars are read fresh at deploy time, so setting one doesn't restart a running container by itself.

Manage variables on a remote app without a local teploy.yml using --app (requires --host) — this is the path teploy-dash uses:

teploy env set DATABASE_URL=postgres://... --app myapp --host 203.0.113.10

Viewing and removing variables

teploy env get DATABASE_URL
teploy env list             # values masked
teploy env list --reveal    # show actual values
teploy env unset API_KEY

System variables

Only one variable is set automatically by teploy:

Variable	Description
PORT	The port your app should listen on. teploy sets this on every container start based on teploy.yml's port: field — it's reserved and teploy env set PORT=... is rejected.

Everything else — NODE_ENV, database URLs, API keys — is whatever you set with teploy env set or define directly in teploy.yml's env: block. Nothing else is injected implicitly.

Secrets

For sensitive values (API keys, database passwords) that should be encrypted at rest rather than stored as plaintext, use teploy secret instead of teploy env:

teploy secret set API_KEY=secret123
teploy secret list      # keys only, values masked
teploy secret rotate API_KEY

Secrets and env vars both end up in the same merged env file on the server and are available to your container the same way — the difference is at-rest encryption and audit-friendly access (teploy secret get decrypts on demand rather than storing plaintext). See Secrets for the full command set, including OpenBao for dynamic database credentials, per-app scoped policy, HA, and audit streaming.

teploy.yml env block

Plain (non-secret) env vars can also be set directly in config instead of via the CLI:

env:
  NODE_ENV: production
  LOG_LEVEL: info

These are merged with anything set via teploy env set at deploy time.