Service Environment Map

This page maps each service's current environment variables to their target names under the Environment Variables convention (AC_ prefix, DOMAIN_TYPE component names, standard keywords). It is the reference used during migration: for a given service, look up the variable here to see the name it should have, what it does, and an example value.

The target names come from reading each service's runtime code, not only its settings file, so the description reflects how the value is actually consumed.

Conventions used in the tables below:

• 🔒 marks a secret. Its value must come from ${secret:<service>/<path>} (see Environment Configuration), never a literal.
• The component is the service's DOMAIN_TYPE name. Cross-cutting dependencies (Kafka, Redis, object storage, Keycloak, CDN providers) are named directly without a component split.
• Example values are illustrative, not real credentials.
• Context/Secret Expression — the recommended ${context:...}/${secret:...} value (or literal) once this service resolves its own envdef.yaml through Config Service, per Deployment Context & Service Naming. — means this stays the service's own directly-set variable, never resolved via context (same reasoning as AC_ENVIRONMENT). "not yet resolved" means no confirmed mapping exists — anything shown for those is illustrative, never a recommendation to copy as-is. This column is filled in service by service, verified against that service's own real code as it's done, not guessed in bulk — an empty column for a service below means it hasn't been done yet.

Resource Server

Repository: ac-server-resource. Component: RESOURCE_API.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	Port Kestrel listens on. No component — each service runs in its own container, so the value is unambiguous (see Environment Variables)	8080	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; ASPNETCORE_ENVIRONMENT is derived from it	Production	—
SupportedCultures (appsettings)	AC_SUPPORTED_CULTURES	Supported UI cultures	en,tr	—
CUSTOMCONNSTR_RESOURCE_DB_CONNECTION_STRING / ConnectionStrings:ResourceServerDbConnection	AC_DB_CONNECTION_STRING 🔒	MongoDB connection string for the resource database. The secret's storage path stays service-scoped (${secret:resource-api/...}) for authorization purposes even though the variable name is not	${secret:resource-api/db_connection}	${secret:resource-api/db_connection} (matches already)
ASPNETCORE_KAFKA_SERVER_URLS / ConnectionStrings:KafkaServerUrls	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap broker host:port list, comma-separated — named after Kafka's own bootstrap.servers config key rather than the ENDPOINT keyword, since it is scheme-less and can hold multiple brokers	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	host:port of the Redis cache server, no scheme	redis.appcircle.svc.cluster.local:6379	${context:resource_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	Key prefix this service uses for its own keys in the shared Redis cache. No component — own property — kept as REDIS rather than a generic "cache" word to stay consistent with AC_REDIS_ADDRESS above	ResourceServer	—
ASPNETCORE_S3_CLIENT_PROVIDER	AC_S3_PROVIDER	Active object-storage backend	MINIO | AWS | GCLOUD	— (corrected; this isn't a Kafka-shaped "one value shared by every service" case — Resource Server is the only service with a live S3/object-storage client. Every other service's own MinIO/S3 vars are dead, commented-out code — see the Removed tables in Build Server, Distribution Server, Store API Service, Publish Service, Resign Service, App Parser Server, Store Submit Server, and Agent Cache Service's own note below. So this is Resource Server's own value, same reasoning as AC_ENVIRONMENT, not a context candidate at all)
ASPNETCORE_S3_ENDPOINT	AC_S3_ADDRESS	host:port of the S3/MinIO server, no scheme	minio:9000	not yet resolved — same open S3-as-context question as the row above
ASPNETCORE_S3_ACCESS_KEY	AC_S3_ACCESS_KEY 🔒	S3 access key	${secret:s3/access_key}	${secret:s3/access_key} (matches already)
ASPNETCORE_S3_SECRET_KEY	AC_S3_SECRET_KEY 🔒	S3 secret key	${secret:s3/secret_key}	${secret:s3/secret_key} (matches already)
ASPNETCORE_S3_REGION	AC_S3_REGION	S3 region	europe-west1	not yet resolved — same open S3-as-context question above
ASPNETCORE_S3_USE_HTTP	AC_S3_HTTP_ENABLED	Connect to S3 over plain HTTP (no TLS) — resolves the scheme that AC_S3_ADDRESS deliberately omits	false	not yet resolved — same open S3-as-context question above
