Environment variables

167 variables, generated from two sources: the variables the Rust crates read (env::var and the env_* helpers), and medbrains/.env.example with its comments. Example is the value .env.example uses for local development, not necessarily the compiled default; the server's own defaults are in crates/medbrains-server-core/src/config.rs. Settings layer as compiled defaults, then config.toml, then environment variables.

Name	Example	What it does	Read by
`ABDM_BASE_URL`	`https://abhasbx.abdm.gov.in`	ABDM (Ayushman Bharat Digital Mission)	config file (`RawConfig`) or deploy kit
`ABDM_BEARER_TOKEN`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`ABDM_CLIENT_ID`			`medbrains-server`
`ABDM_CLIENT_SECRET`	secret: set in your secret store, never commit		`medbrains-server`
`ABDM_ENVIRONMENT`			`medbrains-server`
`ABDM_HIE_GATEWAY_URL`	`https://dev.abdm.gov.in/gateway/v0.5`		config file (`RawConfig`) or deploy kit
`ABDM_HIP_ID`	`medbrains.hip`		config file (`RawConfig`) or deploy kit
`AI_MODEL`			`medbrains-server-services`
`AI_PROVIDER`	`anthropic`	Anthropic API — dev/eval on synthetic data only (production AI is Bedrock above; startup warns that this provider is outside India). There is NO Anthropic API key anywhere: the server, and the eval harness, sign in with their AWS identity b	`medbrains-server`, `medbrains-server-services`
`AI_QUERY_TEST_DATABASE_URL`			`medbrains-ai`
`ANATOMY_CDN_ORIGIN`	`https://dxxxxxxxxxxxx.cloudfront.net`	CDN origin serving the body-site anatomy model (bare https://host). Joins the SPA's CSP connect-src. Leave unset when the model is served from /anatomy.	`medbrains-server`
`ANTHROPIC_AWS_PROFILE`	`medbrains-claude # laptop only; unset = ambient AWS credentials`		config file (`RawConfig`) or deploy kit
`ANTHROPIC_AWS_REGION`	`ap-south-1 # where STS signs the identity token (default)`		config file (`RawConfig`) or deploy kit
`ANTHROPIC_FEDERATION_RULE_ID`	`fdrl_01TsZUU4SvQdgNzheHcx7mpT`		config file (`RawConfig`) or deploy kit
`ANTHROPIC_ORGANIZATION_ID`	`d6f15fb3-c3e7-41d0-a30e-b32170a1420a`		config file (`RawConfig`) or deploy kit
`ANTHROPIC_SERVICE_ACCOUNT_ID`	`svac_01YAU6D9HuQytpETGjhuYrgQ`		config file (`RawConfig`) or deploy kit
`ANTHROPIC_WORKSPACE_ID`	`wrkspc_016nVbho3L6ZPaHea3kJ3Z2y`		config file (`RawConfig`) or deploy kit
`APP_ORIGIN`	`https://medbrains.localhost`		config file (`RawConfig`) or deploy kit
`BEDROCK_API_KEY`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`BEDROCK_BASE_URL`			`medbrains-server`, `medbrains-server-services`
`BEDROCK_REGION`	`ap-south-1`		`medbrains-server`, `medbrains-server-services`
`COOKIE_DOMAIN`			`medbrains-server`
`CORS_ORIGIN`	`https://medbrains.localhost,https://medbrains-desktop.localhost,https://medbrains-icd.localhost`	CORS & Cookies	config file (`RawConfig`) or deploy kit
`DATABASE_URL`	`postgres://medbrains_app:medbrains_dev@localhost:5435/medbrains`	PostgreSQL Three roles, three URLs (docs/ops/DB-ROLES.md): DATABASE_URL medbrains_app — requests; row level security applies MIGRATION_DATABASE_URL medbrains (owner) — migrations and seeding WORKER_DATABASE_URL	`medbrains-analytics`, `medbrains-ancillary`, `medbrains-auth`, `medbrains-authz`, `medbrains-automation-store`, `medbrains-billing`, `medbrains-db`, `medbrains-health-intel`, `medbrains-health-services`, `medbrains-kernel`, `medbrains-knowledge`, `medbrains-mrd`, `medbrains-nabh`, `medbrains-reports`, `medbrains-research`, `medbrains-security-intel`, `medbrains-server`, `medbrains-sop-flows`, `medbrains-vte`
