Environment variables

Sockudo loads configuration from files first, then applies supported environment variable overrides. Environment variables are explicit mappings, not a generic alternative syntax for every nested TOML or JSON field. Use them for deployment-specific values and secret injection; keep complex app policy, retention, queue reliability, and feature structure in a static file or persistent manager. See Static configuration for the full precedence and equivalent file examples.

Values are parsed as strings unless the target option is numeric or boolean. Boolean values follow the server parser and accept common true/false forms.

This page lists every runtime environment variable referenced by the server, core configuration loader, push subsystem, app managers, adapters, queues, and provider workers.

Config File Interpolation

Sockudo supports ${VAR} environment variable interpolation in TOML and JSON configuration files. Variables are resolved from the process environment at startup, before the config file is parsed.

Syntax

Pattern	Behavior
`${VAR}`	Replaced with the value of `VAR`. Startup error if unset or empty.
`${VAR:-default}`	Replaced with the value of `VAR`, or `default` if unset or empty.

Examples

Inject a secret from the environment (e.g. from AWS Secrets Manager via a pod environment variable):

[[app_manager.array.apps]]
id = "my-app"
key = "app-key"
secret = "${SOCKUDO_APP_SECRET}"
enabled = true

Use defaults for optional values:

port = 6001

[adapter]
driver = "${ADAPTER_DRIVER:-local}"

[adapter.redis.redis_pub_options]
url = "${REDIS_URL:-redis://localhost:6379}"

Behavior

Missing variables: If a ${VAR} reference has no default and the variable is unset or empty, sockudo prints an error listing all unresolved variables and exits. This is fail-fast by design — you see every missing variable at once, not one at a time.
Empty values: An environment variable set to an empty string (VAR="") is treated as unset. The :-default fallback will activate.
Single pass: Interpolation runs once on the raw file text. If a resolved value itself contains ${…}, it is not re-expanded. This prevents accidental recursion and injection.
No bare $VAR: Only the braced ${VAR} syntax is recognized. A bare $ character (e.g., in regex patterns or currency symbols) is never matched.

Limitations

Comments: Interpolation operates on raw text before TOML/JSON parsing. A ${VAR} reference inside a TOML comment (# secret = "${MISSING}") will still be resolved — and will cause a startup error if the variable is missing. Remove or replace ${…} patterns in comments if they reference variables that are not set.
Typed fields: Interpolation produces string replacements. For string config values (secrets, URLs, connection strings), this works naturally. For numeric or boolean fields, prefer the existing environment variable overrides instead.
Defaults cannot contain }: The default value in ${VAR:-default} ends at the first } character. This is sufficient for most values (strings, URLs, ports) but not for JSON fragments.

Process and listener

Variable	Purpose
`ENVIRONMENT`	Runtime mode label.
`DEBUG`	Forces debug mode on when truthy.
`DEBUG_MODE`	Overrides the configured debug flag.
`HOST`	Main HTTP and WebSocket bind host.
`PORT`	Main HTTP and WebSocket bind port.
`ACTIVITY_TIMEOUT`	Pusher protocol activity timeout.
`SHUTDOWN_GRACE_PERIOD`	Seconds to keep the listener open after SIGTERM/SIGINT. Existing WebSockets close promptly with 4200; during this window `/up`, `/ready`, and `/accept-traffic` return 503 `DRAINING` and new upgrades are rejected with 503. HTTP API requests are still served. A second signal ends the window early. The webhook drain follows this window.
`USER_AUTHENTICATION_TIMEOUT`	Timeout used by user authentication flows.
`SOCKUDO_MAX_CONNECTIONS`	Per-node WebSocket connection limit. `0` disables.
`WEBSOCKET_MAX_PAYLOAD_KB`	Legacy maximum WebSocket payload size in KiB.
`SOCKUDO_SERVER_ROLE`	Deployment topology role. `"default"` or `"api"`. Overrides `server_role` in the config file.
`INSTANCE_PROCESS_ID`	Stable node/process identity used by clustering and Iggy consumers.
`HOSTNAME`	Fallback node identity for Iggy when `INSTANCE_PROCESS_ID` is not set.
`HEALTH_CHECK_TIMEOUT_MS`	Per-dependency timeout for `/up` health checks in milliseconds. Defaults to `2000`.
`HTTP_API_USAGE_ENABLED`	Enables `/usage` and `/stats` operational endpoints.
`HTTP_API_READINESS_HIGH_WATERMARK`	Fraction of `SOCKUDO_MAX_CONNECTIONS` that makes `/ready` return `503 CAPACITY`. Defaults to `0.95`.
`HTTP_API_READINESS_LOW_WATERMARK`	Fraction at or below which `/ready` recovers after capacity shedding. Defaults to `0.85`; must be nonnegative and less than the high watermark.
`HTTP_API_ACCEPT_TRAFFIC_ENABLED`	Enables memory-pressure admission control for new WebSocket connections. Defaults to `false`.
`HTTP_API_ACCEPT_TRAFFIC_MEMORY_THRESHOLD`	Fraction of the effective memory limit that closes new-connection admission. Defaults to `0.9`; valid range is greater than `0` through `1`.
`HTTP_API_ACCEPT_TRAFFIC_MEMORY_LIMIT_BYTES`	Optional explicit memory limit in bytes. When unset, Linux cgroup v2/v1 limits are discovered.
`HTTP_API_ACCEPT_TRAFFIC_SAMPLE_INTERVAL_MS`	Independent memory-pressure sampling interval in milliseconds. Defaults to `500`.

Logging

Variable	Purpose
`RUST_LOG`	Highest-precedence tracing filter.
`SOCKUDO_LOG_DEBUG`	Default log filter when debug mode is active.
`SOCKUDO_LOG_PROD`	Default log filter when debug mode is not active.
`LOG_OUTPUT_FORMAT`	Set to `json` for JSON logs.
`LOG_COLORS_ENABLED`	Enables or disables colored text logs.
`LOG_INCLUDE_TARGET`	Includes tracing targets in text or JSON logs.

See Logging for level policy, stable lifecycle fields, and data-safety requirements.

OpenTelemetry

OpenTelemetry is disabled unless [opentelemetry].enabled or SOCKUDO_OTEL_ENABLED is true. When enabled, Sockudo can export the stable OpenTelemetry traces, metrics, and logs signals over OTLP. Export is additive to local logs and the Prometheus /metrics endpoint. OpenTelemetry profiles are not supported.