ASPNETCORE_S3_MIN_FILE_UPLOAD_DURATION_IN_SECONDS	AC_S3_MIN_UPLOAD_DURATION_SECONDS	Minimum validity, in seconds, of a presigned upload URL	300	—
ASPNETCORE_BUCKET_PREFIX	AC_S3_BUCKET_PREFIX	Prefix prepended to bucket names	appcircle-resource-	—
ASPNETCORE_GOOGLE_CREDENTIALS_BASE64	AC_S3_GCLOUD_CREDENTIALS_BASE64 🔒	Base64-encoded GCP service-account JSON for GCS	${secret:s3/gcloud_credentials}	${secret:s3/gcloud_credentials} (matches already)
ASPNETCORE_S3_USE_INTERNAL_SERVER	AC_S3_INTERNAL_SERVER_ENABLED	This service's own routing policy — serve downloads through the internal S3 endpoint instead of CDN/external URL. No component — own property — though it sits next to genuinely cross-cutting AC_S3_* rows above, so double-check this reads unambiguously in context	false	—
ASPNETCORE_EXTERNAL_RESOURCE_URL	AC_EXTERNAL_URL	Public base URL clients use to reach resources	https://resource.appcircle.io	not yet resolved — no confirmed external subdomain
ASPNETCORE_EXTERNAL_RESOURCE_PRESERVE_SUBDOMAIN	AC_EXTERNAL_PRESERVE_SUBDOMAIN_ENABLED	Keep the original bucket subdomain when rewriting to the external URL	false	—
ASPNETCORE_S3_CDN_PROVIDER	AC_S3_CDN_PROVIDER	Default CDN provider for signed URLs	GCLOUD | AWS | CLOUDFLARE	—
ASPNETCORE_S3_CDN_MAPPING	AC_S3_CDN_MODULE_URLS	Per-module CDN base URLs	Build=https://cdn1...,Store=https://cdn4...	—
ASPNETCORE_CDN_MODULE_PROVIDERS	AC_S3_CDN_MODULE_PROVIDERS	Per-module CDN provider overrides	CodePush=CLOUDFLARE	—
ASPNETCORE_CLOUDFLARE_URL_SIGN_SECRET	AC_CLOUDFLARE_URL_SIGN_SECRET 🔒	Cloudflare signed-URL secret	${secret:cloudflare/url_sign_secret}	${secret:cloudflare/url_sign_secret} (generatable, hex(32))
ASPNETCORE_URL_SIGN_KEY_NAME	AC_GCLOUD_CDN_URL_SIGN_KEY_NAME	GCP Cloud CDN signing key name	resource-key	—
ASPNETCORE_URL_SIGN_SIGN_KEY	AC_GCLOUD_CDN_URL_SIGN_KEY 🔒	GCP Cloud CDN signing key value	${secret:gcloud/cdn_sign_key}	${secret:gcloud/cdn_sign_key} (generatable, base64(32))
ASPNETCORE_URL_SIGN_PRIVATE_KEY	AC_AWS_CDN_URL_SIGN_PRIVATE_KEY 🔒	CloudFront private key	${secret:aws/cdn_private_key}	${secret:aws/cdn_private_key} (generatable, rsa(2048), publicKeyPath: "aws/cdn_public_key" — see note below)
ASPNETCORE_URL_SIGN_PUBLIC_KEY_ID	AC_AWS_CDN_URL_SIGN_PUBLIC_KEY_ID	CloudFront key-pair ID	K44JRUNAWZ3VN	—
ASPNETCORE_URL_SIGN_POLICY	AC_AWS_CDN_URL_SIGN_POLICY	CloudFront canned-policy template	{"Statement":[...]}	—
ASPNETCORE_APPCIRCLE_WEB_CLIENT_ID	AC_KEYCLOAK_WEB_CLIENT_ID	OIDC client id for appcircle-web, used in token exchange	appcircle-web	"appcircle-web" (literal, not context)
ASPNETCORE_APPCIRCLE_WEB_CLIENT_SECRET	AC_KEYCLOAK_WEB_CLIENT_SECRET 🔒	Client secret for appcircle-web	${secret:keycloak/web_client_secret}	${secret:keycloak/web_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	External OIDC issuer base URL	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	In-cluster Keycloak base URL	http://keycloak:8080	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's Keycloak client id — named after Keycloak (the dependency), not this service; the owning service is already implicit in its own envdef.yaml	resource-server	"resource-server" (literal, not context — this service's own fixed id)
ASPNETCORE_KEYCLOAK_CLIENT_SECRET	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's Keycloak client secret. The secret's storage path stays service-scoped (${secret:resource-api/...}) for authorization purposes even though the variable name is not	${secret:resource-api/keycloak_client_secret}	${secret:resource-api/keycloak_client_secret} (generatable)
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum log level	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Liveness health endpoint path	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Deep/readiness health endpoint path	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Log liveness health requests. Inverts the old IGNORE flag: IGNORE=true becomes ENABLED=false	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Log deep-health requests	false	—
ASPNETCORE_FILE_SYSTEM_ROOT_PATH	AC_FILE_SYSTEM_ROOT_PATH	Root directory for self-hosted filesystem storage	/data/resources	—
ASPNETCORE_IS_SELF_HOSTED	AC_IS_SELF_HOSTED	Whether the installation is self-hosted. Deployment-wide, so no component (see Environment Variables)	false	—
TEMP_CLEAN_PERIOD_HOURS	AC_TEMP_CLEAN_PERIOD_HOURS	Interval, in hours, of the expired-temp cleanup job	24	—
TEMP_CLEAN_BUCKETS	AC_TEMP_CLEAN_BUCKETS	Buckets scanned by the temp cleaner	build,distribution	—