`DB_POOL_ACQUIRE_TIMEOUT_SECS`	`5`		config file (`RawConfig`) or deploy kit
`DB_POOL_IDLE_TIMEOUT_SECS`	`600`		config file (`RawConfig`) or deploy kit
`DB_POOL_MAX_CONNECTIONS`	`20`		config file (`RawConfig`) or deploy kit
`DB_POOL_MAX_LIFETIME_SECS`	`1800`		config file (`RawConfig`) or deploy kit
`DB_POOL_MIN_CONNECTIONS`	`2`		config file (`RawConfig`) or deploy kit
`DB_SLOW_QUERY_MS`	`250`		config file (`RawConfig`) or deploy kit
`DB_STATEMENT_CACHE_CAPACITY`	`256`		config file (`RawConfig`) or deploy kit
`DLT_ENFORCE`	`true # India: refuse to send if no registered template matches event scope`		config file (`RawConfig`) or deploy kit
`EMAIL_FROM_ADDRESS`	`hospital@example.com`		`medbrains-infra-settings`
`EMAIL_FROM_NAME`	`MedBrains Hospital`		config file (`RawConfig`) or deploy kit
`EMAIL_PROVIDER`	`sendgrid # or "ses" (pending SigV4)`	Email — SendGrid (production) or stub (dev) when unset	config file (`RawConfig`) or deploy kit
`EVAL_AI_MODEL`			`medbrains-ai-eval`
`EVAL_AI_PRICE`			`medbrains-ai-eval`
`EVAL_AI_PROVIDER`	`anthropic EVAL_AI_MODEL=claude-haiku-5-5 make eval-ai-live`	Live eval against Anthropic (`make eval-ai-live`):	`medbrains-ai-eval`
`EXPO_PUBLIC_API_BASE`	`https://medbrains.localhost`		config file (`RawConfig`) or deploy kit
`FLOW_TICK_SECS`			`medbrains-flow`
`GITHUB_ISSUES_API_URL`			`medbrains-client-errors`
`GITHUB_ISSUES_INCLUDE_CLIENT_STACK`	`false`		`medbrains-client-errors`
`GITHUB_ISSUES_LABELS`	`bug,client-error`		`medbrains-client-errors`
`GITHUB_ISSUES_REPO`	`owner/repo`		`medbrains-client-errors`
`GITHUB_ISSUES_TOKEN`	secret: set in your secret store, never commit	GitHub issue creation for frontend crash reports (optional)	`medbrains-client-errors`
`GOTENBERG_URL`	`http://127.0.0.1:3005`	Server-side PDF rendering (documents API). Point at the gotenberg container from docker-compose. Unset = documents endpoints 503.	`medbrains-print`
`HOST`	`0.0.0.0`	Server	config file (`RawConfig`) or deploy kit
`ICD_API_INCLUDE`	`2026-01_en`		config file (`RawConfig`) or deploy kit
`ICD_API_PORT`	`8382`		config file (`RawConfig`) or deploy kit
`ICD_API_SAVE_ANALYTICS`	`false`		config file (`RawConfig`) or deploy kit
`JWT_PRIVATE_KEY`	secret: set in your secret store, never commit	JWT (Ed25519 keys — leave unset for auto-generated dev keypair; REQUIRED when MEDBRAINS_ENV=production)	config file (`RawConfig`) or deploy kit
`JWT_PUBLIC_KEY`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`LOADTEST_DEBUG`			`medbrains-loadtest`
`LOADTEST_DOCTOR_ID`			`medbrains-loadtest`
`LOADTEST_FORWARDED`			`medbrains-loadtest`
`LOADTEST_PASSWORD`	secret: set in your secret store, never commit		`medbrains-loadtest`
`LOADTEST_USERNAME`			`medbrains-loadtest`
`MB_OS_TEST_ARCH`			`medbrains-os-test`
`MB_OS_TEST_ONLY`			`medbrains-os-test`
`MEDBRAINS_ABDM_SECRET_KEY`	secret: set in your secret store, never commit	Keys the Aadhaar/ID fingerprints used to spot the same person twice. Changing it orphans every stored fingerprint.	config file (`RawConfig`) or deploy kit