Sockudo controls

These variables map directly to the [opentelemetry] configuration block:

Variable	Default	Purpose
`SOCKUDO_OTEL_ENABLED`	`false`	Enables OpenTelemetry initialization and export.
`SOCKUDO_OTEL_TRACES_ENABLED`	`true`	Enables trace export while OpenTelemetry is enabled.
`SOCKUDO_OTEL_METRICS_ENABLED`	`true`	Enables OTLP metric export while preserving Prometheus independently.
`SOCKUDO_OTEL_LOGS_ENABLED`	`true`	Enables OTLP log export while preserving local log output.
`SOCKUDO_OTEL_SERVICE_NAME`	`sockudo`	Sets the `service.name` resource attribute.
`SOCKUDO_OTEL_SERVICE_NAMESPACE`	unset	Sets `service.namespace`. An empty value clears it.
`SOCKUDO_OTEL_DEPLOYMENT_ENVIRONMENT`	unset	Sets `deployment.environment.name`. An empty value clears it.
`SOCKUDO_OTEL_RESOURCE_ATTRIBUTES`	unset	Comma-separated `key=value` resource attributes. Invalid entries are ignored with a warning.
`SOCKUDO_OTEL_ENDPOINT`	SDK default	Common OTLP collector endpoint used by enabled signals.
`SOCKUDO_OTEL_EXPORT_TIMEOUT_MS`	`10000`	Request timeout for an OTLP export attempt.
`SOCKUDO_OTEL_BATCH_SCHEDULED_DELAY_MS`	`5000`	Maximum trace/log batching delay.
`SOCKUDO_OTEL_BATCH_MAX_QUEUE_SIZE`	`2048`	Bounded trace/log export queue capacity.
`SOCKUDO_OTEL_BATCH_MAX_EXPORT_BATCH_SIZE`	`512`	Maximum trace/log records per export batch; cannot exceed queue capacity.
`SOCKUDO_OTEL_METRIC_EXPORT_INTERVAL_MS`	`60000`	Periodic metric export interval.
`SOCKUDO_OTEL_PROPAGATION_TRACE_CONTEXT`	`true`	Enables W3C `traceparent` and `tracestate` extraction and injection.
`SOCKUDO_OTEL_PROPAGATION_BAGGAGE`	`true`	Enables W3C baggage extraction and injection.

Standard OpenTelemetry SDK and OTLP variables

Sockudo also honors the standard OTEL_* SDK and exporter variables implemented by the bundled Rust SDK. Use these for protocol, sampling, per-signal endpoints, compression, and authenticated collector headers. A signal-specific exporter value is more specific than its common OTLP equivalent.

Variable or family	Purpose
`OTEL_SDK_DISABLED`	Hard-disables the OpenTelemetry SDK when true.
`OTEL_SERVICE_NAME`	Standard `service.name` resource setting.
`OTEL_RESOURCE_ATTRIBUTES`	Standard comma-separated resource attributes.
`OTEL_PROPAGATORS`	Comma-separated `tracecontext` and `baggage` propagators. Other propagator names are ignored.
`OTEL_TRACES_EXPORTER`, `OTEL_METRICS_EXPORTER`, `OTEL_LOGS_EXPORTER`	Selects `otlp` or disables an individual signal with `none`.
`OTEL_EXPORTER_OTLP_ENDPOINT`	Common OTLP endpoint. For HTTP it is a base URL and the SDK appends `/v1/traces`, `/v1/metrics`, or `/v1/logs`.
`OTEL_EXPORTER_OTLP_PROTOCOL`	`grpc`, `http/protobuf`, or `http/json`.
`OTEL_EXPORTER_OTLP_HEADERS`	Comma-separated exporter headers. Treat the complete value as a secret.
`OTEL_EXPORTER_OTLP_COMPRESSION`	Export compression: `gzip` or `zstd`.
`OTEL_EXPORTER_OTLP_TIMEOUT`	Common exporter timeout in milliseconds.
`OTEL_EXPORTER_OTLP_TRACES_*`	Trace-specific endpoint, protocol, headers, compression, and timeout.
`OTEL_EXPORTER_OTLP_METRICS_*`	Metric-specific endpoint, protocol, headers, compression, timeout, and temporality preference.
`OTEL_EXPORTER_OTLP_LOGS_*`	Log-specific endpoint, protocol, headers, compression, and timeout.
`OTEL_TRACES_SAMPLER`, `OTEL_TRACES_SAMPLER_ARG`	Head sampler and its argument; for example `parentbased_traceidratio` and `0.10`.
`OTEL_BSP_SCHEDULE_DELAY`, `OTEL_BSP_MAX_QUEUE_SIZE`, `OTEL_BSP_MAX_EXPORT_BATCH_SIZE`	Batch span processor settings. The delay is in milliseconds.
`OTEL_BLRP_SCHEDULE_DELAY`, `OTEL_BLRP_MAX_QUEUE_SIZE`, `OTEL_BLRP_MAX_EXPORT_BATCH_SIZE`	Batch log-record processor settings. The delay is in milliseconds.
`OTEL_METRIC_EXPORT_INTERVAL`	Periodic metric reader interval in milliseconds.
`OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE`	Metric temporality preference.
`OTEL_SPAN_ATTRIBUTE_COUNT_LIMIT`, `OTEL_SPAN_EVENT_COUNT_LIMIT`, `OTEL_SPAN_LINK_COUNT_LIMIT`	Trace span limits implemented by the bundled SDK.

The standard signal-specific endpoint is used exactly as supplied. With HTTP, include its final signal path when setting a signal-specific endpoint. Keep OTEL_EXPORTER_OTLP_HEADERS and private API tokens in a secret store rather than a configuration file or command line. HTTPS exporters use the bundled platform/web PKI roots. Custom CA bundles, client certificates, and mTLS exporter configuration are not supported by the current Rust SDK integration.

Exporter connection failures, timeouts, and bounded-queue drops do not fail requests and do not change /live or /up. Invalid Sockudo configuration still fails validation at startup. See Logging for log correlation and data-safety details.

Driver selection

Variable	Purpose
`ADAPTER_DRIVER`	Horizontal fanout driver.
`CACHE_DRIVER`	Cache driver.
`QUEUE_DRIVER`	Queue driver.
`APP_MANAGER_DRIVER`	App manager driver.
`RATE_LIMITER_DRIVER`	Rate limiter backend driver.
`ADAPTER_BUFFER_MULTIPLIER_PER_CPU`	Adapter fanout buffer sizing multiplier.
`ADAPTER_ENABLE_SOCKET_COUNTING`	Enables adapter socket counting.
`ADAPTER_AGGREGATE_COUNTS`	Enables gossiped aggregate channel counts for local count reads.
`ADAPTER_FAST_PRESENCE_TRANSITIONS`	Uses the replicated presence registry for first-join/last-leave checks; faster but eventually consistent.
`ADAPTER_FALLBACK_TO_LOCAL`	Falls back to the local adapter when a configured adapter cannot start.
`APP_MANAGER_REGISTER_INLINE_APPS`	Allows inline app definitions from config to be registered.
`SOCKUDO_SKIP_INLINE_APPS`	Skips inline apps even if present in the config file.

Default app bootstrap

Variable	Purpose
`SOCKUDO_DEFAULT_APP_ID`	Default app ID created from environment.
`SOCKUDO_DEFAULT_APP_KEY`	Default app key created from environment.
`SOCKUDO_DEFAULT_APP_SECRET`	Default app secret created from environment.
`SOCKUDO_DEFAULT_APP_ENABLED`	Enables or disables default app registration.
`SOCKUDO_DEFAULT_APP_MAX_CONNECTIONS`	Default app connection limit.
`SOCKUDO_DEFAULT_APP_MAX_BACKEND_EVENTS_PER_SECOND`	Default app backend publish rate limit.
`SOCKUDO_DEFAULT_APP_MAX_CLIENT_EVENTS_PER_SECOND`	Default app client event rate limit.
`SOCKUDO_DEFAULT_APP_MAX_READ_REQUESTS_PER_SECOND`	Default app read API rate limit.
`SOCKUDO_DEFAULT_APP_MAX_PRESENCE_MEMBERS_PER_CHANNEL`	Default app presence member limit per channel.
`SOCKUDO_DEFAULT_APP_MAX_PRESENCE_MEMBER_SIZE_IN_KB`	Default app presence member payload size limit.
`SOCKUDO_DEFAULT_APP_MAX_CHANNEL_NAME_LENGTH`	Default app channel name length limit.
`SOCKUDO_DEFAULT_APP_MAX_EVENT_CHANNELS_AT_ONCE`	Default app maximum fanout channels per event.
`SOCKUDO_DEFAULT_APP_MAX_EVENT_NAME_LENGTH`	Default app event name length limit.
`SOCKUDO_DEFAULT_APP_MAX_EVENT_PAYLOAD_IN_KB`	Default app event payload size limit.
`SOCKUDO_DEFAULT_APP_MAX_EVENT_BATCH_SIZE`	Default app batch publish item limit.
`SOCKUDO_DEFAULT_APP_ENABLE_CLIENT_MESSAGES`	Enables client events for the default app.
`SOCKUDO_ENABLE_CLIENT_MESSAGES`	Legacy fallback for default app client events.
`SOCKUDO_DEFAULT_APP_ENABLE_USER_AUTHENTICATION`	Enables user authentication features for the default app.
`SOCKUDO_DEFAULT_APP_ENABLE_WATCHLIST_EVENTS`	Enables watchlist events for the default app.
`SOCKUDO_DEFAULT_APP_ALLOWED_ORIGINS`	Comma-separated origin allowlist for the default app.
`SOCKUDO_DEFAULT_APP_ANNOTATIONS_ENABLED`	Enables annotations for the default app channel policy.

