# Environment secrets and variables explained

#### **Global repository secrets**

<table><thead><tr><th width="295">Parameter</th><th>Description</th></tr></thead><tbody><tr><td>DOCKER_USERNAME</td><td><p>Your <a href="https://hub.docker.com/">Dockerhub</a> username to access the container registry. If you are using a different container registry, you will need to manually edit the deploy.yml at OpenCRVS Countryconfig repository appropriately.<br></p><p>NOTE: Dockerhub is used to store only OpenCRVS Countryconfig docker images. All Core images are stored in GitHub Packages</p></td></tr><tr><td>DOCKER_TOKEN</td><td>Your <a href="https://hub.docker.com/">Dockerhub</a> access token.</td></tr><tr><td>DOCKERHUB_ACCOUNT</td><td>The name of your Dockerhub account or organisation that forms the URL to your country config docker image on Dockerhub <em><strong>before</strong></em> the slash. e.g: <strong>opencrvs</strong></td></tr><tr><td>DOCKERHUB_REPO</td><td>The name of your Dockerhub repository that forms the URL to your country config docker image on Dockerhub <em><strong>after</strong></em> the slash.. e.g. <strong>ocrvs-farajaland</strong></td></tr><tr><td>GH_TOKEN</td><td>The personal Github Token used in all Action runners.</td></tr><tr><td>GH_ENCRYPTION_PASSWORD</td><td>Using the Github Token, a password is created that allows automated actions to access the secrets from other environments. This occurs during provisioning so that the <strong>production, backup</strong> and <strong>staging</strong> environments use the same BACKUP_ENCRYPTION_PASSPHRASE.</td></tr></tbody></table>

#### **Global repository variables**

| Variable      | Description                                                                      |
| ------------- | -------------------------------------------------------------------------------- |
| GH\_APPROVERS | List of valid GitHub accounts to approve deployments for particular environment. |

#### **Environment secrets**

| Secret                              | Description                                                                                                                                                                                              |
| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ENCRYPTION\_KEY                     | A password used to LUKS encrypt the `/data` folder containing OpenCRVS data.                                                                                                                             |
| ELASTICSEARCH\_SUPERUSER\_PASSWORD  | The Elasticsearch superuser password. You can also use this to login to Kibana with the username "**elastic**" and you have superuser Elastic privileges. Kibana URL: <https://kibana.\\>\<your\_domain> |
| KIBANA\_USERNAME                    | A username for a regular Kibana user to login and monitor OpenCRVS stack health. Useful for developers as this user will have no superuser privileges.                                                   |
| KIBANA\_PASSWORD                    | A password for a regular Kibana user to login and monitor OpenCRVS stack health                                                                                                                          |
| MONGODB\_ADMIN\_USER                | The MongoDB superuser admin username. A powerful account that has all rights to OpenCRVS data                                                                                                            |
| MONGODB\_ADMIN\_PASSWORD            | The MongoDB superuser admin password.                                                                                                                                                                    |
| MINIO\_ROOT\_USER                   | A username for a Minio superuser admin to login to the Minio console to view supporting document attachments submitted during registrations. <https://minio-console.\\>\<your\_domain>                   |
| MINIO\_ROOT\_PASSWORD               | A password for a Minio superuser admin                                                                                                                                                                   |
| SMTP\_HOST                          |                                                                                                                                                                                                          |
| SMTP\_PORT                          |                                                                                                                                                                                                          |
| SMTP\_USERNAME                      |                                                                                                                                                                                                          |
| SMTP\_PASSWORD                      |                                                                                                                                                                                                          |
| SMTP\_SECURE                        | Whether or not your SMTP port requires TLS                                                                                                                                                               |
| ALERT\_EMAIL                        | Email address or Slack channel address to send system technical alerts to.                                                                                                                               |
| SENDER\_EMAIL\_ADDRESS              | The sender email address that appears in all emails will need to be configured.                                                                                                                          |
| OPENCRVS\_METABASE\_ADMIN\_EMAIL    | Email address for metabase admin panel login                                                                                                                                                             |
| OPENCRVS\_METABASE\_ADMIN\_PASSWORD | Password for metabase admin panel login                                                                                                                                                                  |

