Configuration
Every setting in .env.example for a copy you run yourself, grouped as the file groups them.
A copy you run with Docker Compose reads its settings from .env, which starts as a copy of .env.example. Configuration explains the ones that matter most; this is the whole list, with each setting's example value.
Version
CAREERBOT_VERSIONWhich CareerBot release to run. Unset: the release this compose.yaml came with. A version such as 0.8.0 stays on it until you change it here; `latest` moves to the newest release on each `docker compose pull`. Before changing it, back up and read the release notes: https://careerbot.dev/changelog
Your site
SITE_URLhttp://localhost:3000Where people open CareerBot, as the browser sees it. On your own computer: http://localhost:3000. On a server with a domain: its https address (https://careerbot.example.com), with your proxy or tunnel sending it to WEB_PORT.
Convex: pick one
NEXT_PUBLIC_CONVEX_URLhttps://your-deployment.convex.cloudA) Convex's cloud (free plan). Create a project at https://dashboard.convex.dev, then: NEXT_PUBLIC_CONVEX_URL: Settings > URL & Deploy Key, the deployment URL (https://….convex.cloud) CONVEX_DEPLOY_KEY: Settings > URL & Deploy Key, Generate Production Deploy Key CONVEX_SITE_ORIGIN isn't needed: Google and GitHub send people back to https://….convex.site. Uncomment the two lines below and comment out or delete B's four lines.CONVEX_DEPLOY_KEYprod:your-deployment|…A) Convex's cloud (free plan). Create a project at https://dashboard.convex.dev, then: NEXT_PUBLIC_CONVEX_URL: Settings > URL & Deploy Key, the deployment URL (https://….convex.cloud) CONVEX_DEPLOY_KEY: Settings > URL & Deploy Key, Generate Production Deploy Key CONVEX_SITE_ORIGIN isn't needed: Google and GitHub send people back to https://….convex.site. Uncomment the two lines below and comment out or delete B's four lines.COMPOSE_PROFILESself-hostedB) Self-hosted Convex, run by this compose file on this computer. Its data stays in the convex-data Docker volume. On a server with a domain, NEXT_PUBLIC_CONVEX_URL and CONVEX_SITE_ORIGIN are two https addresses of their own (https://convex.example.com, https://convex-site.example.com) that your proxy sends to CONVEX_PORT and CONVEX_SITE_PORT. CONVEX_SELF_HOSTED_URL stays as it is: the setup step reaches Convex inside compose.NEXT_PUBLIC_CONVEX_URLhttp://localhost:3210B) Self-hosted Convex, run by this compose file on this computer. Its data stays in the convex-data Docker volume. On a server with a domain, NEXT_PUBLIC_CONVEX_URL and CONVEX_SITE_ORIGIN are two https addresses of their own (https://convex.example.com, https://convex-site.example.com) that your proxy sends to CONVEX_PORT and CONVEX_SITE_PORT. CONVEX_SELF_HOSTED_URL stays as it is: the setup step reaches Convex inside compose.CONVEX_SITE_ORIGINhttp://localhost:3211B) Self-hosted Convex, run by this compose file on this computer. Its data stays in the convex-data Docker volume. On a server with a domain, NEXT_PUBLIC_CONVEX_URL and CONVEX_SITE_ORIGIN are two https addresses of their own (https://convex.example.com, https://convex-site.example.com) that your proxy sends to CONVEX_PORT and CONVEX_SITE_PORT. CONVEX_SELF_HOSTED_URL stays as it is: the setup step reaches Convex inside compose.CONVEX_SELF_HOSTED_URLhttp://convex-backend:3210B) Self-hosted Convex, run by this compose file on this computer. Its data stays in the convex-data Docker volume. On a server with a domain, NEXT_PUBLIC_CONVEX_URL and CONVEX_SITE_ORIGIN are two https addresses of their own (https://convex.example.com, https://convex-site.example.com) that your proxy sends to CONVEX_PORT and CONVEX_SITE_PORT. CONVEX_SELF_HOSTED_URL stays as it is: the setup step reaches Convex inside compose.