Ably compatibility credentials

Variable	Purpose
`SOCKUDO_ABLY_COMPAT_ENABLED`	Enables the optional additional-key registry. The primary `App.key`/`App.secret` remains available independently.
`SOCKUDO_ABLY_COMPAT_REALTIME_ADMISSION`	Ably WebSocket admission mode: `accept` (default) or `placement_constraint`, which returns `DISCONNECTED` error `50320` so clients try configured WebSocket fallback hosts. No fallback realtime transport is enabled.
`SOCKUDO_ABLY_COMPAT_ATTACH_TIMEOUT_MS`	Maximum native ATTACH processing time before Sockudo removes the partial subscription and returns `DETACHED`/`50003`. Defaults to `10000`.
`SOCKUDO_ABLY_COMPAT_KEYS_JSON`	JSON array of additional keys with `app_id`, `key_name`, `secret`, optional `capability`, `revocable_tokens`, `enabled`, and rotation metadata. Treat this value as a secret.
`SOCKUDO_ABLY_COMPAT_MAX_TOKEN_TTL_MS`	Maximum accepted TokenRequest TTL in milliseconds. Defaults to 24 hours.
`SOCKUDO_ABLY_COMPAT_TOKEN_REQUEST_TIMESTAMP_SKEW_MS`	Maximum absolute TokenRequest timestamp skew. Defaults to 15 minutes.
`SOCKUDO_ABLY_COMPAT_NONCE_TTL_SECONDS`	Shared replay-protection TTL for TokenRequest nonces. Defaults to 15 minutes.
`SOCKUDO_ABLY_COMPAT_STATS_FIXTURE_INGEST_ENABLED`	Enables authenticated conformance fixture writes through `POST /stats`. Defaults to `false`; do not enable on public deployments.
`SOCKUDO_ABLY_COMPAT_STATS_QUEUE_CAPACITY`	Maximum bounded aggregation backlog. Defaults to `4096`.
`SOCKUDO_ABLY_COMPAT_STATS_FLUSH_INTERVAL_MS`	Maximum batching delay before a stats-store merge. Defaults to `10`.
`SOCKUDO_ABLY_COMPAT_STATS_RETENTION_SECONDS`	Cache retention for canonical minute buckets. Defaults to 400 days.
`SOCKUDO_ABLY_COMPAT_STATS_MAX_SCAN_ENTRIES`	Maximum minute buckets read by one stats query. Defaults to `100000`.
`SOCKUDO_ABLY_COMPAT_STATS_CAS_RETRIES`	Maximum compare-and-swap retries when merging a shared bucket. Defaults to `8`.

Redis

Variable	Purpose
`REDIS_URL`	Shared Redis URL override for adapter, cache, queue, and rate limiter Redis clients.
`DATABASE_REDIS_HOST`	Redis host.
`DATABASE_REDIS_PORT`	Redis port.
`DATABASE_REDIS_USERNAME`	Redis username.
`DATABASE_REDIS_PASSWORD`	Redis password.
`DATABASE_REDIS_DB`	Redis database index.
`DATABASE_REDIS_KEY_PREFIX`	Redis key prefix.
`DATABASE_REDIS_SENTINEL_USERNAME`	ACL username for authenticating to the Sentinel nodes.
`DATABASE_REDIS_SENTINEL_PASSWORD`	Password for authenticating to the Sentinel nodes.
`DATABASE_REDIS_SENTINEL_TLS_ENABLED`	Enables TLS for the connection to the Sentinel nodes.
`DATABASE_REDIS_SENTINEL_TLS_ACCEPT_INVALID_CERTS`	Skips certificate/hostname verification for the Sentinel connection (dangerous).
`DATABASE_REDIS_SENTINEL_TLS_CA_PATH`	PEM CA certificate path for the Sentinel connection (private CAs).
`DATABASE_REDIS_SENTINEL_TLS_CLIENT_CERT_PATH`	PEM client certificate path for mutual TLS to the Sentinel nodes.
`DATABASE_REDIS_SENTINEL_TLS_CLIENT_KEY_PATH`	PEM client private key path for mutual TLS to the Sentinel nodes.
`DATABASE_REDIS_MASTER_TLS_ENABLED`	Enables TLS for direct Redis, Redis Cluster, or the Sentinel-resolved master/replica data connection.
`DATABASE_REDIS_MASTER_TLS_ACCEPT_INVALID_CERTS`	Skips certificate/hostname verification for Redis data connections (dangerous).
`DATABASE_REDIS_MASTER_TLS_CA_PATH`	PEM CA certificate path for Redis data connections (private CAs).
`DATABASE_REDIS_MASTER_TLS_CLIENT_CERT_PATH`	PEM client certificate path for mutual TLS to Redis data connections.
`DATABASE_REDIS_MASTER_TLS_CLIENT_KEY_PATH`	PEM client private key path for mutual TLS to Redis data connections.
`DATABASE_REDIS_CLUSTER_NODES`	Comma-separated Redis Cluster seed nodes.
`REDIS_CLUSTER_NODES`	Comma-separated Redis Cluster seed nodes, also applied to adapter and queue cluster config.
`DATABASE_REDIS_CLUSTER_USERNAME`	Redis Cluster username.
`DATABASE_REDIS_CLUSTER_PASSWORD`	Redis Cluster password.
`DATABASE_REDIS_CLUSTER_USE_TLS`	Enables TLS for Redis Cluster with the default root store; use the master-TLS variables for private CA or mTLS material.
`REDIS_CLUSTER_QUEUE_CONCURRENCY`	Redis Cluster queue worker concurrency.
`REDIS_CLUSTER_QUEUE_PREFIX`	Redis Cluster queue key prefix.

