Environment Variables

Complete reference for all OWASP Nest environment variables

Overview

OWASP Nest uses environment variables for configuration across frontend (Next.js) and backend (Django) services. This page documents all available environment variables from .env.example files.

All .env files must be saved in UTF-8 format without BOM (Byte Order Mark). Incorrect encoding causes “Unexpected character” errors.

Frontend Environment Variables

Configured in frontend/.env.

Authentication

NEXTAUTH_SECRET · string · required

Secret key for NextAuth.js session encryption. Generate a secure random string.

Example: openssl rand -base64 32

NEXTAUTH_URL · string · required

The canonical URL of your site. Used by NextAuth.js for redirects.

Example: http://localhost:3000/ (development)

Example: https://nest.owasp.org/ (production)

API Endpoints (Client-Side)

These variables are prefixed with NEXT_PUBLIC_ and accessible in browser JavaScript.

NEXT_PUBLIC_API_URL · string · required

Base URL for the backend API.

Example: http://localhost:8000/ (development)

Example: https://nest.owasp.org/ (production)

Usage: Frontend components use this for API calls.

NEXT_PUBLIC_CSRF_URL · string · required

Endpoint to fetch CSRF tokens for secure POST/PUT/DELETE requests.

Example: http://localhost:8000/csrf/

Example: https://nest.owasp.org/csrf/

NEXT_PUBLIC_GRAPHQL_URL · string · required

GraphQL API endpoint.

Example: http://localhost:8000/graphql/

Example: https://nest.owasp.org/graphql/

NEXT_PUBLIC_IDX_URL · string · required

Base URL for indexing/search service.

Example: http://localhost:8000/idx/

API Endpoints (Server-Side)

These variables are only accessible in Next.js server-side code.

NEXT_SERVER_CSRF_URL · string · required

Server-side CSRF endpoint. Used for SSR.

Example: http://backend:8000/csrf/ (Docker internal)

Example: https://lambda-url.amazonaws.com/csrf/ (AWS)

NEXT_SERVER_GRAPHQL_URL · string · required

Server-side GraphQL endpoint.

Example: http://backend:8000/graphql/ (Docker internal)

Example: https://lambda-url.amazonaws.com/graphql/ (AWS)

GitHub OAuth

NEXT_SERVER_GITHUB_CLIENT_ID · string · required

GitHub OAuth App Client ID.

Setup: Create OAuth App at GitHub Developer Settings

NEXT_SERVER_GITHUB_CLIENT_SECRET · string · required

GitHub OAuth App Client Secret.

Never commit this value to version control.

Environment Configuration

NEXT_PUBLIC_ENVIRONMENT · string · required

Current environment identifier.

Values: local, development, staging, production

Usage: Toggle features and logging based on environment.

NEXT_SERVER_DISABLE_SSR · boolean · default: "false"

Disable server-side rendering for debugging.

Example: false (enable SSR), true (disable SSR)

Analytics and Monitoring

NEXT_PUBLIC_GTM_ID · string

Google Tag Manager container ID.

Example: GTM-XXXXXXX

Usage: Required for Google Tag Manager integration.

NEXT_PUBLIC_POSTHOG_KEY · string

PostHog project API key for product analytics.

Example: phc_abc123xyz456

NEXT_PUBLIC_POSTHOG_HOST · string

PostHog instance URL.

Example: https://us.i.posthog.com

NEXT_PUBLIC_SENTRY_DSN · string

Sentry Data Source Name for frontend error tracking.

Example: https://[e-mail]/7890123

Release Information

NEXT_PUBLIC_RELEASE_VERSION · string

Current application version.

Example: 1.0.5

Usage: Displayed in UI and sent to error tracking services.

Feature Flags

NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED · boolean · default: "true"

Enable Project Health Dashboard feature.

Example: true

Backend Environment Variables

Configured in backend/.env.

Django Configuration

DJANGO_CONFIGURATION · string · required

Django settings configuration class to load.

Values: Local, Test, Production

Example: Local (development), Production (production)

DJANGO_SECRET_KEY · string · required

Django secret key for cryptographic signing.

Example: openssl rand -base64 50

Never commit this value to version control. Use a strong random string.

Usage: Session management, CSRF tokens, password reset tokens.

DJANGO_ALLOWED_HOSTS · string · required

Comma-separated list of allowed HTTP Host header values.

Example: * (development only)

Example: nest.owasp.org,staging.nest.owasp.org (production)

Usage: Prevents host header attacks.

Database Configuration

DJANGO_DB_HOST · string · required

PostgreSQL database hostname.

Example: db (Docker Compose)

Example: localhost (local development)

Example: nest-staging-db.abc123.us-east-1.rds.amazonaws.com (AWS RDS)

DJANGO_DB_NAME · string · required

PostgreSQL database name.

