Environment Variables & Secrets

Setting plain environment variables

When deploying a custom app, you can pass environment variables that get injected into your container at runtime.

Via the portal: on the Apps page deploy form, add key-value pairs in the environment variables section. After deploying, update them by editing the app.

Via the API:

POST /api/portal/apps
{
  "name": "my-api",
  "image": "registry.compacthive.dev/<project>/my-api:latest",
  "port": 3000,
  "env": {
    "NODE_ENV": "production"
  }
}

Plain environment variables set this way are stored in the Kubernetes Deployment spec — fine for non-sensitive config, but don't put API keys or passwords in them.

Secrets (sensitive values)

For API keys, database passwords, and other sensitive values, use the app's Secrets tab instead of a plain env var. Secrets are written to your tenant's Vault, injected into the container, and rotated (the previous value stays valid briefly during a rotation so an in-flight request doesn't break) — the value itself never appears in the Deployment spec or in logs.

Connecting to platform services

CompactHive services run in your namespace and are reachable over Kubernetes' internal DNS — no VPN or external access needed from your own app.

Check the portal Connect page for the exact values for your tenant — it also has a pre-filled connection string for each service.

Common patterns

# Node.js
PORT=3000
NODE_ENV=production
DATABASE_URL=postgresql://user:pass@pg-<tenant-id>-rw:5432/app

# Python / FastAPI
APP_ENV=production
DATABASE_URL=postgresql://user:pass@pg-<tenant-id>-rw:5432/app
REDIS_URL=redis://cache-<tenant-id>:6379

# Go
GIN_MODE=release
DB_HOST=pg-<tenant-id>-rw
DB_PORT=5432