SQL and app storage

Variable	Purpose
`DATABASE_MYSQL_HOST`	MySQL host.
`DATABASE_MYSQL_PORT`	MySQL port.
`DATABASE_MYSQL_USERNAME`	MySQL username.
`DATABASE_MYSQL_PASSWORD`	MySQL password.
`DATABASE_MYSQL_DATABASE`	MySQL database name.
`DATABASE_MYSQL_TABLE_NAME`	MySQL app table name.
`DATABASE_MYSQL_POOL_MIN`	MySQL minimum pool size.
`DATABASE_MYSQL_POOL_MAX`	MySQL maximum pool size.
`DATABASE_POSTGRES_HOST`	PostgreSQL host.
`DATABASE_POSTGRES_PORT`	PostgreSQL port.
`DATABASE_POSTGRES_USERNAME`	PostgreSQL username used by the core config loader.
`DATABASE_POSTGRES_USER`	PostgreSQL username fallback used by the PostgreSQL app manager.
`DATABASE_POSTGRES_PASSWORD`	PostgreSQL password.
`DATABASE_POSTGRES_DATABASE`	PostgreSQL database name.
`DATABASE_POSTGRES_POOL_MIN`	PostgreSQL minimum pool size.
`DATABASE_POSTGRES_POOL_MAX`	PostgreSQL maximum pool size.
`DATABASE_POOLING_ENABLED`	Enables database pooling.
`DATABASE_POOL_MIN`	Global minimum pool size.
`DATABASE_POOL_MAX`	Global maximum pool size.
`DATABASE_CONNECTION_POOL_SIZE`	Global connection pool size applied to MySQL and PostgreSQL.

DynamoDB, SurrealDB, and ScyllaDB

Variable	Purpose
`DATABASE_DYNAMODB_REGION`	DynamoDB region.
`DATABASE_DYNAMODB_TABLE_NAME`	DynamoDB table name.
`DATABASE_DYNAMODB_ENDPOINT_URL`	DynamoDB custom endpoint URL.
`AWS_ACCESS_KEY_ID`	AWS access key used by DynamoDB and AWS-backed queues.
`AWS_SECRET_ACCESS_KEY`	AWS secret key used by DynamoDB and AWS-backed queues.
`DATABASE_SURREALDB_URL`	SurrealDB connection URL.
`DATABASE_SURREALDB_NAMESPACE`	SurrealDB namespace.
`DATABASE_SURREALDB_DATABASE`	SurrealDB database.
`DATABASE_SURREALDB_USERNAME`	SurrealDB username.
`DATABASE_SURREALDB_PASSWORD`	SurrealDB password.
`DATABASE_SURREALDB_TABLE_NAME`	SurrealDB app table name.
`SCYLLADB_NODES`	Comma-separated ScyllaDB nodes.
`SCYLLADB_KEYSPACE`	ScyllaDB keyspace.
`SCYLLADB_REPLICATION_CLASS`	ScyllaDB replication class.
`SCYLLADB_REPLICATION_FACTOR`	ScyllaDB replication factor.

Cache

Variable	Purpose
`CACHE_TTL_SECONDS`	Cache TTL applied to app, channel, database, and memory cache settings.
`CACHE_CLEANUP_INTERVAL`	Cache cleanup interval for in-memory and database cache paths.
`CACHE_MAX_CAPACITY`	Cache maximum capacity for supported cache stores.

TLS, Unix sockets, and CORS

Variable	Purpose
`SSL_ENABLED`	Enables TLS listener mode.
`SSL_CERT_PATH`	TLS certificate path.
`SSL_KEY_PATH`	TLS private key path.
`SSL_REDIRECT_HTTP`	Enables HTTP-to-HTTPS redirect support.
`SSL_HTTP_PORT`	HTTP redirect listener port.
`UNIX_SOCKET_ENABLED`	Enables Unix socket listener mode.
`UNIX_SOCKET_PATH`	Unix socket filesystem path.
`UNIX_SOCKET_PERMISSION_MODE`	Unix socket permission mode in octal.
`CORS_ORIGINS`	Comma-separated CORS origin patterns.
`CORS_METHODS`	Comma-separated CORS methods. Defaults include `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, and `OPTIONS` so browser clients can use every supported REST mutation route.
`CORS_HEADERS`	Comma-separated allowed headers.
`CORS_CREDENTIALS`	Enables CORS credentials.

Metrics and rate limiting

Variable	Purpose
`METRICS_DRIVER`	Metrics backend driver.
`METRICS_ENABLED`	Enables the metrics server.
`METRICS_HOST`	Metrics bind host.
`METRICS_PORT`	Metrics bind port.
`METRICS_PROMETHEUS_PREFIX`	Prefix for Prometheus metric names.
`METRICS_TCP_EXPORTER_ENABLED`	Enables the metrics-rs TCP event exporter.
`METRICS_TCP_EXPORTER_HOST`	TCP exporter bind host.
`METRICS_TCP_EXPORTER_PORT`	TCP exporter bind port.
`METRICS_TCP_EXPORTER_BUFFER_SIZE`	TCP exporter internal and per-client buffer size.
`RATE_LIMITER_ENABLED`	Enables HTTP and WebSocket rate limiting.
`RATE_LIMITER_API_MAX_REQUESTS`	API requests allowed per rate limit window.
`RATE_LIMITER_API_WINDOW_SECONDS`	API rate limit window length.
`RATE_LIMITER_API_TRUST_HOPS`	Client's one-based position from the right of `X-Forwarded-For` for API rate limits. `0` ignores both forwarding headers; `1` suits one NGINX appending proxy. See client IP extraction.
`RATE_LIMITER_WS_MAX_REQUESTS`	WebSocket upgrade attempts allowed per window.
`RATE_LIMITER_WS_WINDOW_SECONDS`	WebSocket rate limit window length.
`RATE_LIMITER_WS_TRUST_HOPS`	Client's one-based position from the right of `X-Forwarded-For` for WebSocket rate limits. `0` ignores both forwarding headers; `1` suits one NGINX appending proxy. See client IP extraction.
`RATE_LIMITER_REDIS_PREFIX`	Redis key prefix for rate limiter state.

Queue backends

Variable	Purpose
`QUEUE_REDIS_CONCURRENCY`	Redis queue worker concurrency.
`QUEUE_REDIS_PREFIX`	Redis queue key prefix.
`QUEUE_REDIS_RESPONSE_TIMEOUT_MS`	Redis queue command response timeout in milliseconds. Defaults to `5000` so Sentinel failover invalidates stale primary connections promptly; set to `0` to disable the client-side deadline.
`QUEUE_MAX_ATTEMPTS`	Maximum Queue v2 deliveries before dead-lettering. Defaults to `5`.
`QUEUE_RETRY_BASE_DELAY_MS`	Initial retry delay. Defaults to `1000`.
`QUEUE_RETRY_MAX_DELAY_MS`	Maximum exponential retry delay. Defaults to `60000`.
`QUEUE_RETRY_JITTER`	Symmetric retry jitter fraction from `0.0` to `1.0`. Defaults to `0.2`.
`QUEUE_LEASE_DURATION_MS`	Redis Queue v2 in-flight lease duration. Defaults to `30000`.
`QUEUE_LEASE_RENEW_INTERVAL_MS`	Redis Queue v2 lease renewal interval; must be below the lease duration. Defaults to `10000`.
`QUEUE_STALLED_BATCH_SIZE`	Maximum expired/due jobs recovered by one Redis atomic claim. Defaults to `100`.
`QUEUE_WORKER_POLL_INTERVAL_MS`	Worker recovery poll and delayed-delivery promotion bound. Defaults to `500`.
`QUEUE_WORKER_PREFETCH`	Maximum jobs processed concurrently or prefetched per worker for bounded broker I/O. SQS FIFO stays serial. Defaults to `16`.
`QUEUE_SHUTDOWN_TIMEOUT_MS`	Budget for draining connection cleanup, presence leases, and webhooks after listener grace; also the separate queue worker shutdown timeout. Defaults to `30000` per phase. See shutdown delivery.
`QUEUE_COMPLETED_RETENTION`	Completed Redis job metadata retained per queue. `0` removes immediately. Defaults to `1000`.
`QUEUE_FAILED_RETENTION`	Dead-letter jobs retained per queue. Defaults to `10000`.
`QUEUE_EVENT_RETENTION`	Approximate Redis lifecycle event-stream retention. Defaults to `10000`.
`QUEUE_DEDUPLICATION_TTL_MS`	Application deduplication-key lifetime. Defaults to `300000`.
`QUEUE_MEMORY_CAPACITY`	Maximum outstanding jobs per in-memory logical queue. Capacity errors fail closed. Defaults to `100000`.
`QUEUE_MAX_BATCH_SIZE`	Maximum jobs encoded into one atomic/backend-native enqueue batch. Defaults to `1000`.
`REDIS_CLUSTER_QUEUE_REQUEST_TIMEOUT_MS`	Redis Cluster queue command request timeout in milliseconds. Set to `0` to disable the cluster client deadline.
`QUEUE_SQS_REGION`	SQS region.
`QUEUE_SQS_VISIBILITY_TIMEOUT`	SQS visibility timeout.
`QUEUE_SQS_MAX_MESSAGES`	SQS receive batch size.
`QUEUE_SQS_WAIT_TIME_SECONDS`	SQS long-poll wait time.
`QUEUE_SQS_CONCURRENCY`	SQS worker concurrency.
`QUEUE_SQS_FIFO`	Enables FIFO queue behavior.
`QUEUE_SQS_ENDPOINT_URL`	SQS custom endpoint URL.
`QUEUE_SNS_REGION`	SNS region.
`QUEUE_SNS_TOPIC_ARN`	SNS topic ARN.
`QUEUE_SNS_ENDPOINT_URL`	SNS custom endpoint URL.