Example: production-nest-db

DJANGO_DB_USER · string · required

PostgreSQL database username.

Example: nest-user-production

DJANGO_DB_PASSWORD · string · required

PostgreSQL database password.

Use strong passwords in production. Never commit to version control.

DJANGO_DB_PORT · string · required

PostgreSQL database port.

Example: 5432 (default PostgreSQL port)

Redis Cache Configuration

DJANGO_REDIS_HOST · string · required

Redis server hostname.

Example: production-nest-cache (Docker Compose)

Example: nest-staging-redis.abc123.cache.amazonaws.com (ElastiCache)

DJANGO_REDIS_PASSWORD · string · required

Redis authentication password.

Must match REDIS_PASSWORD in cache environment file.

DJANGO_REDIS_AUTH_ENABLED · boolean · default: "true"

Enable Redis password authentication.

Example: True (production - always use authentication)

Algolia Search

DJANGO_ALGOLIA_APPLICATION_ID · string · required

Algolia Application ID.

Setup: Sign up at Algolia

Example: APPID123

DJANGO_ALGOLIA_WRITE_API_KEY · string · required

Algolia Write API Key with addObject permission.

Setup: Generate from Algolia Dashboard → API Keys

Use Write API Key (not Search-Only Key). Must have addObject permission.

DJANGO_ALGOLIA_EXCLUDED_LOCAL_INDEX_NAMES · string

Comma-separated list of index names to exclude in local development.

Example: projects_dev,users_dev

AI Services

DJANGO_OPEN_AI_SECRET_KEY · string

OpenAI API key for AI features.

Setup: Generate at OpenAI Platform

Usage: AI-powered features, embeddings, completions.

DJANGO_ELEVENLABS_API_KEY · string

ElevenLabs API key for text-to-speech features.

Setup: Generate at ElevenLabs

GitHub Integration

GITHUB_TOKEN · string · required

GitHub Personal Access Token for API access.

Setup: Create at GitHub Settings → Developer settings → Personal access tokens

Permissions: repo, read:org, read:user

Usage: Fetch OWASP project data, sync repositories, create issues.

Slack Integration

DJANGO_SLACK_BOT_TOKEN · string

Slack Bot User OAuth Token.

Setup: Create Slack App → Install App → Copy Bot User OAuth Token

Example: xoxb-123456789012-1234567890123-abcdefghijklmnopqrstuvwx

Usage: Send notifications to Slack channels.

DJANGO_SLACK_SIGNING_SECRET · string

Slack Signing Secret for webhook verification.

Setup: Slack App → Basic Information → App Credentials → Signing Secret

Usage: Verify requests from Slack webhooks.

Never install development Slack apps in OWASP Slack workspace.

AWS Services

DJANGO_AWS_ACCESS_KEY_ID · string

AWS access key ID for S3 and other AWS services.

Usage: File uploads, backups, static assets.

Prefer IAM roles over access keys in production.

DJANGO_AWS_SECRET_ACCESS_KEY · string

AWS secret access key.

Never commit to version control.

Monitoring and Error Tracking

DJANGO_SENTRY_DSN · string

Sentry Data Source Name for backend error tracking.

Example: https://[e-mail]/7890124

Setup: Create project at Sentry.io

Geolocation

DJANGO_PUBLIC_IP_ADDRESS · string · required

IP address for geolocation features in local development.

Example: 127.0.0.1 (local)

Example: 12.34.56.78 (production - use actual server IP)

Usage: Geographic location-based functionality.

Release Information

DJANGO_RELEASE_VERSION · string

Current backend release version.

Example: 1.0.5

Usage: Error tracking, logs, version display.

Docker Compose Environment Files

Production Docker Compose setup requires multiple .env files.

Cache Environment (.env.cache)

REDIS_PASSWORD · string · required

Redis authentication password.

Example: openssl rand -base64 32

Must match DJANGO_REDIS_PASSWORD in backend environment.

Database Environment (.env.db)

POSTGRES_DB · string · required

PostgreSQL database name.

Example: production-nest-db

Must match DJANGO_DB_NAME in backend environment.

POSTGRES_USER · string · required

PostgreSQL username.

Example: nest-user-production

Must match DJANGO_DB_USER in backend environment.

POSTGRES_PASSWORD · string · required

PostgreSQL password.

Must match DJANGO_DB_PASSWORD in backend environment. Use strong passwords.

AWS Parameter Store

For AWS deployments, secrets are stored in Systems Manager Parameter Store.

Parameter Naming Convention

/nest/{environment}/{parameter_name}

Example: /nest/staging/DJANGO_SECRET_KEY

Required Parameters

All backend DJANGO_* and GITHUB_TOKEN variables should be stored as SecureString parameters with KMS encryption.

