Environment Variables
Each app has its own key/value environment variables, injected into the container at deploy time.
Properties
- Encrypted at rest — values are sealed with AES-256-GCM using the
instance’s
CARGO_MASTER_KEY - Write-only — after saving, values can be replaced but never read back through the UI
- Applied on deploy — changing env vars triggers a reconcile on the next deploy; redeploy the app to pick up changes
- Validated keys — env var keys are checked for validity; values are applied atomically in one transaction (no partial state on failure)
The master key is unrecoverable
Env vars (and stored registry credentials) are encrypted with
CARGO_MASTER_KEY. If you lose it, the values are
unrecoverable. Back it up — see
Installation. If the key leaks rather than
gets lost, you can
rotate it without losing anything.
Attached databases
Attaching a managed database injects its connection variable automatically, with per-app isolated credentials:
| Engine | Injected variable |
|---|---|
| Postgres | DATABASE_URL |
| MySQL | MYSQL_URL |
| MongoDB | MONGODB_URL |
| Redis | REDIS_URL |
The keys are distinct per engine, so one app can attach one of each without collisions. Attaching fails if the app already defines that key itself. See Managed databases.