Environment variables

Every setting of the three openplate containers is an environment variable. This page lists all of them, for the app, the core server (openplate-core) and the inference service. Most are optional. When you leave one unset, the default in its row applies.

Some settings stop the boot on purpose. A value the service cannot use, or one half of a pair, makes the container exit. The exit message names the variable. The container does not start with a guess. Settings that stop the boot lists every such rule.

How to set a variable

• Docker Compose. Put the line in the .env file next to the compose file, for example LOG_LEVEL=debug. Then run docker compose -f <your file> up -d again. Every shipped compose file passes each variable its service reads on to the container. docker compose restart does not read .env again.
• Quadlet. Put the line in the <unit>.env file next to the unit, for example app.env, core.env or inference.env. Use the container's own names from this page. Then restart the unit, for example systemctl --user restart core.service. podman.md explains the files.
• Without a container. The app and the core server each read a .env file in the folder they run in. You can also set the variable in the shell or in the systemd unit. Without Docker shows the app's setup.

The Default column says what the service does when the variable is unset. A compose file can pass a value of its own, for example MODEL_PROFILE: lite. The compose file shows that value next to the name.

Names the compose files fill for you

The three topology files, compose.core.yml, compose.inference.yml and compose.full.yml, fill some container variables from shared names in .env. Set the shared name there. The container variable on its own has no effect in these files.

docker/compose.yml, the app on its own, takes APP_URL under its own name. The core server's own quickstart file is apps/core/docker/compose.yml. It takes SERVER_PUBLIC_URL and CLIENT_BASE_URL under their own names. It builds DATABASE_URL from POSTGRES_USER, POSTGRES_PASSWORD and POSTGRES_DB.

The app

The app container, ghcr.io/lowcarbcheck/openplate. It starts with nothing set. configuration.md explains its larger features in depth.

Server and addresses

Language and content

Sync and the kind of instance

Instance-provided AI

Food database

Analytics, newsletter and updates

Logging

Closing an instance

The core server (openplate-core)

The core server container, ghcr.io/lowcarbcheck/openplate-core. It needs two values: DATABASE_URL, which the compose files fill for you, and SERVER_SECRET. Everything else is optional and off until you set it. openplate-core's README explains the features.

Server and addresses

Database

Secrets

Accounts and sign-up

Invitations and trials

Mail

AI proxy and limits

Consent

Push

Plans

Feedback, sharing and research

Logging and other

The inference service (openplate-inference)

The inference container, ghcr.io/lowcarbcheck/openplate-inference. It runs the model runtime and the service in one container. openplate-inference's configuration guide explains the options in depth.

Service and access

Model and weights

Limits

Food data

Settings that stop the boot

A container that does not start is easy to notice, and it costs one restart. A setting that is quietly ignored lets you believe something works when it does not. So each rule below stops the boot, and the log names the variable.

Refused names

These names were settings once. Now the service refuses to start while one is set, and says what to use instead. The core server refuses them even with an empty value, so delete the line. The app refuses GATEWAY_URL only when it has a value.

Rules between variables

The app.

• MATOMO_URL and MATOMO_SITE_ID: set both or neither. MATOMO_EVENT_LEVEL needs both.
• NEWSLETTER_SUBSCRIBE_URL and NEWSLETTER_TURNSTILE_SITE_KEY: set both or neither.
• INSTANCE_MODE=managed needs CORE_URL.
• CORE_URL and the deprecated SYNC_SERVER_URL: set one. If both are set to different addresses, SYNC_SERVER_URL wins for this release and the boot logs one warning.
• APP_URL is required when NODE_ENV=production.
• MOVED_TO_URL must be an https:// address on a host other than APP_URL, without a user name or password.
• A value outside its list stops the boot: DEFAULT_UI_LANGUAGE, NUTRIENT_REFERENCE_BASIS, INSTANCE_MODE, MATOMO_EVENT_LEVEL and FOOD_DB_BACKFILL. So does a FOOD_DB_DAILY_CALL_LIMIT that is not a positive whole number. Malformed addresses in CORE_URL, DEFAULT_INFERENCE_BASE_URL, MATOMO_URL or NEWSLETTER_SUBSCRIBE_URL also stop the boot. Boot also stops if MATOMO_SITE_ID is not a positive whole number, or if CONTENT_DIR is not a folder.

The core server.

