Configuration
Key environment variables per service.
The variables that actually change behavior. Full sets live in each repo's .env.example and are
rendered from environments/matrix.*.env by envctl — see
Local development.
Cross-cutting
| Var | Meaning |
|---|---|
IN_TEE | true in prod (real TDX quotes via /var/run/dstack.sock); false locally (stub) |
INTERNAL_* vs BROWSER_* | docker-network URL vs host-browser URL — do not conflate |
Conclave
| Var | Meaning |
|---|---|
CONCLAVE_INPERSON_VIA_CAPTURE | Route in-person through capture-diart (set explicitly — dstack ignores compose defaults) |
CONCLAVE_DIARIZE_URL | Where to send the authoritative post-pass |
CONCLAVE_ADMIN_EMAILS | In-enclave admin allowlist |
CONCLAVE_DEV_LOGIN | Enables /api/auth/v1/dev-login locally |
| LLM / ASR backend | RedPill TEE / NEAR AI; ASR = NEAR Whisper (whisper-large-v3) |
Capture
| Var | Meaning |
|---|---|
CAPTURE_DIARIZER | diart | diarizen | remote | mock |
CAPTURE_DIARIZER_URL | Remote GPU diarizer endpoint (torch-free caller) |
CAPTURE_AUDIO_FETCH_TOKEN · CAPTURE_DIARIZE_RESULT_TOKEN | Job-queue service tokens |
HF_HUB_OFFLINE | 1 — offline models, no runtime egress |
VFTE / FPM
| Var | Meaning |
|---|---|
FPM_DB_KEY | Master seal key (TEE-sealed → env → dev keyfile) |
FPM_AUTH_TOKENS | Scoped, fail-closed M2M tokens (per-endpoint + optional workspace filter) |
fpm_workspace_for(workspace_id) | The opaque scope-id mapping (must match on identify and tag) |
Local workspaces: Conclave uses
local-ws; VFTE voiceprints are scoped tolocal-ws(not the rawws_xxx) — a common gotcha when wiping test voiceprints.
Source: ENVIRONMENTS.md, per-repo .env.example, DEPLOYMENT-GUIDE.md.