Configuration
Key environment variables per service.
The variables that actually change behavior. Full sets live in each repo's .env.example and are
rendered from environments/matrix.*.env by envctl — see
Local development.
Cross-cutting
| Var | Meaning |
|---|---|
IN_TEE | true in prod (real TDX quotes via /var/run/dstack.sock); false locally (stub) |
INTERNAL_* vs BROWSER_* | docker-network URL vs host-browser URL — do not conflate |
Conclave
| Var | Meaning |
|---|---|
CONCLAVE_INPERSON_VIA_CAPTURE | Route in-person through capture-diart (set explicitly — dstack ignores compose defaults) |
CONCLAVE_DIARIZE_URL | Where to send the authoritative post-pass |
CONCLAVE_ADMIN_EMAILS | In-enclave admin allowlist |
CONCLAVE_DEV_LOGIN | Enables /api/auth/v1/dev-login locally |
CONCLAVE_VERCEL_HOST | Backend's public host — feeds correct magic-link / redirect URLs |
CONCLAVE_UPLOAD_PREPASS_ASR | Upload prepass-ASR gate — single-source reconcile (0) vs prepass (1), set to match the active engine |
CONCLAVE_PUBLIC_API_BASE | OAuth issuer / public API base (https://api.conclavehq.org) — must be set or discovery advertises localhost:8000 |
CONCLAVE_SEAL_KEY · CONCLAVE_SEAL_KEYS_RETIRED | Dev/CI seal seed (in-TEE the seed is dstack-sealed at conclave/transcript-seal) · retired verification keys for rotation (#21) |
ANALYTICS_DATABASE_URL | Analytics DB (the app writes metrics; the dashboard reads) |
ANALYTICS_ENV | test | prod — must match between the writer and the reader, or the dashboard shows nothing |
CONCLAVE_SEED_OWNER_EMAIL / _WORKSPACE · CONCLAVE_SHAPEOS_CONTRIB_DRY_RUN · CAPTURE_INPERSON_RESUME_GRACE_SEC | Prod-required flags (seeding, Shape-OS dry-run, in-person resume grace ~90s) |
| LLM / ASR backend | LLM = RedPill TEE / NEAR AI. ASR = NEAR Whisper (whisper-large-v3) on our own engine; the managed fallback supplies its own |
Capture
| Var | Meaning |
|---|---|
CAPTURE_DIARIZER | diart (our live engine) | diarizen (our TD post-pass model) | deepgram (temporary managed fallback) | remote | mock |
CAPTURE_TRANSCRIBER | ASR engine, independent of the diarizer — near (ours) | deepgram (fallback) |
CAPTURE_DIARIZEN_MODEL | Path to our TD diarization model (the authoritative GPU post-pass) |
CAPTURE_DEEPGRAM_API_KEY | API key for the managed fallback (provided as a sealed secret) |
CAPTURE_DIARIZER_URL | Remote diarizer endpoint (torch-free caller) |
CAPTURE_AUDIO_FETCH_TOKEN · CAPTURE_DIARIZE_RESULT_TOKEN | Job-queue service tokens |
CAPTURE_DIART_STEP · _LATENCY · _BATCH | diart tuning for our live engine — must be set explicitly |
HF_HUB_OFFLINE | 1 — our models run offline |
Never set in prod. CAPTURE_DIART_EMBED_INT8,
CAPTURE_DIART_EMBED_QUANT, and CAPTURE_DIART_OFFLINE are ablation/eval-only
flags. Setting them in prod silently degrades diarization.
Ingress (the in-CVM capture ingress): DOMAIN, TARGET_ENDPOINT, GATEWAY_DOMAIN,
CLOUDFLARE_API_TOKEN, CERTBOT_EMAIL, INGRESS_TIMEOUT_CLIENT / _SERVER (the 3600s WS timeouts).
VFTEE / FPM
| Var | Meaning |
|---|---|
FPM_DB_KEY | Master seal key (TEE-sealed → env → dev keyfile) |
FPM_AUTH_TOKENS | Scoped, fail-closed M2M tokens (per-endpoint + optional workspace filter) |
FPM_OAUTH_REDIRECT_URI | Google sign-in redirect (misconfig = 503) |
fpm_workspace_for(workspace_id) | The opaque scope-id mapping (must match on identify and tag) |
Local workspaces: Conclave uses
local-ws; VFTEE voiceprints are scoped tolocal-ws(not the rawws_xxx) — a common gotcha when wiping test voiceprints.