The three CDN signing secrets are generatable, not install-provided

Confirmed via AwsUrlSigner.cs/GoogleLocalUrlSigner.cs/CloudFlareLocalUrlSigner.cs: all three are arbitrary keys we choose, not certificates issued by the provider — Cloudflare and GCP just HMAC a string with them, and even AWS CloudFront's is a plain RSA keypair (ConvertPemXmlCertificate accepts PKCS#8, exactly what rsa(n) produces). Generating them here doesn't remove the manual step: an operator still has to register the generated public key/secret on the provider's own console (AWS Trusted Key Group, GCP Cloud CDN key, Cloudflare Worker config) — same shape as any rsa(n) pair's public half.

Removed (unused or deprecated)

These variables are present in current settings but are no longer read by the code, or are explicitly deprecated. They are dropped in the target model:

Current variable	Replaced by
ASPNETCORE_RESOURCE_URL	AC_EXTERNAL_URL
ASPNETCORE_MINIO_ENDPOINT	AC_S3_ADDRESS
ASPNETCORE_MINIO_ACCESS_KEY	AC_S3_ACCESS_KEY
ASPNETCORE_MINIO_SECRET_KEY	AC_S3_SECRET_KEY
ASPNETCORE_MINIO_REGION	AC_S3_REGION
ASPNETCORE_URL_SIGN_ENDPOINT	AC_S3_CDN_MODULE_URLS

API Gateway

Repository: ac-server-apigateway.