NATS, Pulsar, RabbitMQ, Pub/Sub, Kafka, Iggy, and OMQ

Variable	Purpose
`NATS_SERVERS`	Comma-separated NATS server URLs.
`NATS_USERNAME`	NATS username.
`NATS_PASSWORD`	NATS password.
`NATS_TOKEN`	NATS token.
`NATS_PREFIX`	NATS subject prefix.
`NATS_CONNECTION_TIMEOUT_MS`	NATS connection timeout.
`NATS_REQUEST_TIMEOUT_MS`	NATS request timeout.
`NATS_DISCOVERY_MAX_WAIT_MS`	NATS node discovery maximum wait.
`NATS_DISCOVERY_IDLE_WAIT_MS`	NATS node discovery idle wait.
`NATS_NODES_NUMBER`	Expected Sockudo node count for horizontal request aggregation when cluster-health discovery is not used.
`NATS_SUBSCRIPTION_CAPACITY`	NATS subscription channel capacity.
`NATS_CLIENT_CAPACITY`	NATS client channel capacity.
`NATS_MAX_RECONNECTS`	NATS reconnect limit.
`NATS_PRESENCE_SYNC_CHUNK_SIZE`	Presence sync chunk size for NATS.
`NATS_NO_ECHO`	Suppress delivery of a NATS connection's own horizontal messages.
`PULSAR_URL`	Pulsar service URL.
`PULSAR_PREFIX`	Pulsar topic prefix.
`PULSAR_TOKEN`	Pulsar auth token.
`PULSAR_REQUEST_TIMEOUT_MS`	Pulsar request timeout.
`PULSAR_NODES_NUMBER`	Expected Pulsar node count.
`RABBITMQ_URL`	RabbitMQ connection URL.
`RABBITMQ_PREFIX`	RabbitMQ exchange or routing prefix.
`RABBITMQ_CONNECTION_TIMEOUT_MS`	RabbitMQ connection timeout.
`RABBITMQ_REQUEST_TIMEOUT_MS`	RabbitMQ request timeout.
`RABBITMQ_NODES_NUMBER`	Expected RabbitMQ node count.
`GOOGLE_PUBSUB_PROJECT_ID`	Google Pub/Sub project ID.
`GOOGLE_PUBSUB_PREFIX`	Google Pub/Sub topic prefix.
`PUBSUB_EMULATOR_HOST`	Pub/Sub emulator host.
`GOOGLE_PUBSUB_REQUEST_TIMEOUT_MS`	Google Pub/Sub request timeout.
`GOOGLE_PUBSUB_NODES_NUMBER`	Expected Pub/Sub node count.
`KAFKA_BROKERS`	Comma-separated Kafka brokers.
`KAFKA_PREFIX`	Kafka topic prefix.
`KAFKA_SECURITY_PROTOCOL`	Kafka security protocol.
`KAFKA_SASL_MECHANISM`	Kafka SASL mechanism.
`KAFKA_SASL_USERNAME`	Kafka SASL username.
`KAFKA_SASL_PASSWORD`	Kafka SASL password.
`KAFKA_REQUEST_TIMEOUT_MS`	Kafka request timeout.
`KAFKA_NODES_NUMBER`	Expected Kafka node count.
`IGGY_CONNECTION_STRING`	Apache Iggy connection string; the first node dialed. Its credentials and query options apply to every cluster seed.
`IGGY_CLUSTER_SEEDS`	Comma-separated extra Apache Iggy replicas (`host:port`) tried in order when an earlier node is unreachable. Bootstrap only; the SDK then fails over using the cluster roster.
`IGGY_CONNECT_TIMEOUT_MS`	Bound on the TCP dial to each node while cluster seeds are set (default: `2000`).
`IGGY_FAILOVER_TIMEOUT_MS`	How long broadcast and queue publishes, and sign-in to a reachable seed, wait for an Apache Iggy leader election or failover (default: `15000`).
`IGGY_DURABILITY`	Message durability for topics Sockudo creates: `replicated` (default) or `persisted`.
`ADAPTER_IGGY_DURABILITY`	Adapter-specific message durability.
`QUEUE_IGGY_DURABILITY`	Queue-specific message durability.
`IGGY_CONSUMER_OFFSET_DURABILITY`	Consumer-offset durability for topics Sockudo creates: `replicated` (default) or `persisted`.
`ADAPTER_IGGY_CONSUMER_OFFSET_DURABILITY`	Adapter-specific consumer-offset durability.
`QUEUE_IGGY_CONSUMER_OFFSET_DURABILITY`	Queue-specific consumer-offset durability.
`IGGY_USERNAME`	Apache Iggy username.
`IGGY_PASSWORD`	Apache Iggy password.
`IGGY_CONSUMER_NAME`	Apache Iggy consumer name.
`IGGY_STREAM`	Apache Iggy stream name.
`IGGY_TOPIC_PREFIX`	Apache Iggy adapter topic prefix.
`IGGY_QUEUE_TOPIC_PREFIX`	Apache Iggy queue topic prefix.
`IGGY_CONSUMER_GROUP_PREFIX`	Apache Iggy consumer group prefix.
`IGGY_REQUEST_TIMEOUT_MS`	Apache Iggy request timeout.
`IGGY_POLL_INTERVAL_MS`	Apache Iggy poll interval in milliseconds (default: `5`).
`IGGY_POLL_BATCH_SIZE`	Apache Iggy poll batch size.
`IGGY_PARTITIONS_COUNT`	Shared Apache Iggy partition count.
`ADAPTER_IGGY_PARTITIONS_COUNT`	Adapter-specific Apache Iggy partition count.
`QUEUE_IGGY_PARTITIONS_COUNT`	Queue-specific Apache Iggy partition count.
`IGGY_PARTITION_ID`	Shared Apache Iggy partition ID.
`ADAPTER_IGGY_PARTITION_ID`	Adapter-specific Apache Iggy partition ID.
`QUEUE_IGGY_PARTITION_ID`	Queue-specific Apache Iggy partition ID.
`IGGY_AUTO_CREATE`	Auto-create Apache Iggy streams and topics.
`IGGY_START_FROM_LATEST`	Start adapter consumption from latest messages.
`IGGY_NODES_NUMBER`	Expected Sockudo node count for horizontal request aggregation (not the Iggy replica count).
`OMQ_BIND_ENDPOINT`	OMQ subscriber bind endpoint for this node.
`OMQ_CONNECT_ENDPOINTS`	Comma-separated OMQ peer subscriber endpoints.
`OMQ_PREFIX`	OMQ transport topic prefix.
`OMQ_REQUEST_TIMEOUT_MS`	OMQ request timeout.
`OMQ_NODES_NUMBER`	Expected OMQ node count. Defaults to peer endpoint count plus this node.
`OMQ_IO_THREADS`	OMQ data-plane IO threads.
`OMQ_SEND_HWM`	OMQ publisher high-water mark in messages.
`OMQ_RECV_HWM`	OMQ subscriber high-water mark in messages.

