Environment Configuration

The backend is configured through environment variables. For the full variable catalog, see the Environment Variables reference; for local-dev knobs, see Environment Variables under Contribute. This page covers the backend-specific conventions those references assume.

Environment files

.env — local development (written by ./rh dev init; see the Backend Overview)
.env.docker — Docker Compose
.env.test — test runs (not committed)

Runtime environment label

BACKEND_ENV is the canonical runtime environment label in Python settings and logging. Valid values are production, development, staging, and local; anything else fails validation at startup.

settings.py
from rhesis.backend.app.config.settings import get_application_settings

settings = get_application_settings()

if settings.is_production:
    ...
elif settings.is_development:
    ...

Shell entrypoints may still read ENVIRONMENT for deployment-script behavior, but application code should use BACKEND_ENV.

Database credentials

Database URLs are built from component variables. Runtime application sessions use APP_DB_USER / APP_DB_PASS; migrations and administrative jobs use ADMIN_DB_USER / ADMIN_DB_PASS when present and fall back to the app credentials for single-role local setups.

Variable	Required	Used for
`DB_DRIVER`	No, defaults to `postgresql`	SQLAlchemy driver
`DB_HOST`	Yes	Database host or Unix socket path
`DB_PORT`	No, defaults to `5432`	TCP port when `DB_HOST` is not a socket
`DB_NAME`	Yes	Database name
`APP_DB_USER`	Yes for runtime backend and workers	Least-privilege application database role
`APP_DB_PASS`	Yes when `APP_DB_USER` is set	Application role password
`ADMIN_DB_USER`	Optional	Migration or admin database role
`ADMIN_DB_PASS`	Required when `ADMIN_DB_USER` is set	Admin role password

Managed Postgres deployments should use a separate migration role through ADMIN_DB_* and a least-privilege runtime role through APP_DB_*. RLS-aware migrations do not require a PostgreSQL superuser.

Secrets

Never commit secrets. Use placeholder values in .env.example, distinct keys per environment, and a secret manager in production. See Deployment for how secrets are supplied to cloud runtimes.