The .NET host calls AddEnvironmentVariables("ASPNETCORE_"), so most keys are read prefix-stripped via IConfiguration; a few are read whole via Environment.GetEnvironmentVariable. Current names below are as actually set (from launchSettings.json and docker-compose.override.yml); rows marked "(code only)" are read at runtime but not declared in any settings file.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	Kestrel listen port for the gateway itself	8100	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Hosting environment name driving env-specific behavior	Development	—
ASPNETCORE_CERT_PATH	AC_CERT_PATH	Path to the gateway's own TLS PFX certificate loaded by Kestrel	star.appcircle.io.pfx	—
ASPNETCORE_CERT_PASSWORD	AC_CERT_PASSWORD 🔒	Password for the gateway's TLS PFX certificate	${secret:api-gateway/cert_password}	${secret:api-gateway/cert_password}
ASPNETCORE_MAX_RESPONSE_BUFFER_SIZE	AC_MAX_RESPONSE_BUFFER_SIZE	Kestrel max response buffer size in bytes (code only)	2147483648	—
PrivateApiUrl	AC_EXTERNAL_URL	The gateway's own public API base URL, injected into the OpenAPI server list	https://api.appcircle.io	${context:api_external_url}
ASPNETCORE_OCELOT_HOSTS_API_GATEWAY	AC_EXTERNAL_URL	Same public base URL, substituted into the Ocelot routing template as the gateway's own host	https://api.appcircle.io	${context:api_external_url}
ASPNETCORE_SERVER_URLS	AC_SERVER_URLS	Comma-separated downstream service base URLs the gateway aggregates for service-info and deep-health probing	http://signing-identity.appcircle.svc.cluster.local,http://license.appcircle.svc.cluster.local,...	${context:api_gateway_server_urls}
ASPNETCORE_CORS_SUFFIX	AC_CORS_SUFFIX	Domain suffix used to build the allowed CORS origins	.appcircle.io	".${context:external_root_host}" — leading . required, external_root_host itself is bare
ASPNETCORE_ADDITIONAL_ALLOWED_CSP_HOSTS	AC_ADDITIONAL_ALLOWED_CSP_HOSTS	Optional, comma-separated extra hosts appended to the CSP default-src/connect-src directives, alongside the hardcoded *.appcircle.io literal and a *.{root domain} wildcard the gateway derives itself from ASPNETCORE_OIDC_EXTERNAL_URL (Startup.cs:785-798: strips the scheme, drops the first host label, prefixes *.)	extra-cdn.example.com	—
ASPNETCORE_SELF_HOSTED_MODULES	AC_SELF_HOSTED_MODULES	Comma-separated allow-list of enabled modules in self-hosted mode	build,distribute	—
ASPNETCORE_IS_SELF_HOSTED	AC_IS_SELF_HOSTED	Deployment-wide flag marking a self-hosted install	false	—
ASPNETCORE_OCELOT_CONFIG_SUFFIX	AC_OCELOT_CONFIG_SUFFIX	Selects which ocelot-source.<suffix>.yaml template the routing config is generated from	local	—
APPCIRCLE_OCELOT_PRIMARY_FILE	AC_OCELOT_PRIMARY_FILE_PATH	Path to the primary generated Ocelot config file loaded at startup	OcelotConfigs/ocelot.json	—
ASPNETCORE_RATE_LIMITING_ENABLED	AC_RATE_LIMITING_ENABLED	Master switch for request rate limiting	true	—
ASPNETCORE_RATE_LIMITING_GLOBAL_IP_ENABLED	AC_RATE_LIMITING_GLOBAL_IP_ENABLED	Enables the global per-IP rate-limiting middleware	false	—
ASPNETCORE_RATE_LIMITING_GLOBAL_IP_POLICY	AC_RATE_LIMITING_GLOBAL_IP_POLICY	Policy expression (window/maxRequests/header) for the global per-IP limiter (code only)	window=1m, maxRequests=600	—
ASPNETCORE_OPTIMIZE_MEMORY_GC_MODE	AC_OPTIMIZE_MEMORY_GC_MODE	GC mode toggle (server/workstation/auto) applied at startup	server	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog log level for the gateway	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path of the shallow health endpoint, used for log filtering	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path of the deep health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether to log shallow health-check requests; inverted from the negative IGNORE flag (IGNORE=true becomes ENABLED=false)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether to log deep health-check requests; inverted from the negative IGNORE flag	false	—
MAIL_ENCRYPTION_KEY	AC_MAIL_ENCRYPTION_KEY 🔒	Key for decrypting mail/unsubscribe payload tokens	${secret:api-gateway/mail_encryption_key}	${secret:api-gateway/mail_encryption_key} (generatable)
ASPNETCORE_UNSUB_RIJNDAEL_KEY	AC_UNSUB_RIJNDAEL_KEY 🔒	Rijndael key for decrypting unsubscribe links	${secret:api-gateway/unsub_rijndael_key}	${secret:api-gateway/unsub_rijndael_key} (generatable)