Cleanup and cluster health

Variable	Purpose
`CLEANUP_ASYNC_ENABLED`	Enables asynchronous cleanup.
`CLEANUP_FALLBACK_TO_SYNC`	Falls back to synchronous cleanup when async cleanup fails.
`CLEANUP_QUEUE_BUFFER_SIZE`	Cleanup queue buffer size.
`CLEANUP_BATCH_SIZE`	Cleanup batch size.
`CLEANUP_BATCH_TIMEOUT_MS`	Cleanup batch timeout.
`CLEANUP_WORKER_THREADS`	Cleanup worker count or `auto`.
`CLEANUP_MAX_RETRY_ATTEMPTS`	Cleanup retry limit.
`CLUSTER_HEALTH_ENABLED`	Enables cluster health tracking.
`CLUSTER_HEALTH_HEARTBEAT_INTERVAL`	Cluster heartbeat interval.
`CLUSTER_HEALTH_NODE_TIMEOUT`	Node timeout before a peer is considered stale. A newly started node also keeps publishing cross-node for this long before it treats an empty peer list as a single-node deployment.
`CLUSTER_HEALTH_CLEANUP_INTERVAL`	Cleanup interval for cluster health state.

WebSocket and Protocol V2 features

Variable	Purpose
`TAG_FILTERING_ENABLED`	Enables Protocol V2 tag filtering.
`WEBSOCKET_MAX_MESSAGES`	Maximum buffered outbound WebSocket messages, or `none`/`0` for unlimited.
`WEBSOCKET_MAX_BYTES`	Maximum buffered outbound WebSocket bytes, or `none`/`0` for unlimited.
`WEBSOCKET_DISCONNECT_ON_BUFFER_FULL`	Disconnects slow clients instead of dropping messages when buffers fill.
`WEBSOCKET_MAX_MESSAGE_SIZE`	WebSocket message size limit.
`WEBSOCKET_MAX_FRAME_SIZE`	WebSocket frame size limit.
`WEBSOCKET_WRITE_BUFFER_SIZE`	WebSocket write buffer size.
`WEBSOCKET_MAX_BACKPRESSURE`	WebSocket backpressure limit.
`WEBSOCKET_AUTO_PING`	Enables native WebSocket Ping/Pong keepalive for Protocol V2. Protocol V1 retains its Pusher-compatible application heartbeat.
`WEBSOCKET_PING_INTERVAL`	Inbound inactivity in seconds before a Protocol V2 native Ping. `0` disables proactive native Ping frames; nonzero values are bounded to at least half of `ACTIVITY_TIMEOUT` (and at least 5 seconds).
`WEBSOCKET_IDLE_TIMEOUT`	Hard inbound-idle timeout in seconds for Protocol V2 native connections. `0` disables the hard idle deadline.
`WEBSOCKET_COMPRESSION`	WebSocket compression mode.
`CONNECTION_RECOVERY_ENABLED`	Enables Protocol V2 connection recovery.
`CONNECTION_RECOVERY_BUFFER_TTL`	Recovery buffer TTL.
`CONNECTION_RECOVERY_MAX_BUFFER_SIZE`	Recovery buffer maximum size.
`EPHEMERAL_ENABLED`	Enables ephemeral event handling.
`ECHO_CONTROL_ENABLED`	Enables per-connection echo control.
`ECHO_CONTROL_DEFAULT_ECHO_MESSAGES`	Default echo behavior when echo control is enabled.
`EVENT_NAME_FILTERING_ENABLED`	Enables event-name filtering for subscriptions.
`EVENT_NAME_FILTERING_MAX_EVENTS_PER_FILTER`	Maximum event names in one subscription filter.
`EVENT_NAME_FILTERING_MAX_EVENT_NAME_LENGTH`	Maximum event name length inside a filter.

Presence

Variable	Purpose
`PRESENCE_UPDATE_RATE_LIMIT_PER_MEMBER_PER_SECOND`	Maximum presence updates accepted per member per second.
`PRESENCE_UNGRACEFUL_TIMEOUT_SECONDS`	Protocol V1/Pusher presence lease after an abrupt disconnect. Defaults to immediate removal.
`PRESENCE_V2_UNGRACEFUL_TIMEOUT_SECONDS`	Protocol V2 presence lease after an abrupt disconnect. Defaults to 15 seconds.

History, idempotency, versioning, and annotations

Variable	Purpose
`HISTORY_ENABLED`	Enables durable channel history.
`HISTORY_REWIND_ENABLED`	Enables rewind reads from history.
`HISTORY_RETENTION_WINDOW_SECONDS`	Durable history retention window.
`HISTORY_MAX_PAGE_SIZE`	Maximum history page size.
`HISTORY_WRITER_SHARDS`	Durable history writer shard count.
`HISTORY_WRITER_QUEUE_CAPACITY`	Durable history writer queue capacity.
`HISTORY_BACKEND`	Durable history backend.
`HISTORY_MAX_MESSAGES_PER_CHANNEL`	Optional retained message count limit per channel.
`HISTORY_MAX_BYTES_PER_CHANNEL`	Optional retained byte limit per channel.
`HISTORY_POSTGRES_TABLE_PREFIX`	PostgreSQL history table prefix.
`HISTORY_POSTGRES_WRITE_TIMEOUT_MS`	PostgreSQL history write timeout.
`HISTORY_PURGE_INTERVAL_SECONDS`	History purge interval.
`HISTORY_PURGE_BATCH_SIZE`	History purge batch size.
`HISTORY_MAX_PURGE_PER_TICK`	Maximum purged history rows per purge tick.
`PRESENCE_HISTORY_ENABLED`	Enables retained presence history.
`PRESENCE_HISTORY_RETENTION_WINDOW_SECONDS`	Presence history retention window.
`PRESENCE_HISTORY_MAX_PAGE_SIZE`	Maximum presence history page size.
`PRESENCE_HISTORY_MAX_EVENTS_PER_CHANNEL`	Optional retained presence event limit per channel.
`PRESENCE_HISTORY_MAX_BYTES_PER_CHANNEL`	Optional retained presence byte limit per channel.
`IDEMPOTENCY_ENABLED`	Enables HTTP publish idempotency.
`IDEMPOTENCY_TTL_SECONDS`	Idempotency cache TTL.
`IDEMPOTENCY_MAX_KEY_LENGTH`	Maximum idempotency key length.
`VERSIONED_MESSAGES_ENABLED`	Enables Protocol V2 mutable messages.
`VERSIONED_MESSAGES_DRIVER`	Versioned message backend driver.
`VERSIONED_MESSAGES_MAX_PAGE_SIZE`	Maximum versioned-message page size.
`VERSIONED_MESSAGES_RETENTION_WINDOW_SECONDS`	Versioned-message retention window.
`VERSIONED_MESSAGES_PURGE_INTERVAL_SECONDS`	Versioned-message purge interval.
`VERSIONED_MESSAGES_PURGE_BATCH_SIZE`	Versioned-message purge batch size.
`VERSIONED_MESSAGES_MAX_PURGE_PER_TICK`	Maximum versioned-message rows purged per tick.
`ANNOTATIONS_ENABLED`	Enables message annotations globally.

