Environment Variables

Swisblade injects environment variables into your containers at deploy time. There are two types: auto-generated (connection strings from needs and connects_to) and vault variables (your custom config and secrets, managed from the dashboard).

Auto-generated variables

These are created automatically based on your stack.json. You never need to set them manually.

From needs

Infrastructure	Variable	Example
PostgreSQL	DATABASE_URL	postgresql://proj_abc:pass@platform-postgres:5432/proj_abc
MySQL	DATABASE_URL	mysql://proj_abc:pass@platform-mysql:3306/proj_abc
Redis	REDIS_URL	redis://proj_abc:pass@platform-redis:6379/0
Redis	REDIS_KEY_PREFIX	proj_abc:
RabbitMQ	MQ_URL	amqp://proj_abc:pass@platform-rabbitmq:5672/proj_abc

From connects_to

Target service	Variable	Example
worker (port 8080)	WORKER_URL	http://worker:8080
search (port 9200)	SEARCH_URL	http://search:9200

The variable name is derived from the service name in UPPER_SNAKE_CASE + _URL.

Vault (user-defined variables)

All user-defined environment variables are stored in the project vault, managed from the dashboard. Every variable in the vault is automatically injected into all services at deploy time — you don't need to declare them in stack.json.

Managing the vault

1. Go to Project → Environment Variables
2. Add variables with a key and value
3. Toggle Secret for sensitive values (API keys, passwords, tokens)
4. Save

Plain vs Secret

	Plain	Secret
Stored as	Plain text	AES-256-GCM encrypted
Visible in dashboard	Yes	No (masked after saving)
Can be edited	Yes	Replace only
Use for	LOG_LEVEL, NODE_ENV	API keys, passwords, tokens

tip

Mark a variable as secret if it contains sensitive data. Once saved, the value cannot be revealed — only replaced with a new one.

Pre-deploy validation with requires_env

You can optionally declare which vault variables a service requires to run:

{
  "api": {
    "type": "app",
    "requires_env": ["STRIPE_KEY", "WEBHOOK_SECRET"]
  }
}

If any listed variable is missing from the vault, the deploy fails immediately with a clear error message — before any containers start. If you don't declare requires_env, the deploy proceeds without checking; missing variables will cause runtime errors instead.

Default secrets by service type

Some infrastructure types automatically require passwords. Swisblade generates these for you, but you can override them.

Service type	Auto-required secret	Purpose
postgres	{NAME}_PASSWORD	Database password
mysql	{NAME}_ROOT_PASSWORD	Root password
mongo	{NAME}_ROOT_PASSWORD	Root password

For example, a service named db of type postgres will expect DB_PASSWORD.

Deploy-time validation

Swisblade validates environment variables before starting containers:

• Variables listed in requires_env must exist in the vault
• If any required variable is missing, the deploy fails with a message listing the missing ones
• Auto-generated variables (DATABASE_URL, etc.) are always present
• All vault variables are injected into every service, regardless of requires_env

OpenTelemetry variables

These are injected automatically for observability. You don't need to set them:

Variable	Value
OTEL_EXPORTER_OTLP_ENDPOINT	Points to the platform's OTel Collector
OTEL_SERVICE_NAME	{project-slug}/{service-name}
OTEL_RESOURCE_ATTRIBUTES	Deployment metadata