`MEDBRAINS_ADVISORY_BUNDLE`	`/usr/share/medbrains/advisories.json`		`medbrains-security-intel`
`MEDBRAINS_ADVISORY_FETCH`	`off`	check reads the advisory bundle shipped with the release (scripts/build_advisory_bundle.py); with neither it reports "could not check", never "no vulnerabilities".	`medbrains-security-intel`
`MEDBRAINS_API_BASE`			`medbrains-server`
`MEDBRAINS_BINDING_SIGNING_KEY`	secret: set in your secret store, never commit	openssl x509 -in cert.pem -pubkey -noout \| openssl pkey -pubin -outform der \ \| openssl dgst -sha256 -binary \| base64	config file (`RawConfig`) or deploy kit
`MEDBRAINS_DEPLOY_MODE`			`medbrains-core`
`MEDBRAINS_DISABLE_OUTBOX_WORKER`			`medbrains-server`
`MEDBRAINS_DISABLE_SIMULATOR_SCHEDULER`			`medbrains-server`
`MEDBRAINS_ENABLE_E2E_SEED`			`medbrains-server`
`MEDBRAINS_ENV`	`production`	Deployment environment: development (default) \| production. production refuses to start without JWT keys and disables demo seeding.	`medbrains-core`, `medbrains-dictation`, `medbrains-outbox`, `medbrains-payment-gateway`, `medbrains-seed`, `medbrains-server`
`MEDBRAINS_EVENT_TOKEN_KEY`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`MEDBRAINS_HOSTED`	`true (MedBrains-hosted installs default ON). Off, the`	── Security intelligence (RFC-OSINT phase 1) Dependency advisories: the server compares the crate/npm versions it was built from with OSV. Network lookups are OFF unless set here, or unless	`medbrains-core`, `medbrains-security-intel`
`MEDBRAINS_IDENTIFIER_HMAC_KEY`	secret: set in your secret store, never commit	Production will not start without MEDBRAINS_IDENTIFIER_HMAC_KEY. The ABDM, NHCX and PACS keys are optional: without one the server starts with that integration off (ABDM + UHI, NHCX, or the PACS password) and its settings screen says which	config file (`RawConfig`) or deploy kit
`MEDBRAINS_LOG_FAILED_PAYLOADS`	`0`	Log the query and JSON body of failed requests (not 401s), identity masked, clinical values kept. Turn on only while chasing a failure.	`medbrains-server-core`
`MEDBRAINS_LOG_PAYLOAD_SIZES`			`medbrains-server-core`
`MEDBRAINS_NHCX_SECRET_KEY`	secret: set in your secret store, never commit	Encrypts the ABDM client secret at rest. Changing it means re-entering the secret on the ABDM settings screen.	config file (`RawConfig`) or deploy kit
`MEDBRAINS_NOTIFY_SIMULATOR`	`true`	Message simulator — dev and test ONLY. SMS, WhatsApp and email are stored in `simulated_messages` and shown in Admin → Message Simulator instead of being sent. The server refuses to start with this on and MEDBRAINS_ENV=production.	`medbrains-server`
`MEDBRAINS_OBJECTS_HOT`	`/var/lib/medbrains/objects`	Generated-document storage root (LocalFs object store). Defaults to ./data/objects in dev; the deploy kit sets /var/lib/medbrains/objects.	`medbrains-server`
`MEDBRAINS_OSV_URL`			`medbrains-security-intel`
`MEDBRAINS_PACS_ALLOWED_HOSTS`	`pacs.example-hospital.in`	Encrypts each hospital's PACS password at rest. Changing it means re-entering it in Radiology → PACS.	config file (`RawConfig`) or deploy kit