MCP

Embedded Model Context Protocol server ([mcp], requires the mcp Cargo feature). See MCP server.

Variable	Maps to	Notes
`MCP_ENABLED`	`mcp.enabled`	Boolean.
`MCP_PATH`	`mcp.path`	URL path, default `/mcp`.
`MCP_PORT`	`mcp.port`	Dedicated listener port; unset shares the main HTTP listener.
`MCP_HOST`	`mcp.host`	Bind host for the dedicated listener.
`MCP_ALLOWED_HOSTS`	`mcp.allowed_hosts`	Comma-separated `Host` authorities.
`MCP_ALLOWED_ORIGINS`	`mcp.allowed_origins`	Comma-separated browser origins.
`MCP_ALLOW_ANONYMOUS`	`mcp.allow_anonymous`	Boolean; development only.
`MCP_ANONYMOUS_SCOPES`	`mcp.anonymous_scopes`	Comma-separated scopes.
`MCP_REQUEST_TIMEOUT_MS`	`mcp.request_timeout_ms`	Per-tool upstream timeout.
`MCP_MAX_BODY_BYTES`	`mcp.max_body_bytes`	Maximum MCP POST body.
`MCP_SESSION_TTL_SECONDS`	`mcp.session_ttl_seconds`	Idle session lifetime.
`MCP_RATE_LIMIT_PER_MINUTE`	`mcp.rate_limit_per_minute`	Per-token budget; `0` disables.
`MCP_DISABLED_TOOLS`	`mcp.disabled_tools`	Comma-separated tool names to hide.
`MCP_INSTRUCTIONS`	`mcp.instructions`	Extra MCP instructions text.
`MCP_TOKEN`	`[[mcp.tokens]]` entry	Adds or replaces one token principal from the environment.
`MCP_TOKEN_NAME`	`mcp.tokens[].name`	Name for `MCP_TOKEN`, default `env`.
`MCP_TOKEN_SCOPES`	`mcp.tokens[].scopes`	Comma-separated, default `read,write`.
`MCP_TOKEN_APPS`	`mcp.tokens[].apps`	Comma-separated app ids, default `*`.

The standalone sockudo-mcp binary reads SOCKUDO_URL, SOCKUDO_MCP_APPS, SOCKUDO_APP_ID, SOCKUDO_APP_KEY, SOCKUDO_APP_SECRET, SOCKUDO_MCP_TRANSPORT, SOCKUDO_MCP_LISTEN, SOCKUDO_MCP_PATH, SOCKUDO_MCP_TOKENS, SOCKUDO_MCP_SCOPES, SOCKUDO_MCP_ALLOW_ANONYMOUS, SOCKUDO_METRICS_URL, SOCKUDO_MCP_TIMEOUT_MS, SOCKUDO_MCP_ALLOWED_HOSTS, SOCKUDO_MCP_ALLOWED_ORIGINS, SOCKUDO_MCP_DISABLED_TOOLS, and SOCKUDO_MCP_INSTRUCTIONS.

Webhooks

Variable	Purpose
`WEBHOOK_BATCHING_ENABLED`	Enables webhook batching.
`WEBHOOK_BATCHING_DURATION`	Webhook batching duration.
`WEBHOOK_BATCHING_SIZE`	Webhook batching size.

Push core

Variable	Purpose
`PUSH_STORAGE_DRIVER`	Push storage backend driver.
`PUSH_QUEUE_DRIVER`	Push queue backend driver.
`PUSH_ALLOW_MEMORY_DRIVERS`	Explicitly allows node-local memory push store/queue in production; use only for local/dev acknowledgment.
`PUSH_CREDENTIAL_ENCRYPTION_KEY`	Master key for encrypted push credential material.
`PUSH_ACCEPTANCE_RATE_LIMIT`	Admission rate limit for push publish requests.
`PUSH_ANALYTICS_ENABLED`	Enables push analytics collection.
`PUSH_FANOUT_FAST_THRESHOLD`	Recipient threshold for fast-path push fanout.
`PUSH_FANOUT_SHARD_SIZE`	Recipient shard size for large fanout.
`PUSH_FANOUT_SYNC_THRESHOLD`	Threshold below which fanout can remain synchronous.
`PUSH_BACKPRESSURE_LAG_THRESHOLD_SECS`	Oldest actionable push queue age, in seconds, tolerated before push backpressure; `0` disables age-based queue backpressure.
`PUSH_BACKPRESSURE`	Forces push backpressure responses in the HTTP layer.
`PUSH_BACKPRESSURE_RETRY_AFTER_SECONDS`	Retry-After value emitted for push backpressure.
`PUSH_PUBLISH_LOG_MAX_LAG`	Maximum publish-log queue depth tolerated before push backpressure.
`PUSH_CRITICAL_QUEUE_MAX_LAG`	Maximum queue depth tolerated for shard, delivery result, retry, dead-letter, and active provider delivery stages.
`PUSH_PUBLISH_STATUS_TTL_DAYS`	Retention for push publish status records.
`PUSH_DISPATCH_MAX_OUTBOUND_REQUESTS`	Maximum outbound provider requests each dispatch worker hands to a provider dispatcher at once.
`PUSH_RETRY_WORKER_COUNT`	Number of monolith retry scheduler workers consuming `push.retry.v1`.
`PUSH_RETRY_MAX_ATTEMPTS`	Maximum provider delivery attempts before retry work is dead-lettered.
`PUSH_RETRY_INITIAL_BACKOFF_MS`	Initial retry backoff when the provider does not send `Retry-After`.
`PUSH_RETRY_MAX_BACKOFF_MS`	Maximum exponential retry backoff.
`PUSH_RETRY_MAX_ELAPSED_SECS`	Maximum retry age from first provider attempt.
`PUSH_RETRY_JITTER`	Enables deterministic retry jitter.
`PUSH_RETRY_JITTER_RATIO_PERCENT`	Retry jitter spread as a percentage of the selected backoff.
`PUSH_RETRY_RESPECT_RETRY_AFTER`	Uses provider `Retry-After` deadlines when present.
`PUSH_REPAIR_INTERVAL_SECS`	Interval for the monolith push repair worker; `0` disables durable publish-log repair.
`PUSH_REPAIR_MIN_AGE_SECS`	Minimum queued publish-log age before repair recreates missing `push.publish.v1` work.
`PUSH_REPAIR_BATCH_SIZE`	Maximum durable publish-log rows scanned per app and repair tick.
`PUSH_FAILURE_THRESHOLD`	Push circuit-breaker failure threshold.
`PUSH_SCHEDULER_INTERVAL_SECS`	Scheduled push scan interval.
`PUSH_CLEANUP_INTERVAL_SECS`	Push cleanup worker interval. Set `0` to disable the worker.
`PUSH_CLEANUP_BATCH_SIZE`	Maximum rows considered per cleanup category per tick.
`PUSH_CLEANUP_MAX_DELETED_PER_TICK`	Overall cap on rows deleted by one push cleanup tick.
`PUSH_STALE_DEVICE_MAX_AGE_DAYS`	Stale device age threshold.
`PUSH_DEFAULT_ACCEPTANCE_RPS`	Default per-app push acceptance RPS quota.
`PUSH_DEFAULT_DELIVERY_QUOTA_DAILY`	Default per-app daily delivery quota.
`PUSH_DEFAULT_FANOUT_MAX`	Default per-app maximum fanout.
`PUSH_DEFAULT_INFLIGHT_MAX`	Default per-app in-flight publish limit.
`PUSH_FANOUT_MAX`	HTTP-layer fanout cap override.
`PUSH_DELIVERY_QUOTA_DAILY`	HTTP-layer daily delivery quota override.

