> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pinaivu.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Environment Variables
> Required configuration for the coordinator, gateway, chat-relayer, and explorer-indexer
No real secret values appear on this page — variable names, purposes, and
whether a value is safe to reuse across environments only. Generate fresh
secrets for every deployment; never reuse a development value in
production.
## Coordinator (pushed via VSOCK:7000 inside the enclave)
| Variable | What | Notes |
| -------------------------------- | ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- |
| `DATABASE_URL` | Postgres connection string | Must use `?sslmode=require`; needs the **Session pooler** host if using Supabase free tier (direct connect is IPv6-only) |
| `REDIS_URL` | Redis connection string | Use `rediss://` + auth — the VSOCK bridge doesn't terminate TLS itself |
| `POSTGRES_BRIDGE_HOST` / `_PORT` | Real upstream Postgres host/port | `init` writes a `127.0.0.1` `/etc/hosts` alias so TLS SNI still sees the real hostname |
| `REDIS_BRIDGE_HOST` / `_PORT` | Same trick for Redis | |
| `SUI_RPC_URL` | Sui fullnode URL | e.g. `https://fullnode.testnet.sui.io` |
| `SUI_NETWORK` | `mainnet` / `testnet` / `devnet` | |
| `OPERATOR_PRIVATE_KEY` | Sui secret key used by the sidecar to sign PTBs | Never the same key as the enclave's signing key — see [On-chain contracts](/architecture/onchain) for why that separation matters |
| `PINAIVU_PACKAGE_ID` | Published `pinaivu` contracts address | |
| `PINAIVU_ENCLAVE_CONFIG_ID` | Shared-object id of `EnclaveConfig` | |
| `PINAIVU_CAP_ID` | Owned-object id of `Cap` | Held by the operator address |
| `PINAIVU_VAULT_ID` | Shared-object id of `Vault` | |
| `PINAIVU_ENCLAVE_OBJECT_ID` | Set automatically by `register-coordinator.sh` after a successful registration | Lives in the dynamic env file, not the static one |
| `SIDECAR_URL` | Defaults to `http://127.0.0.1:8200` | |
| `SIDECAR_SECRET` | Authenticates coordinator↔sidecar and `/v1/admin/*` | Auto-generated from NSM entropy if not supplied |
| `PINAIVU_BIND` | Defaults to `127.0.0.1:4000` | |
| `PINAIVU_LIBP2P_LISTEN` | Defaults to `/ip4/0.0.0.0/tcp/4001` | |
## Gateway (`api.pinaivu.com` backend)
| Variable | Purpose | Reuse across environments? |
| ------------------------------ | ------------------------------------------------------------------ | ---------------------------------------------------------------------------------------- |
| `DATABASE_URL` | Gateway's own Postgres (API keys, usage) | No — provision real Postgres per environment |
| `REDIS_URL` | Rate limiting | No |
| `COORDINATOR_URL` | Live coordinator's HTTPS endpoint | Re-verify via `GET /enclave_health` before relying on it — the IP can change on redeploy |
| `ADMIN_SECRET` | Auth for the key-management dashboard | No — generate fresh per environment |
| `PORT` | Listen port | Yes, as a default |
| `NODE_TLS_REJECT_UNAUTHORIZED` | Set to `0` only to trust the coordinator's self-signed cert in dev | **Must not be set in production** once a real cert chain is in place |
## chat-relayer (`chat.pinaivu.ai` backend)
| Variable | Purpose | Reuse across environments? |
| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `CHAT_RELAYER_BIND` | Listen address | Yes, as a default |
| `DATABASE_URL` | chat-relayer's own Postgres (pgvector) | No — dedicated instance per environment |
| `REDIS_URL` | Rate limiting | No |
| `MEMORY_ENCRYPTION_KEY` | 32-byte hex secret, HKDF-derives a per-owner AES-256-GCM key (see the [memory layers caveat](/architecture/memory-layers#one-honest-caveat)) | No — generate with `openssl rand -hex 32` per environment, never reuse a dev value |
| `WALRUS_PUBLISHER_URL` / `WALRUS_AGGREGATOR_URL` | Walrus testnet HTTP endpoints | Yes, while on testnet |
| `WALRUS_EPOCHS` | Blob lifetime | Yes, as a default |
| `PINAIVU_API_BASE` | Upstream coordinator (or gateway, once live) | No — points directly at the coordinator during early testing; switch to the gateway URL once provisioned |
| `INSECURE_COORDINATOR` | Trusts a self-signed coordinator cert | Dev-only, like the gateway's equivalent flag |
| `EMBEDDING_API_BASE` / `EMBEDDING_API_KEY` / `EMBEDDING_MODEL` | Jina embeddings for cross-session recall | Get your own production API key rather than sharing one across environments |
| `EMBEDDING_DIM` | Fixes the pgvector column's dimension at migration time | Only reusable if `EMBEDDING_MODEL` doesn't change — changing models later needs a new migration, not just an env edit |
| `SUI_RPC_URL` | Sui fullnode URL | Yes |
For the enclave deploy, the same variable names go into `.env.runtime` and
are pushed over VSOCK:7000 by `parent_forwarder.sh`, exactly like the
coordinator.
## explorer-indexer (`explorer.pinaivu.com` backend)
| Variable | Purpose | Reuse across environments? |
| ---------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| `DATABASE_URL` | **Read-only** role against the coordinator's real Postgres | No — provision a dedicated read-only role per environment, never reuse a seeded dev DB |
| `INDEXER_BIND` | Listen address | Yes, as a default |
| `WALRUS_PUBLISHER_URL` | Walrus testnet endpoint | Yes, while on testnet |
| `ARCHIVE_AFTER_HOURS` | Delay before a receipt is batched to Walrus | No — dev uses `0` to force immediate archiving for testing; production should use a real delay (e.g. `24`) |
| `RUST_LOG` | Log verbosity | Yes |
## What each new operator must provision themselves
* Real Postgres + Redis for the gateway.
* Real Postgres with the `pgvector` extension, plus Redis, for chat-relayer.
* A **read-only** Postgres role on the coordinator's actual database for
explorer-indexer.
* A fresh `MEMORY_ENCRYPTION_KEY` and `ADMIN_SECRET` — generated, not copied
from any other environment.
* Their own embeddings API key rather than a shared one, for production use.