`MEDBRAINS_PACS_SECRET_KEY`	secret: set in your secret store, never commit	Encrypts the NHCX client secret and private key at rest. Changing it means re-entering both in Settings → NHCX.	config file (`RawConfig`) or deploy kit
`MEDBRAINS_PUBLIC_BASE_URL`	`https://hims.example.org # where apps reach this server`	Hospital binding QR (Admin -> Devices -> Bind apps). Apps scan it and talk only to this server, pinned to its TLS key.	`medbrains-print-data`, `medbrains-signing`, `medbrains-sso-login`
`MEDBRAINS_RETENTION_DRY_RUN`	`true`	Retention enforcement: set true to log what the daily pass WOULD purge without deleting anything.	`medbrains-server`
`MEDBRAINS_SECRETS_BACKEND`	secret: set in your secret store, never commit	Secrets backend (where runtime secrets — payment keys, OAuth creds — resolve from). env (default) \| file \| aws. Unset → derived from MEDBRAINS_DEPLOY_MODE (onprem → file at /etc/medbrains/secrets, saas/hybrid → aws). The 'aws' backend (AW	`medbrains-server`
`MEDBRAINS_SEED_ADMIN_PASSWORD`	secret: set in your secret store, never commit	Initial admin password for first seed. REQUIRED in production (dev falls back to admin123). The account is flagged for forced password change on first login in production.	`medbrains-seed`
`MEDBRAINS_SEED_ADMIN_PASSWORD_CHOSEN`	secret: set in your secret store, never commit		`medbrains-seed`
`MEDBRAINS_SEED_ADMIN_PASSWORD_HASH`	secret: set in your secret store, never commit		`medbrains-seed`
`MEDBRAINS_SEED_ADMIN_USERNAME`			`medbrains-seed`
`MEDBRAINS_SEED_DEMO_DATA`			`medbrains-seed`
`MEDBRAINS_SEED_HOSPITAL_NAME`			`medbrains-seed`
`MEDBRAINS_SIGNATURE_KEY_ENCRYPTION_KEY`	secret: set in your secret store, never commit	Local cryptographic material Use different random 32+ byte values per environment/tenant group. SIGNATURE key wraps doctor Ed25519 signing keys at rest. EVENT token key encrypts opaque QR/barcode event tokens.	config file (`RawConfig`) or deploy kit
`MEDBRAINS_SINGLE_HOSPITAL`			`medbrains-auth`
`MEDBRAINS_SSO_SCREEN_BASE`			`medbrains-sso-login`
`MEDBRAINS_TENANT_ID`	`<tenant-uuid>`	Deployment ↔ tenant binding (on-prem single-hospital). Pins this deployment to its hospital so the sign-in page brands correctly, host-independent and stable across restarts (no custom-domain match needed). The public brand endpoint (/api/p	`medbrains-setup`
`MEDBRAINS_TENANT_LOGO`	`https://cdn.example/hospital-logo.svg`		`medbrains-setup`
`MEDBRAINS_TENANT_NAME`	`Alagappa Medical College & Hospital`		`medbrains-setup`
`MEDBRAINS_TLS_SPKI_SHA256`	`... # base64 SHA-256 of the cert's public key:`		config file (`RawConfig`) or deploy kit
`MEDBRAINS_VENDOR_BACKFILL_MAX`			`medbrains-core`
`MEDBRAINS_VENDOR_EMAIL_DOMAINS`			`medbrains-core`
`MIGRATION_DATABASE_URL`	`postgres://medbrains:medbrains_dev@localhost:5435/medbrains`	The connection migrations and seeding run on. Must own the schema — the application role deliberately cannot create tables or alter policies, so without this the server fails at boot with "permission denied for schema public" before it has	`medbrains-server`
`NHCX_BASE_URL`	`https://apisbx.abdm.gov.in/hcx/v1 # sandbox`	NHCX (insurance claims gateway, India)	config file (`RawConfig`) or deploy kit
`NHCX_BEARER_TOKEN`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`NHCX_PARTICIPANT_CODE`	`hospital@nhcx`		config file (`RawConfig`) or deploy kit
