configuration

Environment Variables

Every variable in .env.example, what it does, and what to set it to.

Glyph reads its configuration from environment variables, defined in a .env file at the project root. The shipped .env.example is the source of truth for every supported variable.

Database

Variable	Default	Required	Description
`MYSQL_ROOT_PASSWORD`	`changeme_root`	Yes	Root password for the MySQL container. Used for administrative tasks like backups.
`MYSQL_PASSWORD`	`changeme`	Yes	Password for the `glyph` MySQL user that the backend connects with.

The MySQL container is named db in docker-compose.yml. The database itself is glyph, the user is glyph. Connection string is built automatically as:

mysql+pymysql://glyph:${MYSQL_PASSWORD}@db:3306/glyph

Choose long random passwords. The changeme* defaults are placeholders only.

Security

Variable	Default	Required	Description
`SECRET_KEY`	placeholder	Yes	Secret used for signing JWT tokens AND encrypting stored Personal Access Tokens. 64 characters minimum.

Generate a secure value with:

python3 -c "import secrets; print(secrets.token_hex(32))"

Changing SECRET_KEY invalidates every existing session AND every stored PAT. Users will be signed out and connected GitHub/GitLab accounts must be reconnected. Pick a value at install and never rotate without a plan.

JWT tokens are signed with HS256 and expire after 7 days.

Search

Variable	Default	Required	Description
`MEILISEARCH_KEY`	`changeme_meili_master_key`	Yes	Master key for the Meilisearch container. Used by the backend to authenticate.

The Meilisearch container is named meilisearch. The backend connects to http://meilisearch:7700. The port is not exposed outside the Docker network.

GitHub OAuth

These are optional - only needed if you want users to sign into Glyph using GitHub OAuth (separate from connecting personal accounts via PAT).

Variable	Default	Required	Description
`GITHUB_CLIENT_ID`	empty	No	Client ID from your GitHub OAuth App.
`GITHUB_CLIENT_SECRET`	empty	No	Secret from your GitHub OAuth App.

See GitHub OAuth for setup.

GitLab OAuth

Same pattern as GitHub.

Variable	Default	Required	Description
`GITLAB_CLIENT_ID`	empty	No	Application ID from your GitLab OAuth App.
`GITLAB_CLIENT_SECRET`	empty	No	Secret from your GitLab OAuth App.

See GitLab OAuth for setup.

Email

At least one provider is needed to send invitation emails. Without any, Glyph still creates invitations but you must share the link manually.

Provider priority (highest first): Resend → SendGrid → Mailgun → SMTP. The first non-empty configuration wins.

SMTP (generic)

Variable	Default	Description
`SMTP_HOST`	empty	Hostname of the SMTP server.
`SMTP_PORT`	`587`	TCP port. STARTTLS is used unless port is `465` (implicit TLS).
`SMTP_USER`	empty	SMTP username.
`SMTP_PASSWORD`	empty	SMTP password (or app-specific password).

Resend

Variable	Description
`RESEND_API_KEY`	API key from resend.com. Recommended for new setups.

SendGrid

Variable	Description
`SENDGRID_API_KEY`	API key from sendgrid.com.

Mailgun

Variable	Description
`MAILGUN_API_KEY`	API key from mailgun.com.
`MAILGUN_DOMAIN`	Mailgun sending domain. Both key and domain required.

Sender address

Variable	Default	Description
`EMAIL_FROM`	`noreply@glyph.app`	The "From" address used by every provider. Use a domain you own and is verified with your provider.

See Email Providers for end-to-end setup.

URLs

Variable	Default	Description
`FRONTEND_URL`	`http://localhost:3000`	Public URL of the frontend. Used in invitation emails.
`NEXT_PUBLIC_API_URL`	`http://localhost:8000`	Public URL of the backend, used by the browser.
`APP_URL`	`http://localhost:8000`	Public URL of the backend. Used for OAuth redirects.
`CORS_ORIGINS`	`http://localhost:3000`	Comma-separated list of allowed origins for CORS.

For production behind a reverse proxy, set all four to your public HTTPS URLs. See Reverse Proxy.

Internal (no need to edit)

These are set in docker-compose.yml and shouldn't normally be changed:

Variable	Default	Description
`DATA_DIR`	`/data`	Where the backend stores cloned repositories. Backed by `volumes/data`.
`MEILISEARCH_URL`	`http://meilisearch:7700`	Internal URL of the Meilisearch container.
`DATABASE_URL`	computed	Built from `MYSQL_PASSWORD` automatically.

Verifying

After editing .env, restart the stack:

docker compose -f docker-compose.prod.yml up -d

Check the backend logs to confirm it started cleanly:

docker compose logs backend

If a required variable is missing, the backend exits with a clear error.

Theme & Preferences

GitHub OAuth