Environment Variables - Pinaivu

No real secret values appear on this page — variable names, purposes, and whether a value is safe to reuse across environments only. Generate fresh secrets for every deployment; never reuse a development value in production.

Coordinator (pushed via VSOCK:7000 inside the enclave)

Variable	What	Notes
`DATABASE_URL`	Postgres connection string	Must use `?sslmode=require`; needs the Session pooler host if using Supabase free tier (direct connect is IPv6-only)
`REDIS_URL`	Redis connection string	Use `rediss://` + auth — the VSOCK bridge doesn’t terminate TLS itself
`POSTGRES_BRIDGE_HOST` / `_PORT`	Real upstream Postgres host/port	`init` writes a `127.0.0.1` `/etc/hosts` alias so TLS SNI still sees the real hostname
`REDIS_BRIDGE_HOST` / `_PORT`	Same trick for Redis
`SUI_RPC_URL`	Sui fullnode URL	e.g. `https://fullnode.testnet.sui.io`
`SUI_NETWORK`	`mainnet` / `testnet` / `devnet`
`OPERATOR_PRIVATE_KEY`	Sui secret key used by the sidecar to sign PTBs	Never the same key as the enclave’s signing key — see On-chain contracts for why that separation matters
`PINAIVU_PACKAGE_ID`	Published `pinaivu` contracts address
`PINAIVU_ENCLAVE_CONFIG_ID`	Shared-object id of `EnclaveConfig<ENCLAVE>`
`PINAIVU_CAP_ID`	Owned-object id of `Cap<ENCLAVE>`	Held by the operator address
`PINAIVU_VAULT_ID`	Shared-object id of `Vault<SUI>`
`PINAIVU_ENCLAVE_OBJECT_ID`	Set automatically by `register-coordinator.sh` after a successful registration	Lives in the dynamic env file, not the static one
`SIDECAR_URL`	Defaults to `http://127.0.0.1:8200`
`SIDECAR_SECRET`	Authenticates coordinator↔sidecar and `/v1/admin/*`	Auto-generated from NSM entropy if not supplied
`PINAIVU_BIND`	Defaults to `127.0.0.1:4000`
`PINAIVU_LIBP2P_LISTEN`	Defaults to `/ip4/0.0.0.0/tcp/4001`

Gateway (`api.pinaivu.com` backend)

Variable	Purpose	Reuse across environments?
`DATABASE_URL`	Gateway’s own Postgres (API keys, usage)	No — provision real Postgres per environment
`REDIS_URL`	Rate limiting	No
`COORDINATOR_URL`	Live coordinator’s HTTPS endpoint	Re-verify via `GET /enclave_health` before relying on it — the IP can change on redeploy
`ADMIN_SECRET`	Auth for the key-management dashboard	No — generate fresh per environment
`PORT`	Listen port	Yes, as a default
`NODE_TLS_REJECT_UNAUTHORIZED`	Set to `0` only to trust the coordinator’s self-signed cert in dev	Must not be set in production once a real cert chain is in place

chat-relayer (`chat.pinaivu.ai` backend)

Variable	Purpose	Reuse across environments?
`CHAT_RELAYER_BIND`	Listen address	Yes, as a default
`DATABASE_URL`	chat-relayer’s own Postgres (pgvector)	No — dedicated instance per environment
`REDIS_URL`	Rate limiting	No
`MEMORY_ENCRYPTION_KEY`	32-byte hex secret, HKDF-derives a per-owner AES-256-GCM key (see the memory layers caveat)	No — generate with `openssl rand -hex 32` per environment, never reuse a dev value
`WALRUS_PUBLISHER_URL` / `WALRUS_AGGREGATOR_URL`	Walrus testnet HTTP endpoints	Yes, while on testnet
`WALRUS_EPOCHS`	Blob lifetime	Yes, as a default
`PINAIVU_API_BASE`	Upstream coordinator (or gateway, once live)	No — points directly at the coordinator during early testing; switch to the gateway URL once provisioned
`INSECURE_COORDINATOR`	Trusts a self-signed coordinator cert	Dev-only, like the gateway’s equivalent flag
`EMBEDDING_API_BASE` / `EMBEDDING_API_KEY` / `EMBEDDING_MODEL`	Jina embeddings for cross-session recall	Get your own production API key rather than sharing one across environments
`EMBEDDING_DIM`	Fixes the pgvector column’s dimension at migration time	Only reusable if `EMBEDDING_MODEL` doesn’t change — changing models later needs a new migration, not just an env edit
`SUI_RPC_URL`	Sui fullnode URL	Yes

For the enclave deploy, the same variable names go into .env.runtime and are pushed over VSOCK:7000 by parent_forwarder.sh, exactly like the coordinator.

explorer-indexer (`explorer.pinaivu.com` backend)

Variable	Purpose	Reuse across environments?
`DATABASE_URL`	Read-only role against the coordinator’s real Postgres	No — provision a dedicated read-only role per environment, never reuse a seeded dev DB
`INDEXER_BIND`	Listen address	Yes, as a default
`WALRUS_PUBLISHER_URL`	Walrus testnet endpoint	Yes, while on testnet
`ARCHIVE_AFTER_HOURS`	Delay before a receipt is batched to Walrus	No — dev uses `0` to force immediate archiving for testing; production should use a real delay (e.g. `24`)
`RUST_LOG`	Log verbosity	Yes

What each new operator must provision themselves

Real Postgres + Redis for the gateway.
Real Postgres with the pgvector extension, plus Redis, for chat-relayer.
A read-only Postgres role on the coordinator’s actual database for explorer-indexer.
A fresh MEMORY_ENCRYPTION_KEY and ADMIN_SECRET — generated, not copied from any other environment.
Their own embeddings API key rather than a shared one, for production use.