`NHCX_PRIVATE_KEY_PEM`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`NHCX_RECIPIENT_PUBLIC_KEY`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`NOTIFY_SOCKET`			`medbrains-proxy`
`NO_COLOR`			`medbrains-server-core`
`NRCES_BUNDLE_DIR`			`medbrains-facilities`, `medbrains-fhir`, `medbrains-fhir-api`, `medbrains-nhcx-callback`, `medbrains-server`
`OLLAMA_API_BASE_URL`			`medbrains-server-services`
`OPENROUTER_API_KEY`	secret: set in your secret store, never commit		`medbrains-server-services`
`OUT_DIR`			`medbrains-security-intel`
`PORT`	`3000`		config file (`RawConfig`) or deploy kit
`RAZORPAY_KEY_ID`			`medbrains-payment-gateway`, `medbrains-pharmacy-delivery`
`RAZORPAY_KEY_SECRET`	secret: set in your secret store, never commit		`medbrains-payment-gateway`, `medbrains-pharmacy-delivery`
`RAZORPAY_WEBHOOK_SECRET`	secret: set in your secret store, never commit		`medbrains-payment-gateway`
`REPORTS_DATABASE_URL`	`postgres://medbrains_app:medbrains_dev@replica:5432/medbrains`	Reports, analytics, dashboard tiles and the AI query tool run on a pool of their own (docs/ops/DB-ROLES.md, "The report database"): read only, each statement stopped after the timeout, at most N heavy reports per hospital. Set REPORTS_DATAB	`medbrains-server`
`REPORTS_DB_POOL_MAX_CONNECTIONS`	`4`		`medbrains-server`
`REPORTS_MAX_CONCURRENT_PER_TENANT`	`2`		config file (`RawConfig`) or deploy kit
`REPORTS_SLOT_WAIT_MS`	`5000`		config file (`RawConfig`) or deploy kit
`REPORTS_STATEMENT_TIMEOUT_MS`	`15000`		config file (`RawConfig`) or deploy kit
`RESEARCH_TEST_DATABASE_URL`			`medbrains-ancillary`, `medbrains-research`
`RUST_LOG`	`medbrains_server=debug,tower_http=debug`	Logging	config file (`RawConfig`) or deploy kit
`S3_ACCESS_KEY_ID`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`S3_BUCKET`	`medbrains-alagappa-uploads-ap-south-1`	S3 — patient document uploads (MLC, MRD, consent forms, etc.) Bucket is provisioned by infra/terraform/modules/hospital-package. Leave blank for local dev; the /api/upload/presign endpoints return 400 Bad Request when S3 is not configured.	config file (`RawConfig`) or deploy kit
`S3_ENDPOINT`	`# leave blank for AWS; set for MinIO`		config file (`RawConfig`) or deploy kit
`S3_REGION`	`ap-south-1`		config file (`RawConfig`) or deploy kit
`S3_SECRET_ACCESS_KEY`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`SECURE_COOKIES`	`true`		config file (`RawConfig`) or deploy kit
`SENDGRID_API_KEY`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`SMTP_HOST`	`mail.medbrains.localhost`	(make dev-mail-mailboxes) every account uses the same dev value.	config file (`RawConfig`) or deploy kit
`SMTP_INSECURE_TLS`	`1`	Dev only: accept the local Stalwart's mkcert TLS cert. The SMTP client (rustls) doesn't use the OS keychain, so it sees the dev cert as untrusted and sends fail "invalid peer certificate". Never set in production.	`medbrains-outbox`
`SMTP_PASSWORD`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`SMTP_PORT`	`587`		config file (`RawConfig`) or deploy kit
`SMTP_TLS`	`starttls # starttls \| implicit \| none`		config file (`RawConfig`) or deploy kit
`SMTP_USERNAME`			config file (`RawConfig`) or deploy kit
`SNOMED_FHIR_AUTHORIZATION`			`medbrains-snomed`
