ENCRYPT_KEY
ENCRYPT_KEY does double duty: Fernet encryption at rest, and JWT signing. It must be
a urlsafe-base64 32-byte key — the output of Fernet.generate_key().
It encrypts the OAuth access and refresh tokens of every connected integration.
Changing it makes all already-connected integrations unreadable. Back it up
alongside your other secrets.
scripts/generate-secrets.sh in apowerb-hosting never replaces a value that is
already set, precisely to avoid this.
RAG_WEBHOOK_SECRET
Signs the completion callbacks sent by the RAG service. It ships with a documented
default value, which means it is not a secret until you change it.
A configuration value that looks filled in is not the same as one that is
configured. Compare the deployed value against the literal in .env.example before
calling a secret set — a placeholder in quotes reads as a real value at a glance.
Empty is not unset
An environment variable set to the empty string is present. Code that falls back with
?? (nullish coalescing) or os.getenv(name, default) will accept "" and skip the
default. Where a value is required, assert it is non-empty at startup and refuse to
boot otherwise.
