Configuration

Cargo’s install-time configuration lives in deploy/.env (mode 0600, generated by install.sh). Everything runtime-adjustable — the apps-domain suffix, SMTP, GitHub App, OIDC, alerts webhook — is managed from the admin area instead, so most installs never edit .env after setup.

A commented deploy/.env.example ships with the repo.

Required

Variable	Purpose
`CARGO_MASTER_KEY`	64 hex chars (32 bytes). Encrypts all secrets at rest. Back it up — losing it makes them unrecoverable. It can be rotated if you suspect it leaked.
`CARGO_DB_PASSWORD`	Password for the bundled Postgres container
`CARGO_DATABASE_URL`	Connection string; built automatically by `docker-compose.yml` from the password

Domains & TLS

Variable	Default	Purpose
`CARGO_PLATFORM_DOMAIN`	—	Where the Cargo UI is served. Empty for a local install.
`CARGO_APPS_SUFFIX`	`apps.localhost`	Apps are served at `<name>.<suffix>`
`CARGO_ACME_EMAIL`	—	Let’s Encrypt account email. Required with a TLS overlay.
`CARGO_DNS_PROVIDER`	—	Traefik DNS provider name for wildcard DNS-01 (e.g. `cloudflare`). Provider credentials (e.g. `CF_DNS_API_TOKEN`) go in `.env` too.

App container defaults

Instance-wide caps applied to any app that doesn’t override them in its settings.

Variable	Default	Purpose
`CARGO_DEFAULT_MEM_LIMIT`	`512m`	Memory cap per app container
`CARGO_DEFAULT_CPU_LIMIT`	`1`	CPU cap per app container
`CARGO_DEFAULT_PIDS_LIMIT`	`512`	Max processes per app container
`CARGO_DEPLOY_STRATEGY`	`bluegreen`	Default deploy strategy: `bluegreen` (zero-downtime) or `recreate`
`CARGO_MAX_MEM_LIMIT`	—	Absolute ceiling for per-app `mem_limit` — a tenant cannot raise their own app above it
`CARGO_MAX_CPU_LIMIT`	—	Absolute ceiling for per-app `cpus`
`CARGO_MAX_PIDS_LIMIT`	—	Absolute ceiling for per-app `pids_limit`

The three CARGO_MAX_* ceilings exist because per-app limits are advisory: without them, a tenant could set mem_limit to an arbitrarily large value. On a shared instance, set them to protect the host.

Git host screening

Variable	Default	Purpose
`CARGO_ALLOW_PRIVATE_GIT_HOSTS`	`false`	When true, allows cloning from git hosts that resolve to private addresses

Repository URLs are validated against server-side request forgery: only https://, ssh://, and git@host:path transports are accepted, and hosts that resolve to loopback, RFC1918, link-local, or cloud-metadata addresses are refused. Set this only if your git server is self-hosted on a private network — it widens where clones may go, never which transports. See Applications.

Operations

Variable	Default	Purpose
`CARGO_PLATFORM_BACKUP_KEEP`	`14`	Control-plane backup sets retained
`CARGO_DISK_MIN_FREE_PCT`	`10`	Warn/alert below this % free disk
`CARGO_AUDIT_RETENTION_DAYS`	`180`	Audit-log retention
`CARGO_API_RATELIMIT_RPS`	`20`	General API rate limit per user/IP (burst 2×)
`CARGO_METRICS_ADDR`	`:9090`	Internal-only Prometheus listener
`CARGO_TRAEFIK_METRICS_URL`	Traefik’s internal `:8082`	Where per-app traffic metrics are scraped from

Platform internals

Rarely changed; the defaults suit the bundled compose stack.

Variable	Default	Purpose
`CARGO_HTTP_ADDR`	`:8080`	Control-plane listen address
`CARGO_DATA_DIR`	`/var/lib/cargo`	Root of managed-DB volumes, snapshots, logs, and backups
`CARGO_ENV`	`development`	`development` or `production`; production enables HSTS and secure cookies
`CARGO_COMPOSE_PROJECT`	self-discovered	Compose project used to find platform containers
`CARGO_PLATFORM_DB_CONTAINER`	`db`	Compose service name of the platform database
`CARGO_DEV_PORT`	`8080`	Host port for the dev overlay only

Invalid values fail fast

Numeric settings are validated at startup — a non-numeric CARGO_DISK_MIN_FREE_PCT or a zero CARGO_PLATFORM_BACKUP_KEEP stops the control plane with a named error rather than silently falling back to a default.