Signing in
SIGNUP_ALLOWLISTPeople sign in with a username and password: the owner's account is made with the setup code, and the owner adds everyone else in Settings, Account. Google and GitHub are optional; the sign-in screen offers them once they're set. Who may sign in with Google or GitHub: their emails, comma-separated. Empty: nobody (password accounts don't need it). Changing the list takes effect after `docker compose up -d`; to empty it again, delete SIGNUP_ALLOWLIST in the Convex dashboard's environment variables (an empty value here leaves the one there as it is).AUTH_GOOGLE_IDEach of Google and GitHub needs an OAuth app whose callback URL is your Convex HTTP actions URL plus /api/auth/callback/google (or /github): self-hosted on this computer: http://localhost:3211/api/auth/callback/google self-hosted on a server: CONVEX_SITE_ORIGIN/api/auth/callback/google (https://convex-site.example.com/…) Convex's cloud: https://your-deployment.convex.site/api/auth/callback/google Google: https://console.cloud.google.com/apis/credentials (OAuth client ID, Web application) GitHub: https://github.com/settings/developers (New OAuth App; its homepage URL is SITE_URL)AUTH_GOOGLE_SECRETEach of Google and GitHub needs an OAuth app whose callback URL is your Convex HTTP actions URL plus /api/auth/callback/google (or /github): self-hosted on this computer: http://localhost:3211/api/auth/callback/google self-hosted on a server: CONVEX_SITE_ORIGIN/api/auth/callback/google (https://convex-site.example.com/…) Convex's cloud: https://your-deployment.convex.site/api/auth/callback/google Google: https://console.cloud.google.com/apis/credentials (OAuth client ID, Web application) GitHub: https://github.com/settings/developers (New OAuth App; its homepage URL is SITE_URL)AUTH_GITHUB_IDEach of Google and GitHub needs an OAuth app whose callback URL is your Convex HTTP actions URL plus /api/auth/callback/google (or /github): self-hosted on this computer: http://localhost:3211/api/auth/callback/google self-hosted on a server: CONVEX_SITE_ORIGIN/api/auth/callback/google (https://convex-site.example.com/…) Convex's cloud: https://your-deployment.convex.site/api/auth/callback/google Google: https://console.cloud.google.com/apis/credentials (OAuth client ID, Web application) GitHub: https://github.com/settings/developers (New OAuth App; its homepage URL is SITE_URL)AUTH_GITHUB_SECRETEach of Google and GitHub needs an OAuth app whose callback URL is your Convex HTTP actions URL plus /api/auth/callback/google (or /github): self-hosted on this computer: http://localhost:3211/api/auth/callback/google self-hosted on a server: CONVEX_SITE_ORIGIN/api/auth/callback/google (https://convex-site.example.com/…) Convex's cloud: https://your-deployment.convex.site/api/auth/callback/google Google: https://console.cloud.google.com/apis/credentials (OAuth client ID, Web application) GitHub: https://github.com/settings/developers (New OAuth App; its homepage URL is SITE_URL)
Made for you the first time
JWT_PRIVATE_KEYLeft empty, the first `docker compose up` makes these and keeps them in your Convex deployment's settings. Set them only to bring keys from another copy. MASTER_KEY_V1 encrypts the API keys people save in CareerBot; losing it means entering those again.JWKSLeft empty, the first `docker compose up` makes these and keeps them in your Convex deployment's settings. Set them only to bring keys from another copy. MASTER_KEY_V1 encrypts the API keys people save in CareerBot; losing it means entering those again.MASTER_KEY_V1Left empty, the first `docker compose up` makes these and keeps them in your Convex deployment's settings. Set them only to bring keys from another copy. MASTER_KEY_V1 encrypts the API keys people save in CareerBot; losing it means entering those again.
Optional
GOOGLE_PICKER_KEYChoosing a Google Drive folder in Settings (a browser API key for Google's Picker).LIQUIDAI_API_KEYLiquid AI's model, for an experiment in sorting roles.UPDATE_CHECKoffOnce a day this copy asks https://careerbot.dev/releases.json whether there's a newer version, and its owner sees it in Settings, Updates. Nothing about you or this copy is sent, but like any web request it shows careerbot.dev this server's IP address. off: never ask (the owner can also turn it off there).WEB_PORT3000Ports on this computer, if the defaults are taken. Change SITE_URL, NEXT_PUBLIC_CONVEX_URL and CONVEX_SITE_ORIGIN to match when they're localhost addresses (behind a domain they stay as they are). Dokploy's own dashboard is on 3000: there, set WEB_PORT=3001 or another free port.CONVEX_PORT3210Ports on this computer, if the defaults are taken. Change SITE_URL, NEXT_PUBLIC_CONVEX_URL and CONVEX_SITE_ORIGIN to match when they're localhost addresses (behind a domain they stay as they are). Dokploy's own dashboard is on 3000: there, set WEB_PORT=3001 or another free port.CONVEX_SITE_PORT3211Ports on this computer, if the defaults are taken. Change SITE_URL, NEXT_PUBLIC_CONVEX_URL and CONVEX_SITE_ORIGIN to match when they're localhost addresses (behind a domain they stay as they are). Dokploy's own dashboard is on 3000: there, set WEB_PORT=3001 or another free port.CONVEX_DASHBOARD_PORT6791Ports on this computer, if the defaults are taken. Change SITE_URL, NEXT_PUBLIC_CONVEX_URL and CONVEX_SITE_ORIGIN to match when they're localhost addresses (behind a domain they stay as they are). Dokploy's own dashboard is on 3000: there, set WEB_PORT=3001 or another free port.BIND_ADDRESS127.0.0.1The address those ports are published on. 127.0.0.1 (the default): this machine only; Coolify's and Dokploy's proxies don't need them, and on a server they'd skip the proxy and its HTTPS (Docker's ports also go around ufw). Set 0.0.0.0 only to reach the ports from other machines without a proxy, never on a server facing the internet.