Navigate to AWS Console → Systems Manager → Parameter Store and populate:

• /nest/staging/DJANGO_SECRET_KEY
• /nest/staging/DJANGO_ALGOLIA_APPLICATION_ID
• /nest/staging/DJANGO_ALGOLIA_WRITE_API_KEY
• /nest/staging/DJANGO_OPEN_AI_SECRET_KEY
• /nest/staging/DJANGO_SLACK_BOT_TOKEN
• /nest/staging/DJANGO_SLACK_SIGNING_SECRET
• /nest/staging/DJANGO_SENTRY_DSN
• /nest/staging/GITHUB_TOKEN
• /nest/staging/NEXTAUTH_SECRET
• /nest/staging/NEXT_SERVER_GITHUB_CLIENT_ID
• /nest/staging/NEXT_SERVER_GITHUB_CLIENT_SECRET

Security Best Practices

1. Never commit secrets to version control

   • Use .gitignore to exclude .env files
   • Use AWS Parameter Store or similar for production

2. Use strong random values for secrets

   # Generate secure random string
   openssl rand -base64 32
   

3. Rotate secrets regularly

   • Update passwords quarterly
   • Regenerate API keys after team member departures

4. Use different secrets per environment

   • Never reuse production secrets in staging/development

5. Restrict access to secrets

   • Use IAM roles in AWS
   • Limit Parameter Store access to specific users

6. Enable encryption at rest

   • Use KMS-encrypted SecureString parameters in AWS
   • Enable Redis AUTH
   • Enable PostgreSQL SSL connections

7. Validate environment files

   • Check UTF-8 encoding without BOM
   • Verify no trailing whitespace
   • Ensure proper key=value format

Environment File Template

Minimal required configuration for local development:

backend/.env

DJANGO_CONFIGURATION=Local
DJANGO_SECRET_KEY=your-secret-key-here
DJANGO_ALLOWED_HOSTS=*
DJANGO_DB_HOST=db
DJANGO_DB_NAME=nest
DJANGO_DB_USER=postgres
DJANGO_DB_PASSWORD=postgres
DJANGO_DB_PORT=5432
DJANGO_REDIS_HOST=cache
DJANGO_REDIS_PASSWORD=redis-password
DJANGO_REDIS_AUTH_ENABLED=True
DJANGO_ALGOLIA_APPLICATION_ID=your-algolia-app-id
DJANGO_ALGOLIA_WRITE_API_KEY=your-algolia-write-key
DJANGO_PUBLIC_IP_ADDRESS=127.0.0.1
GITHUB_TOKEN=your-github-token

frontend/.env

NEXTAUTH_SECRET=your-nextauth-secret
NEXTAUTH_URL=http://localhost:3000/
NEXT_PUBLIC_API_URL=http://localhost:8000/
NEXT_PUBLIC_CSRF_URL=http://localhost:8000/csrf/
NEXT_PUBLIC_ENVIRONMENT=local
NEXT_PUBLIC_GRAPHQL_URL=http://localhost:8000/graphql/
NEXT_PUBLIC_IDX_URL=http://localhost:8000/idx/
NEXT_PUBLIC_IS_PROJECT_HEALTH_ENABLED=true
NEXT_SERVER_CSRF_URL=http://backend:8000/csrf/
NEXT_SERVER_DISABLE_SSR=false
NEXT_SERVER_GITHUB_CLIENT_ID=your-github-client-id
NEXT_SERVER_GITHUB_CLIENT_SECRET=your-github-client-secret
NEXT_SERVER_GRAPHQL_URL=http://backend:8000/graphql/

Troubleshooting

”Unexpected character” error

Cause: .env file has incorrect encoding (UTF-8 with BOM).

Solution: Save file as “UTF-8 without BOM” in your text editor.

In VS Code:

1. Click encoding in bottom-right corner
2. Select “Save with Encoding”
3. Choose “UTF-8” (not “UTF-8 with BOM”)

Environment changes not applied

Cause: Application not restarted after .env changes.

Solution: Restart Docker containers:

docker compose restart

Database connection refused

Cause: Database credentials mismatch between backend and database environment files.

Solution: Verify DJANGO_DB_* values in .env.backend match POSTGRES_* values in .env.db.

Redis authentication failed

Cause: Redis password mismatch.

Solution: Verify DJANGO_REDIS_PASSWORD matches REDIS_PASSWORD in .env.cache.

Algolia indexing fails

Cause: Invalid Algolia API key or missing permissions.

Solution:

1. Verify DJANGO_ALGOLIA_APPLICATION_ID and DJANGO_ALGOLIA_WRITE_API_KEY
2. Ensure API key has addObject permission in Algolia Dashboard

Next Steps

• Docker Deployment Guide
• Infrastructure Setup
• Local Development Setup