Production environment variables

Enter production values in Dokploy’s environment-variable management. Do not commit a production .env or paste its contents into tickets, chat, screenshots, or documentation.

Laravel and runtime

Variable	Production value	Secret	Owner or rotation
`APP_NAME`	Hospital-approved name	No	Application owner
`APP_ENV`	`production`	No	Fixed
`APP_DEBUG`	`false`	No	Fixed
`APP_URL`	`https://{{HMIS_DOMAIN}}`	No	Application owner
`APP_KEY`	Unique `base64:` key	Yes	Preserve; rotate only through an approved key-migration plan
`APP_PREVIOUS_KEYS`	Previous keys during controlled rotation	Yes	Remove after encrypted data is migrated
`TRUSTED_PROXIES`	Approved Dokploy proxy range/value	No	Infrastructure owner
`LOG_CHANNEL`	`stack`	No	Operations owner
`LOG_LEVEL`	`warning` or approved level	No	Operations owner
`RUN_MIGRATIONS`	`false`	No	Fixed; migrations are manual
`QUEUE_CONNECTION`	`database`	No	Fixed for supplied stack
`SESSION_DRIVER`	`database`	No	Fixed for supplied stack
`SESSION_SECURE_COOKIE`	`true`	No	Fixed for HTTPS
`CACHE_STORE`	`database`	No	Fixed for supplied stack

Generate APP_KEY once in an application container or approved secure workstation:

php artisan key:generate --show

Back up the key through the secret-management process. Do not regenerate it during redeployment.

HMIS PostgreSQL

The Compose file sets the connection host and port internally.

Variable	Example	Secret	Rotation
`DB_DATABASE`	`hmis_production`	No	Do not change after initialization without a migration plan
`DB_USERNAME`	`hmis`	No	Dedicated service account
`DB_PASSWORD`	`{{HMIS_DATABASE_PASSWORD}}`	Yes	At installation and after suspected exposure

Mail

Variable	Required value
`MAIL_MAILER`	Approved SMTP/API mailer; never `log` for production password resets
`MAIL_HOST`, `MAIL_PORT`, `MAIL_SCHEME`	Provider connection details
`MAIL_USERNAME`, `MAIL_PASSWORD`	Dedicated credentials stored as secrets
`MAIL_FROM_ADDRESS`	Approved hospital sender
`MAIL_FROM_NAME`	`${APP_NAME}` or approved display name

Verify password reset and email verification in staging without sending to real patients.

OIE

Variable	Production guidance	Secret
`OIE_IMAGE`	Keep the repository-pinned version unless a tested upgrade is approved	No
`OIE_DB_DATABASE`	`oie` or installation-specific name	No
`OIE_DB_USERNAME`	Dedicated OIE database user	No
`OIE_DB_PASSWORD`	Unique random password	Yes
`OIE_KEYSTORE_STOREPASS`	Unique random keystore password	Yes
`OIE_KEYSTORE_KEYPASS`	Unique random key password	Yes
`OIE_ADMIN_BIND_ADDRESS`	`127.0.0.1`	No
`OIE_ADMIN_PORT`	`8443`	No
`OIE_BIND_ADDRESS`	`127.0.0.1` until a private listener is approved	No
`OIE_ANALYZER_PORT`	Vendor-approved port	No
`OIE_JVM_MIN_MEMORY`	Begin with `128m`	No
`OIE_JVM_MAX_MEMORY`	Size from observed workload; repository default is `256m`	No

Radiology

Variable	Production guidance	Secret
`ORTHANC_IMAGE`	Keep the tested pinned version	No
`ORTHANC_DB_DATABASE`	`orthanc` or installation-specific name	No
`ORTHANC_DB_USERNAME`	Dedicated Orthanc database user	No
`ORTHANC_DB_PASSWORD`	Unique random password	Yes
`ORTHANC_DICOM_BIND_ADDRESS`	`127.0.0.1` until private DICOM access is approved	No
`ORTHANC_DICOM_PORT`	`4242` unless the network design specifies another mapping	No
`OHIF_IMAGE`	Keep the tested pinned version	No
`PACS_VIEWER_URL_TEMPLATE`	`https://{{OHIF_DOMAIN}}/viewer?StudyInstanceUIDs={study_instance_uid}`	No
`OIE_RADIOLOGY_WORKLIST_URL`	`http://oie:6670/radiology/worklist/`	No
`OIE_RADIOLOGY_PACS_CODE`	Installation-specific PACS code	No

Backup secrets

Store these in the host backup service or a dedicated secret store, not in application containers unless the backup job runs there:

RESTIC_REPOSITORY={{BACKUP_REPOSITORY}}
RESTIC_PASSWORD={{BACKUP_ENCRYPTION_PASSWORD}}
AWS_ACCESS_KEY_ID={{BACKUP_ACCESS_KEY}}
AWS_SECRET_ACCESS_KEY={{BACKUP_SECRET_KEY}}

Use a bucket-restricted account that cannot administer unrelated data. Keep a recovery copy of the encryption password outside the server.

Rotation record

For every secret, record the owner, creation date, storage location, last rotation, next review, dependent services, and tested recovery method. Rotate immediately after suspected exposure.

Getting started

Local development

Dokploy deployment

Initial configuration

Integrations

Operations

Production environment variables

Laravel and runtime

HMIS PostgreSQL

Mail

OIE

Radiology

Backup secrets

Rotation record

​Laravel and runtime

​HMIS PostgreSQL

​Mail

​OIE

​Radiology

​Backup secrets

​Rotation record

Laravel and runtime

HMIS PostgreSQL

Mail

OIE

Radiology

Backup secrets

Rotation record