#### Environment variables

| Variable                                                                       | Description                                                                                                                                                                                                                                                                                                                                                                                                |
| ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DOMAIN                                                                         | The host **domain name** (without www!) for your environment.                                                                                                                                                                                                                                                                                                                                              |
| CONTENT\_SECURITY\_POLICY\_WILDCARD                                            | This string is supplied to the clients and nginx config and ensures that the format of your domain above can be configurable for CORS purposes.                                                                                                                                                                                                                                                            |
| ACTIVATE\_USERS                                                                | When users are seeded, are they immediately active using a test password and six zeros as a 2-Factor auth code. Always false in production and staging.                                                                                                                                                                                                                                                    |
| AUTH\_HOST, CLIENT\_APP\_URL, COUNTRY\_CONFIG\_HOST, GATEWAY\_HOST, LOGIN\_URL | URLs passed to docker-compose to support internal microservice comms.                                                                                                                                                                                                                                                                                                                                      |
| DISK\_SPACE                                                                    | The amount of disk space set aside for encrypted PII data stored by OpenCRVS                                                                                                                                                                                                                                                                                                                               |
| NOTIFICATION\_TRANSPORT                                                        | A prop which can be used to configure either Email or SMS for staff and beneficiary comms or potentially both.                                                                                                                                                                                                                                                                                             |
| KUBE\_API\_HOST                                                                | Kubernetes API host domain name or IP address                                                                                                                                                                                                                                                                                                                                                              |
| WORKER\_NODES                                                                  | Comma separated list of Kubernetes workers nodes, in case you are planning to setup kubernetes cluster with multiple nodes. This property could be left empty for single node setup or you can add worker nodes later.                                                                                                                                                                                     |
| APPROVAL\_REQUIRED                                                             | Make approval required for this particular environment. If set to true all GitHub workflows will ask for approval, otherwise approval process will be optional even with defined `GH_APPROVERS` list. **NOTE:** "Reset environment" workflow required 3 approvals to proceed, that additional requirement was made for security reasons. Single person is not able to take decision for environment reset. |

#### **Optional environment secrets**

<table><thead><tr><th width="371">Parameter</th><th>Description</th></tr></thead><tbody><tr><td>BACKUP_SERVER_USER</td><td>User used to upload backups, users home directory is used as default path for backup. Is used by kubernetes backup jobs</td></tr><tr><td>BACKUP_ENCRYPTION_PASSPHRASE</td><td>Backup encryption passphrase, used only if backup is enabled. This is the password that is used to encrypt all the backups that OpenCRVS creates from a production server and that are stored on the <strong>backup</strong> server. Use this passphrase to decrypt the backups.</td></tr><tr><td>BACKUP_HOST_PUBLIC_KEY</td><td>ssh public key for <code>BACKUP_SERVER_USER</code> , used to authenticate kubernetes backup jobs on backup server</td></tr><tr><td>SENTRY_DSN</td><td>OpenCRVS can report application errors to <a href="https://sentry.io/">Sentry</a> in order to help you debug any issues in production.</td></tr><tr><td>BACKUP_HOST_PRIVATE_KEY</td><td>ssh private key for <code>BACKUP_SERVER_USER</code> is used for authentication by kubernetes backup jobs</td></tr></tbody></table>

#### **Optional environment variables**

| Parameter                  | Description                                                                                                                                                                                                                         |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| BACKUP\_HOST               | Backup server, define this property if you would like to manage backup server as part of your environment. Check Backup and restore section for more information how to use configure backup server. Used by kubernetes backup jobs |
| BACKUP\_ENVIRONMENT\_MODE  | Backup environment mode (full or differential).                                                                                                                                                                                     |
| RESTORE\_ENVIRONMENT\_NAME | GitHub environment name used to configure restore on staging line environments.                                                                                                                                                     |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://documentation.opencrvs.org/v2.0/technical/guides/installation/deploy-set-up-a-server-hosted-environment/create-a-github-environment/environment-secrets-and-variables-explained.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.