Environment Variables

Reference of all supported environment variables, grouped by category.

Client var prefix differs by app. Browser-exposed (client) variables are build-time inlined and the prefix depends on which dashboard you run:

App	Client prefix	Read via
apps/dashboard (Next.js, legacy)	NEXT_PUBLIC_*	process.env.NEXT_PUBLIC_*
apps/dashboard-tsr (TanStack Start)	VITE_*	import.meta.env.VITE_*

Same variable, different prefix — e.g. NEXT_PUBLIC_AUTH_PROVIDER ↔ VITE_AUTH_PROVIDER, NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY ↔ VITE_CLERK_PUBLISHABLE_KEY. The tables below list the legacy NEXT_PUBLIC_* names; for the TanStack app substitute the VITE_ prefix. Worker [vars] are runtime-only and never reach the client, so these MUST be set at build time (CI build step / vite.config.ts). Authoritative TanStack reference: apps/dashboard-tsr/.env.example.

---

ClickHouse Connection

Required. At minimum set CLICKHOUSE_HOST.

Each position across the comma-separated values maps to the same host index. All four vars must have the same number of values.

---

Query Execution

Connection Pool

---

Health Alerting (Cron Sweep)

The autonomous health sweep (GET /api/cron/health-sweep, triggered by the Cloudflare Cron Trigger every 5 minutes) runs the same health checks as the Health dashboard over all configured hosts and dispatches webhook alerts — even when no browser tab is open. Unlike the in-app alert settings (stored per-browser in localStorage), the cron sweep reads its configuration from env.

# Example: alert to Slack on warning-or-worse, every 5 minutes
CRON_SECRET=a-long-random-string
HEALTH_ALERT_ENABLED=true
HEALTH_ALERT_WEBHOOK_URL=https://hooks.slack.com/services/T000/B000/XXXX
HEALTH_ALERT_MIN_SEVERITY=warning

---

Feature Permissions

All features are public and enabled by default. Override only what needs different behavior.

Replace {ID} with an uppercase feature id: AGENT, TABLES, METRICS, SETTINGS, ACTIONS, MCP, PEERDB, INSIGHTS, SECURITY, LOGS, CLUSTER, OPERATIONS, DASHBOARD, OVERVIEW, QUERIES, HEALTH, DOCS, ABOUT.

# Examples
CHM_FEATURE_AGENT_ACCESS=authenticated
CHM_FEATURE_METRICS_ENABLED=false
CHM_FEATURE_SETTINGS_ACCESS=authenticated

See the Feature Permissions guide for full details.

---

Authentication

The active server-side auth provider is chosen by CHM_AUTH_PROVIDER. See the Authentication reference for the full model (public, API key, Clerk, and reverse-proxy methods).

Reverse proxy (CHM_AUTH_PROVIDER=proxy)

Trust a reverse proxy that already authenticated the user. Either mechanism below authenticates a request; whichever succeeds first wins.

Without CHM_PROXY_AUTH_SECRET, the trusted-header mechanism is disabled — any client could forge X-Forwarded-User on a publicly-reachable worker.

---

AI Agent / LLM Provider

The AI agent uses an OpenAI-compatible API. At minimum set LLM_API_KEY.

Provider-Specific

Agent Behaviour

---

Conversation Store

See Agent Conversation Storage for setup commands, backend permissions, and fallback behavior.

---

PeerDB Monitoring

Optional, view-only. Set PEERDB_API_URL to enable the PeerDB section (Mirrors and Peers) in the sidebar. When unset, the section shows a "not configured" state and the proxy returns 503.

CHM proxies only a read-only allowlist of PeerDB endpoints (app/api/v1/peerdb/[...slug]); mutating endpoints (create/drop/pause, alert config, maintenance) are rejected with 403.

# Example: PeerDB UI behind NextAuth
PEERDB_API_URL=https://peerdb.example.com/api
PEERDB_PASSWORD=your-peerdb-ui-password

# Example: raw flow-api (no auth)
PEERDB_API_URL=http://localhost:8113

For local development without a PeerDB instance, run the bundled mock:

bun run peerdb:mock                                  # serves :8113
PEERDB_API_URL=http://localhost:8113 bun run dev

---

Analytics & Branding

---

Runtime & Build

Build-Time

These are injected at build time for the About page:

---

Legacy / Migration