Push providers

Variable	Purpose
`PUSH_FCM_ENABLED`	Enables FCM dispatch.
`FCM_PROJECT_ID`	FCM project ID for monolith dispatch workers.
`PUSH_FCM_PROJECT_ID`	FCM project ID alias.
`FCM_SERVICE_ACCOUNT_JSON_PATH`	Path to FCM service account JSON for auto-refreshing OAuth tokens.
`PUSH_FCM_SERVICE_ACCOUNT_JSON_PATH`	FCM service account JSON path alias.
`FCM_SERVICE_ACCOUNT_JSON`	Inline FCM service account JSON for auto-refreshing OAuth tokens.
`PUSH_FCM_SERVICE_ACCOUNT_JSON`	Inline FCM service account JSON alias.
`FCM_APP_ID`	App ID used to load stored FCM credentials.
`PUSH_FCM_APP_ID`	Stored FCM credential app ID alias.
`FCM_CREDENTIAL_ID`	Stored FCM credential ID.
`PUSH_FCM_CREDENTIAL_ID`	Stored FCM credential ID alias.
`FCM_PROVIDER_TOKEN`	Legacy static FCM OAuth token for short-lived dispatch.
`PUSH_FCM_PROVIDER_TOKEN`	Legacy static FCM token alias.
`FCM_ENDPOINT`	FCM endpoint override.
`PUSH_FCM_ENDPOINT`	FCM endpoint alias.
`PUSH_APNS_ENABLED`	Enables APNs dispatch.
`APNS_TOPIC`	APNs topic or bundle ID.
`PUSH_APNS_TOPIC`	APNs topic alias.
`APNS_ENDPOINT`	APNs endpoint override.
`PUSH_APNS_ENDPOINT`	APNs endpoint alias.
`APNS_APP_ID`	App ID used to load stored APNs credentials.
`PUSH_APNS_APP_ID`	Stored APNs app ID alias.
`APNS_CREDENTIAL_ID`	Stored APNs credential ID.
`PUSH_APNS_CREDENTIAL_ID`	Stored APNs credential ID alias.
`APNS_PROVIDER_TOKEN`	Static APNs provider token.
`PUSH_APNS_PROVIDER_TOKEN`	Static APNs provider token alias.
`APNS_TEAM_ID`	APNs token-auth team ID.
`PUSH_APNS_TEAM_ID`	APNs team ID alias.
`APNS_KEY_ID`	APNs token-auth key ID.
`PUSH_APNS_KEY_ID`	APNs key ID alias.
`APNS_PRIVATE_KEY`	APNs token-auth private key content.
`PUSH_APNS_PRIVATE_KEY`	APNs private key content alias.
`APNS_PRIVATE_KEY_PATH`	Filesystem path to APNs token-auth private key.
`PUSH_APNS_PRIVATE_KEY_PATH`	APNs private key path alias.
`PUSH_APNS_LIVE_ACTIVITIES_ENABLED`	Enables typed ActivityKit start, update, and end delivery.
`PUSH_APNS_LIVE_ACTIVITY_TOPIC`	Live Activity topic; defaults to `<bundle-id>.push-type.liveactivity`.
`PUSH_APNS_BUNDLE_ID`	Bundle ID used by APNs broadcast and channel-management requests.
`PUSH_APNS_BROADCAST_ENABLED`	Enables iOS 18 Live Activity broadcast delivery and channel management.
`PUSH_APNS_BROADCAST_ENDPOINT`	Broadcast endpoint; use the sandbox host for sandbox channels.
`PUSH_APNS_MANAGEMENT_ENDPOINT`	Broadcast channel-management endpoint: production uses port `2196`, sandbox uses `2195`.
`PUSH_APNS_DEFAULT_BROADCAST_EXPIRATION_SECS`	Default retained-broadcast lifetime, from 1 to 28800 seconds.
`PUSH_APNS_CONNECT_TIMEOUT_MS`	APNs connection timeout.
`PUSH_APNS_REQUEST_TIMEOUT_MS`	Per-request APNs timeout.
`PUSH_APNS_POOL_IDLE_TIMEOUT_SECS`	APNs pooled HTTP/2 idle timeout.
`PUSH_APNS_MAX_IDLE_CONNECTIONS_PER_HOST`	Maximum idle APNs connections retained per host.
`PUSH_APNS_TCP_KEEPALIVE_SECS`	APNs TCP keepalive interval.
`PUSH_APNS_HTTP2_KEEPALIVE_INTERVAL_SECS`	HTTP/2 keepalive ping interval.
`PUSH_APNS_HTTP2_KEEPALIVE_TIMEOUT_SECS`	HTTP/2 keepalive acknowledgement timeout.
`PUSH_APNS_CA_CERTIFICATE_PATH`	Optional PEM bundle of extra root certificates trusted for APNs, broadcast, and channel-management TLS. Empty keeps only the built-in public roots.
`PUSH_WEBPUSH_ENABLED`	Enables Web Push dispatch.
`VAPID_PRIVATE_KEY`	Web Push VAPID private key.
`PUSH_WEBPUSH_VAPID_PRIVATE_KEY`	Web Push VAPID private key alias.
`VAPID_CONTACT`	Web Push VAPID contact subject.
`PUSH_WEBPUSH_VAPID_CONTACT`	Web Push VAPID contact alias.
`PUSH_ALLOW_LOCAL_WEB_PUSH_ENDPOINTS`	Allows local Web Push endpoints for development and tests.
`PUSH_WEBPUSH_ALLOWED_HOSTS`	Comma-separated Web Push endpoint allowlist.
`PUSH_WEBPUSH_DENIED_HOSTS`	Comma-separated Web Push endpoint denylist.
`PUSH_HMS_ENABLED`	Enables HMS dispatch.
`HMS_APP_ID`	HMS app ID for dispatch workers.
`PUSH_HMS_APP_ID`	HMS app ID alias.
`HMS_PROVIDER_TOKEN`	HMS provider token.
`PUSH_HMS_PROVIDER_TOKEN`	HMS provider token alias.
`HMS_ENDPOINT`	HMS endpoint override.
`PUSH_HMS_ENDPOINT`	HMS endpoint alias.
`PUSH_WNS_ENABLED`	Enables WNS dispatch.
`WNS_PROVIDER_TOKEN`	WNS provider token.
`PUSH_WNS_PROVIDER_TOKEN`	WNS provider token alias.

On this page