• DATABASE_URL and SERVER_SECRET are required.
• Minimum lengths: 32 characters for SERVER_SECRET and TRIAL_ADDRESS_PEPPER, 24 for ADMIN_TOKEN and BILLING_TOKEN.
• Mail uses one transport. The HTTP mail API needs MAIL_API_URL, MAIL_API_KEY, MAIL_API_FROM and MAIL_OPERATOR_EMAIL, all four. SMTP needs SMTP_HOST, SMTP_FROM and MAIL_OPERATOR_EMAIL, and SMTP_USER and SMTP_PASSWORD go together. Variables of both transports at once stop the boot, and so does MAIL_OPERATOR_EMAIL with no transport.
• Mail needs SERVER_PUBLIC_URL and CLIENT_BASE_URL. With NODE_ENV=production, both must be https:// addresses on another host, not localhost.
• Set both or neither: UPSTREAM_BASE_URL and UPSTREAM_API_KEY; PLANS_UPSTREAM_URL and PLANS_UPSTREAM_SECRET; TURNSTILE_SECRET_KEY and TURNSTILE_SITE_KEY; MEMBER_INVITE_DAILY_AI_LIMIT and MEMBER_INVITE_ALLOWANCE_DAYS; TRIAL_SCANS and TRIAL_DAILY_AI_LIMIT.
• Set all three or none: VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY and VAPID_SUBJECT.
• X requires Y: OPEN_SIGNUP=true requires mail. The Turnstile pair requires OPEN_SIGNUP=true. MEMBER_INVITE_LIFETIME_CAP requires the member-invite pair or MEMBER_INVITE_TRIAL=true. MEMBER_INVITE_TRIAL=true requires the trial pair and refuses the member-invite pair. The trial pair requires TRIAL_ADDRESS_PEPPER. TRIAL_DAYS and AI_TRIAL_INSTANCE_DAILY_LIMIT require the trial pair. AI_TRIAL_NETWORK_DAILY_LIMIT requires AI_TRIAL_INSTANCE_DAILY_LIMIT. TRIAL_TIME_ZONE requires TRIAL_DAYS. SYNC_NOTICE_URL requires SYNC_NOTICE.
• Zero is refused where it would read as "off" and mean the opposite: AI_INSTANCE_DAILY_LIMIT, AI_TRIAL_INSTANCE_DAILY_LIMIT, AI_TRIAL_NETWORK_DAILY_LIMIT, TRIAL_SCANS, TRIAL_DAILY_AI_LIMIT, TRIAL_DAYS, MEMBER_INVITE_DAILY_AI_LIMIT and MEMBER_INVITE_ALLOWANCE_DAYS. Every other number must be positive too, except two that accept 0: TRUST_PROXY, and MEMBER_INVITE_LIFETIME_CAP, where 0 leaves members nothing to send.
• Upper limits: TRIAL_SCANS 100, TRIAL_DAYS 90, TRIAL_DAILY_AI_LIMIT and MEMBER_INVITE_DAILY_AI_LIMIT 10000, SYNC_NOTICE 280 characters, INSTANCE_NAME 64 characters.
• SYNC_SHARING, SYNC_RESEARCH, SYNC_FEEDBACK, DATABASE_SSL and MEMBER_INVITE_TRIAL accept true, false, 1 or 0. OPEN_SIGNUP accepts only true.
• A value outside its list stops the boot: INSTANCE_LANGUAGE, NUTRIENT_REFERENCE_BASIS, LOG_LEVEL, TRIAL_TIME_ZONE and HEALTH_CONSENT_VERSION. A VAPID_SUBJECT that is not mailto: or https: stops the boot. So does an SMTP_HOST with a scheme, port or path. Malformed addresses in SERVER_PUBLIC_URL, CLIENT_BASE_URL, UPSTREAM_BASE_URL, PLANS_UPSTREAM_URL or SYNC_NOTICE_URL also stop the boot.

The inference service.

• MODEL_PROFILE=external requires MODEL_RUNTIME_URL. With any other profile, a MODEL_RUNTIME_URL other than the bundled address stops the container.
• A MODEL_PROFILE, FOOD_SOURCE, PROFILE or LOG_LEVEL outside its list stops the boot. A MODEL_RUNTIME_URL or EMBEDDING_RUNTIME_URL that is not an http:// or https:// address also stops the boot.
• Counts and sizes must be positive whole numbers. LATENCY_CEILING_MS and RUNTIME_COMPLETION_TIMEOUT_MS also accept 0. IMAGE_MAX_LONG_EDGE must be at least 112, and PORT at most 65535.

Sign-up with Turnstile

By default an account comes only from an invitation. Set OPEN_SIGNUP=true on the core server, and anybody can ask for an account with their own address. The service then mails that address an invitation, and the letter proves the address works. So open sign-up needs mail, and the service does not start without it. The app shows the sign-up form only when the core server says its door is open.

A captcha stops scripts from flooding the service with requests. The core server checks a Cloudflare Turnstile captcha when you configure two keys:

1. 01
   Sign in to the Cloudflare dashboard, open Turnstile, and choose Add widget. A free account is sufficient. Your domain does not have to use Cloudflare.
2. 02
   Give the widget a name, add the host name of your app, such as openplate.example.com, and keep the mode Managed. Choose Create.
3. 03
   Set the site key in TURNSTILE_SITE_KEY and the secret key in TURNSTILE_SECRET_KEY on the core server. Set both keys or neither.
4. 04
   Recreate the core server, for example with docker compose -f <your file> up -d.

/health then publishes the site key. The app's sign-up page shows the captcha. Its submit button stays inactive until the user solves it. The secret key never leaves the core server. The service sends Cloudflare the captcha response and the secret key, not the visitor's address.

The service checks only the sign-up request, POST /v1/auth/signup-request. Signing in, opening an invitation, and all other routes carry no captcha. When the service cannot reach Cloudflare, it returns 503, and the person can try again later. The check fails closed, so an unanswered request never passes.

The app's Content-Security-Policy allows Cloudflare's captcha only on a managed instance (INSTANCE_MODE=managed), or when the newsletter form is on. On other instances, the browser blocks the captcha and nobody can submit the form. Set the app to managed before you turn the captcha on.

Without the two keys, open sign-up still works. Its other limits still apply. The service allows five requests an hour from one address, and one letter a day for one mailbox. It blocks addresses from known throwaway mail services. The service logs a warning at start.

NEWSLETTER_TURNSTILE_SITE_KEY is a separate setting. It belongs to the app and protects the newsletter form on the landing page. Its secret key stays with the service that receives that form, not with openplate. Newsletter sign-up explains it.

Building an image yourself

The Dockerfiles accept several build arguments. They are not settings for a running container. OPENPLATE_BUILD_SHA stamps the commit into the app's bundle. The inference image takes BASE_IMAGE, the llama.cpp server image to build on. It also takes NODE_IMAGE, the Node.js image for the build. VITE_ALLOWED_HOSTS applies only to the app's development server and has no default hosts.