API_KEY_SECRET_ENCRYPTION_KEY	AC_API_KEY_SECRET_ENCRYPTION_KEY 🔒	Encryption key for API-key secrets (code only)	${secret:api-gateway/api_key_secret_encryption_key}	${secret:api-gateway/api_key_secret_encryption_key} (generatable)
KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the outgoing message broker	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Redis host:port (no scheme) for the gateway's cache/rate-limit store	redis.appcircle.svc.cluster.local:6379	${context:api_gateway_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	The gateway's own Redis key prefix/namespace (own cache prefix → no component)	Apigateway	—
REDIS_PASSWORD	AC_REDIS_PASSWORD 🔒	Password to authenticate to Redis (code only)	${secret:api-gateway/redis_password}	${secret:api-gateway/redis_password} (generatable)
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Base URL of the Keycloak server the gateway calls	http://keycloak:8080	${context:keycloak_internal_url}
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable Keycloak/OIDC URL used to build candidate issuers	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_OIDC_DISCOVERY_URL	AC_KEYCLOAK_OIDC_DISCOVERY_URL	Keycloak OIDC discovery URL for the main appcircle realm	http://keycloak:8080/auth/realms/appcircle/.well-known/openid-configuration	"${context:keycloak_internal_url}/auth/realms/appcircle/.well-known/openid-configuration"
ASPNETCORE_STORE_OIDC_DISCOVERY_URL	AC_KEYCLOAK_STORE_OIDC_DISCOVERY_URL	Keycloak OIDC discovery URL for the store realm	http://keycloak:8080/auth/realms/store/.well-known/openid-configuration	"${context:keycloak_internal_url}/auth/realms/store/.well-known/openid-configuration"
ASPNETCORE_DISTRIBUTE_OIDC_DISCOVERY_URL	AC_KEYCLOAK_DISTRIBUTE_OIDC_DISCOVERY_URL	Keycloak OIDC discovery URL for the distribute realm	http://keycloak:8080/auth/realms/distribute/.well-known/openid-configuration	"${context:keycloak_internal_url}/auth/realms/distribute/.well-known/openid-configuration"
ASPNETCORE_ADDITIONAL_ISSUER_URL_LIST	AC_KEYCLOAK_ADDITIONAL_ISSUER_URLS	Comma-separated extra token issuer URLs accepted alongside the primary issuer during JWT validation (Startup.cs:898-930, GetCandidateIssuers: the primary issuer is ASPNETCORE_OIDC_EXTERNAL_URL's scheme/host/port rewritten onto the realm's own issuer URI; this list is appended verbatim, no rewriting)	https://auth.appcircle.io,https://auth.appcircle.io/auth/realms/store,https://auth.appcircle.io/auth/realms/distribute	${context:api_gateway_additional_issuer_urls}
ASPNETCORE_KEYCLOAK_AUDIENCE	AC_KEYCLOAK_AUDIENCE	Authorization audience for the Keycloak admin client	license-server	"license-server" (literal, not context)
ASPNETCORE_APPCIRCLE_WEB_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	The gateway's own Keycloak client id (appcircle-web) used for token exchange	appcircle-web	"appcircle-web" (literal, not context)
ASPNETCORE_APPCIRCLE_WEB_SECRET	AC_KEYCLOAK_CLIENT_SECRET 🔒	Secret for the gateway's own appcircle-web Keycloak client	${secret:api-gateway/keycloak_client_secret}	${secret:api-gateway/keycloak_client_secret} (generatable)
ASPNETCORE_TESTER_CLIENT_ID	AC_KEYCLOAK_TESTER_CLIENT_ID	Keycloak client id for the tester web app, surfaced to clients	tester-web	"tester-web" (literal, not context)
ASPNETCORE_STORE_WEB_CLIENT_ID	AC_KEYCLOAK_STORE_WEB_CLIENT_ID	Keycloak client id for the store web app	store-web	"store-web" (literal, not context)
ASPNETCORE_RESOURCE_CLIENT_ID	AC_KEYCLOAK_RESOURCE_CLIENT_ID	Keycloak client id used as the valid audience when validating resource-server tokens	resource-server	"resource-server" (literal, not context)
ASPNETCORE_REPORTING_SERVER_CLIENT_ID	AC_KEYCLOAK_REPORTING_SERVER_CLIENT_ID	Keycloak client id for the reporting server	reporting-server	"reporting-server" (literal, not context)
ASPNETCORE_OCELOT_HOSTS_KEYCLOAK_HOST	AC_KEYCLOAK_HOST	Keycloak host (no scheme/port) substituted into the Ocelot routing template	auth.appcircle.io	${context:keycloak_x_forwarded_host}
ASPNETCORE_OCELOT_HOSTS_KEYCLOAK_PROTO	AC_KEYCLOAK_SCHEME	Scheme (http/https) for the Keycloak route	http	${context:keycloak_x_forwarded_proto}
ASPNETCORE_OCELOT_HOSTS_KEYCLOAK_PORT	AC_KEYCLOAK_PORT	Port for the Keycloak route	80	${context:keycloak_x_forwarded_port}
