TaskLabs
Back to home

Configuration

TaskLabs reads all runtime configuration from explicit environment values. There are no hardcoded ports, origins, credentials, or secrets in the Compose files, Dockerfiles, or application code.

Environment files

  • .env.example — documented template for the production stack.
  • .env — gitignored production values used by the production Compose file.
  • .env.dev.example — documented template for the dev stack.
  • .env.dev — gitignored dev values used by the dev Compose file.

Copy the matching example file, fill every value, and never commit real secrets. Both example files are tracked; the filled files are gitignored.

Required variables

VariablePurpose
FRONTEND_ORIGINPublic origin of the frontend (e.g. https://tasklabs.example.com).
NEXT_PUBLIC_CONVEX_URLConvex API origin the browser connects to.
CONVEX_SERVER_URLServer-side Convex URL for rendering and route handlers.
CONVEX_SELF_HOSTED_ADMIN_KEYAdmin key generated by the backend container. Never commit.
POSTGRES_URLPostgres cluster URL only — no /<database> path.
SITE_URLPublic site URL for Convex Auth.
JWT_PRIVATE_KEYGenerated Convex Auth signing key.
JWKSGenerated Convex Auth public key set.
TELEGRAM_API_ORIGINTelegram API origin required by the frontend CSP and Telegram actions.
TELEGRAM_WEBHOOK_ORIGINPublic HTTPS Convex site origin for the Telegram webhook.
CORS_ALLOWED_ORIGINSComma-separated exact-origin allow-list for browser CORS.

Compose interpolation uses ${VAR:?missing} so a missing required value fails fast at startup instead of silently defaulting.

Origins & CORS

Origins are explicit and never inferred. FRONTEND_ORIGIN and CORS_ALLOWED_ORIGINS must list exact origins. The MCP endpoint validates the request Host (or the first proxy-forwarded host) and any browser Origin against this allow-list.

No wildcard CORS

TaskLabs never uses wildcard CORS or local fallback origins in production. If a proxy fronts the app, its forwarded host must appear in the allow-list too.

Rules to keep

  • Do not add fallback defaults like ${VAR:-value} for runtime env.
  • Keep POSTGRES_URL cluster-only; a /<database> path makes the Convex backend exit.
  • Keep .env, .env.dev, and .env.local files out of commits.
  • Sync Convex deployment env from .env.dev before starting convex dev.
  • Leave TELEGRAM_WEBHOOK_ORIGIN empty until a real public HTTPS origin exists.
PreviousQuickstartNextUsing TaskLabs