Configuration & Secrets
Firebreak uses strongly typed environment variables to configure database connections, cryptographic keys, and operational safety thresholds.
4 min read
•Production Verified
Master Configuration Reference Table
| Variable Name | Required? | Sensitive? | Purpose |
|---|---|---|---|
| DATABASE_URL | Yes | Yes | Pooled PostgreSQL connection string for Neon Serverless. |
| ENCRYPTION_KEY | Yes | Yes | 32-byte Base64 key used for AES-256-GCM token encryption. |
| STATE_SECRET | Yes | Yes | 32-byte Base64 HMAC secret used to sign internal state tokens. |
| BETTER_AUTH_SECRET | Yes | Yes | Cryptographic secret used to sign session cookies. |
| GITHUB_APP_PRIVATE_KEY | Yes | Yes | RSA private key (PEM format) used for GitHub App tokens. |
| DEFAULT_AI_API_KEY | Yes | Yes | API key for Google Gemini 2.5 Flash. |
| RESEND_API_KEY | Optional | Yes | API key for Resend transactional email notifications. |
| PORT | Optional | No | Port for MCP server (defaults to 3001 or 3005). |
Zero-Downtime Key Rotation Procedure
Rotate encryption keys across all database rows without application downtime:
bash
# 1. Set ENCRYPTION_KEY_PREVIOUS to your active key
# 2. Set ENCRYPTION_KEY to your new 32-byte Base64 key
# 3. Execute the re-encryption runner:
npm run ops:reencrypt
# 4. Remove ENCRYPTION_KEY_PREVIOUS once complete