ASPNETCORE_STORE_JWT_RSA_PUBLIC_KEY	AC_STORE_JWT_RSA_PUBLIC_KEY	RSA public key used to validate JWTs issued by the Store service	-----BEGIN PUBLIC KEY-----...	${secret:store-api/jwt_rsa_public_key} — via consumers, see note below
ASPNETCORE_DISTRIBUTION_JWT_RSA_PUBLIC_KEY	AC_DISTRIBUTION_JWT_RSA_PUBLIC_KEY	RSA public key used to validate JWTs issued by the Distribution service	-----BEGIN PUBLIC KEY-----...	${secret:distribution/jwt_rsa_public_key} — via consumers, same shape as Store API's row above
ASPNETCORE_USER_SERVER_URL	AC_USER_SERVER_INTERNAL_URL	Base address of the user server the gateway calls via UserServerClient	http://user:8021	${context:user_internal_url}
ASPNETCORE_RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Base URL of the Resource service registered as ResourceClient	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_FORCE_KEYCLOAK_HEADERS	AC_FORCE_KEYCLOAK_HEADERS_ENABLED	Bool forcing injection of Keycloak headers on requests	false	—
ASPNETCORE_OCELOT_HOSTS_SIGNING_IDENTITY	AC_SIGNING_IDENTITY_API_INTERNAL_URL	Internal URL of the signing-identity service, routed via Ocelot	http://signingidentity:8022	${context:signing_identity_internal_url}
ASPNETCORE_OCELOT_HOSTS_LICENSE	AC_LICENSE_API_INTERNAL_URL	Internal URL of the license service	http://license:8024	${context:license_internal_url}
ASPNETCORE_OCELOT_HOSTS_DISTRIBUTION	AC_DISTRIBUTION_INTERNAL_URL	Internal URL of the distribution service	http://distribution:8016	${context:distribution_internal_url}
ASPNETCORE_OCELOT_HOSTS_NOTIFICATION	AC_NOTIFICATION_INTERNAL_URL	Internal URL of the notification service	http://notification:8019	${context:notification_internal_url}
ASPNETCORE_OCELOT_HOSTS_IDENTITY	AC_IDENTITY_INTERNAL_URL	Internal URL of the identity provider route (points to Keycloak)	http://keycloak:9302	${context:keycloak_internal_url} — same target, different Ocelot route
ASPNETCORE_OCELOT_HOSTS_BUILD	AC_BUILD_API_INTERNAL_URL	Internal URL of the build service	http://build:8023	${context:build_internal_url}
ASPNETCORE_OCELOT_HOSTS_STORE_SUBMIT	AC_STORE_SUBMIT_API_INTERNAL_URL	Internal URL of the store-submit service	http://storesubmit:8027	${context:store_submit_internal_url}
ASPNETCORE_OCELOT_HOSTS_REPORT	AC_REPORT_INTERNAL_URL	Internal URL of the report service	http://report:8025	${context:report_internal_url}
ASPNETCORE_OCELOT_HOSTS_UI	AC_UI_INTERNAL_URL	Internal URL of the UI service	http://ui:56205	${context:ui_internal_url}
ASPNETCORE_OCELOT_HOSTS_TASK	AC_TASK_INTERNAL_URL	Internal URL of the task service	http://task:8028	${context:task_internal_url}
ASPNETCORE_OCELOT_HOSTS_STORE_PROFILE	AC_STORE_PROFILE_INTERNAL_URL	Internal URL of the store-profile service	http://store-profile:8105	${context:store_profile_internal_url}
ASPNETCORE_OCELOT_HOSTS_STORE_API	AC_STORE_API_INTERNAL_URL	Internal URL of the store-api service	http://store-api:8106	${context:store_api_internal_url}
ASPNETCORE_OCELOT_HOSTS_TESTER_API	AC_TESTER_API_INTERNAL_URL	Internal URL of the tester-api service	http://tester-api:8044	${context:tester_api_internal_url}
ASPNETCORE_OCELOT_HOSTS_STORE_REPORT	AC_STORE_REPORT_INTERNAL_URL	Internal URL of the store-report service	http://store-report:8075	${context:store_report_internal_url}
ASPNETCORE_OCELOT_HOSTS_WEBHOOK	AC_WEBHOOK_INTERNAL_URL	Internal URL of the webhook service	http://webhook:8076	${context:webhook_internal_url}
ASPNETCORE_OCELOT_HOSTS_RESIGN	AC_RESIGN_INTERNAL_URL	Internal URL of the resign service	http://resign:8031	${context:resign_internal_url}
ASPNETCORE_OCELOT_HOSTS_PUBLISH	AC_PUBLISH_INTERNAL_URL	Internal URL of the publish service	http://publish:8032	${context:publish_internal_url}
ASPNETCORE_OCELOT_HOSTS_AGENTCACHE	AC_AGENTCACHE_INTERNAL_URL	Internal URL of the agent-cache service	http://agentcache:8068	${context:agentcache_internal_url}
ASPNETCORE_OCELOT_HOSTS_STORE_ADMIN	AC_STORE_ADMIN_INTERNAL_URL	Internal URL of the store-admin service	http://store-admin:8030	${context:store_admin_internal_url}
ASPNETCORE_OCELOT_HOSTS_RESOURCE	AC_RESOURCE_API_INTERNAL_URL	Internal URL of the resource service (routing)	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_OCELOT_HOSTS_CODEPUSH	AC_CODEPUSH_INTERNAL_URL	Internal URL of the codepush service	http://codepush:8787	${context:codepush_internal_url}