`SNOMED_FHIR_BASE_URL`			`medbrains-snomed`
`SNOMED_FHIR_TIMEOUT_MS`			`medbrains-snomed`
`SNOMED_IMPORT_DIR`			`medbrains-terminology`
`SNOMED_MAX_UNPACKED_BYTES`			`medbrains-terminology`
`SNOMED_UPLOAD_MAX_BYTES`			`medbrains-terminology`
`SPICEDB_ENDPOINT`	`http://localhost:50051`	ReBAC — SpiceDB sidecar (optional; falls back to PgAuthzBackend)	`medbrains-authz-spicedb`, `medbrains-server`
`SPICEDB_TEST`			`medbrains-authz-spicedb`
`SPICEDB_TOKEN`	secret: set in your secret store, never commit		`medbrains-authz-spicedb`, `medbrains-server`
`SSO_CONFIG_FILE`			`medbrains-identity`
`STALWART_ADMIN_SECRET`	secret: set in your secret store, never commit		`medbrains-mail-provisioning`
`STALWART_ADMIN_USER`	`admin`		`medbrains-mail-provisioning`
`STALWART_API_URL`	`https://localhost:8086`		`medbrains-mail-provisioning`
`STALWART_INSECURE_TLS`	`1`		`medbrains-mail-provisioning`
`TEST_APP_DATABASE_URL`			`medbrains-server`
`TRIAL_SIGNUP`			`medbrains-onboarding`, `medbrains-server`
`TRUSTED_PROXIES`	`127.0.0.1/32,::1/128`		config file (`RawConfig`) or deploy kit
`TWILIO_ACCOUNT_SID`	`ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`	SMS — Twilio (production) or stub (dev) when unset	config file (`RawConfig`) or deploy kit
`TWILIO_AUTH_TOKEN`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`TWILIO_FROM_NUMBER`	`+91XXXXXXXXXX`		config file (`RawConfig`) or deploy kit
`TWILIO_MESSAGING_SERVICE_SID`	`MGxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx # India DLT routing (optional)`		config file (`RawConfig`) or deploy kit
`UHI_GATEWAY_PUBLIC_KEY_PRODUCTION`	`MCowBQYDK2VwAyEA...`		config file (`RawConfig`) or deploy kit
`UHI_GATEWAY_PUBLIC_KEY_SANDBOX`	`MCowBQYDK2VwAyEA...`	UHI provider (Settings -> UHI). The gateway's public key (base64 SPKI) as NHA issues it, per environment; unset falls back to the UHI registry.	config file (`RawConfig`) or deploy kit
`UHI_PREVIEW_SERVICES`	`true`	Offer services UHI does not yet support from a provider (teleconsultation with online payment, lab tests). Leave unset.	config file (`RawConfig`) or deploy kit
`WHATSAPP_ACCESS_TOKEN`	secret: set in your secret store, never commit		config file (`RawConfig`) or deploy kit
`WHATSAPP_PHONE_NUMBER_ID`	`000000000000000`	WhatsApp — Meta Cloud API	config file (`RawConfig`) or deploy kit
`WHO_ICD_API_BASE_URL`	`https://id.who.int`		`medbrains-platform`
`WHO_ICD_AUTH_MODE`	`oauth`		`medbrains-platform`
`WHO_ICD_CLIENT_ID`	`<client-id>`	Cloud fallback mode: register at https://icd.who.int/icdapi and keep credentials out of source control. Local proxy mode should stay the default for dev/research installs.	`medbrains-platform`
`WHO_ICD_CLIENT_SECRET`	secret: set in your secret store, never commit		`medbrains-platform`
`WHO_ICD_RELEASE_ID`	`2026-01`		`medbrains-platform`
`WHO_ICD_TOKEN_URL`	secret: set in your secret store, never commit		`medbrains-platform`
`WORKER_DATABASE_URL`	`postgres://medbrains_outbox_worker:medbrains_dev@localhost:5435/medbrains`	The background workers' pool. They have no request to take a tenant from — the outbox drains one queue for every hospital, and the escalation passes have to find overdue work before they can act on it per tenant — so this names a role that	`medbrains-server`