ASPNETCORE_ADDITIONAL_ALLOWED_CSP_HOSTS

Confirmed via Startup.cs:786-798: read as a raw literal (, → space, http(s):// stripped) and appended verbatim to the CSP header — no composition happens. It exists for hosts outside the *.{root domain} wildcard the gateway already derives for itself, e.g. a self-hosted install's own extra CDN/integration domain, so it's arbitrary operator-supplied data, not a deployment context fact — same category as ASPNETCORE_ALLOWED_REDIRECT_HOSTS elsewhere in this doc.

ASPNETCORE_OCELOT_HOSTS_KEYCLOAK_HOST/_PROTO/_PORT aren't a split of keycloak_internal_url

Confirmed against appcircle-self-hosted's real template: these three come from keycloak.external.xForwardedHost/xForwardedProto/xForwardedPort, not from fragmenting the internal Keycloak URL. They're the exact same values this file already derives as keycloak_x_forwarded_host/_proto/_port for a related but distinct purpose (telling Keycloak, via X-Forwarded-* headers, what external URL the original browser request came in on, since Ocelot reaches it over its internal address). Same source, two consumers.

ASPNETCORE_STORE_JWT_RSA_PUBLIC_KEY / ASPNETCORE_DISTRIBUTION_JWT_RSA_PUBLIC_KEY are secrets, not context

An earlier pass through this doc called this an unmodeled gap — "neither ${context:...} nor ${secret:...} handles cross-service public-key distribution." That was wrong: it's a ${secret:...}, just not this service's own path. A public key isn't confidential, but it still needs to be stable and provisioned once, which is exactly what the secret store is for — being non-secret doesn't make it a context value, since it isn't computed from any install input either.

It's the public half of Store API's own store-api/jwt_rsa_private_key (see that service's own section), so it needs two sourcing-policy rules, not one: the private-key rule (generator: "rsa(2048)", publicKeyPath: "store-api/jwt_rsa_public_key") drives generation of both halves, and a second rule at store-api/jwt_rsa_public_key itself (not independently generatable — it is always a byproduct of the first rule) is what actually lets anything read the value back, with API Gateway named in that rule's own consumers — the same mechanism already used for shared/redis_password in the worked sourcing-policy example. GeneratorSpec now has an rsa(n) option (SecretProvisioner writes both halves together, and self-heals a missing public half from an existing private key without ever regenerating the private key) — see Provisioning.

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION	— (Minio client code commented out)
ASPNETCORE_BUCKET_PREFIX	— (never read)
ASPNETCORE_AUDIENCE	AC_KEYCLOAK_AUDIENCE (legacy leftover)
ENABLE_ERROR_HANDLING	— (never read)
ASPNETCORE_UNSUB_RIJNDAEL_IV	— (only ..._KEY is used)
ASPNETCORE_GOOGLE_SHEETS_SHEET_NAME / _SPREADSHEET_ID / _CREDENTIAL_FILE	— (never read)
ASPNETCORE_ISSUERS / ASPNETCORE_TOKEN_CERT_PATH / ASPNETCORE_TOKEN_CERT_PASSWORD	— (legacy leftover, never read)

Distribution Server

Repository: ac-server-distribution.

The default host exposes env vars verbatim and Program.cs also calls AddEnvironmentVariables("ASPNETCORE_") (prefix stripped). Current names below are as set in launchSettings.json / appsettings.json.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment, lowercased to select NLog.production.config vs NLog.config	production	—
ASPNETCORE_PORT	AC_PORT	Kestrel listen port; startup throws if unset	8016	—
CUSTOMCONNSTR_DISTRIBUTION_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string (distributionStore database)	${secret:distribution-server/db_connection_string}	${secret:distribution-server/db_connection_string}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Redis host:port (no scheme) used as the StackExchange distributed-cache configuration	redis.appcircle.svc.cluster.local:6379	${context:distribution_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own Redis cache key prefix (defaults to DistributionServer)	DistributionServer	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the message brokers and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Internal Keycloak base URL used to build the Keycloak client	http://keycloak:8080	${context:keycloak_internal_url}
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable Keycloak/OIDC issuer URL set as ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id (also the default audience)	license-server	"license-server" (literal, not context)
ASPNETCORE_KEYCLOAK_AUDIENCE	AC_KEYCLOAK_AUDIENCE	This service's own expected token audience; falls back to the client id when blank	license-server	"license-server" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:distribution-server/keycloak_client_secret}	${secret:distribution-server/keycloak_client_secret} (generatable)
ASPNETCORE_RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Internal base URL of the Resource server, passed to AddResourceClient	http://resource-cluster-service	${context:resource_internal_url}
ASPNETCORE_BUILD_SERVER_URL	AC_BUILD_API_INTERNAL_URL	Internal base URL of the Build server for the BuildClient	http://buildserver-cluster-service	${context:build_internal_url}
ASPNETCORE_SIGNING_IDENTITY_SERVER_URL	AC_SIGNING_IDENTITY_API_INTERNAL_URL	Internal base URL of the Signing Identity server for the SigningIdentityClient	http://signingidentity-cluster-service	${context:signing_identity_internal_url}
ASPNETCORE_STORE_SUBMIT_SERVER_URL	AC_STORE_SUBMIT_API_INTERNAL_URL	Internal base URL of the Store Submit server for the StoreSubmitClient	http://storesubmitserver-cluster-service:80	${context:store_submit_internal_url}
ASPNETCORE_LICENSE_SERVER_URL	AC_LICENSE_API_INTERNAL_URL	Internal base URL of the License server for the LicenseClient; when blank the client is left unconfigured	http://licenseserver-cluster-service	${context:license_internal_url}
PrivateApiUrl	AC_API_INTERNAL_URL	Internal API-gateway base URL used to build binary download links and ApplicationSetting	http://api-cluster-service	${context:api_gateway_internal_url}
TesterWebUrl	AC_TESTER_WEB_URL	External Tester/distribution web URL used to build the app links emailed to testers	https://my.appcircle.io	${context:tester_external_url}
WebUrl	AC_WEB_URL	External main web dashboard URL used when composing tester notification links	https://my.appcircle.io	${context:tester_external_url}
ASPNETCORE_DEFAULT_APP_ICON	AC_DEFAULT_APP_ICON_URL	Default application icon URL stored in ApplicationSetting	https://cdn.appcircle.io/common/images/defaultApp.png	—
ASPNETCORE_UNSUB_RIJNDAEL_KEY	AC_UNSUBSCRIBE_ENCRYPTION_KEY 🔒	Base64 AES-GCM key used to encrypt the unsubscribe token in notification emails	${secret:distribution-server/unsubscribe_encryption_key}	${secret:distribution-server/unsubscribe_encryption_key} (generatable)
ASPNETCORE_TESTER_ENCRYPTION_KEY	AC_TESTER_ENCRYPTION_KEY 🔒	Base64 AES-GCM key used to encrypt the tester approval payload in notification emails	${secret:distribution-server/tester_encryption_key}	${secret:distribution-server/tester_encryption_key} (generatable)
ASPNETCORE_TESTER_EMAIL_FAIR_USAGE_LIMIT	AC_TESTER_EMAIL_FAIR_USAGE_LIMIT	Default tester-email fair-usage limit as count_period (e.g. 10000_1m)	10000_1m	—
ASPNETCORE_TESTER_STARTER_EMAIL_FAIR_USAGE_LIMIT	AC_TESTER_STARTER_EMAIL_FAIR_USAGE_LIMIT	Tester-email fair-usage limit applied to Starter-license organizations	100_1m	—
ASPNETCORE_DELETE_OLD_ARTIFACTS_ALLOW_DEBUG_VALUES	AC_DELETE_OLD_ARTIFACTS_DEBUG_VALUES_ENABLED	Boolean gating whether debug values are allowed when handling the license delete-old-artifacts event (code only)	false	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog log level	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Basic health-check path, consumed by NLog to suppress/route health request logs	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Deep health-check path, consumed by NLog	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	NLog switch to drop basic-health request logs; inverted from the negative form	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	NLog switch to drop deep-health request logs; inverted from the negative form	false	—
SupportedCultures	AC_SUPPORTED_CULTURES	Comma-separated UI cultures for JSON localization	en,tr	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_BUCKET_PREFIX	AC_S3_BUCKET_PREFIX (only in commented-out code)
ASPNETCORE_APPETIZE_API_KEY / _DOMAIN / _QUERY_MINUTE_PERIOD	— (Appetize report job commented out)
ASPNETCORE_RIJNDAEL_KEY / _IV / ASPNETCORE_UNSUB_RIJNDAEL_IV	— (AES-GCM uses the key only)
ConnectionStrings:DistributionServerDbConnection	AC_DB_CONNECTION_STRING (DB read from CUSTOMCONNSTR_...)
ConnectionStrings:Redis_Connection	AC_REDIS_ADDRESS (Redis read from ASPNETCORE_REDIS_ENDPOINT)
ConnectionStrings:ElasticSearchConnection	— (never read)

Tester Web

Repository: ac-tester-web.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	The TCP port Kestrel binds and listens on; startup fails if it is not a valid integer	5000	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment (selects the production NLog config and toggles the dev exception page)	production	—
IS_SELF_HOSTED	AC_IS_SELF_HOSTED	Deployment-wide flag marking whether the app runs self-hosted, read by HomeController	true	—
TesterWebUrl	AC_EXTERNAL_URL	This app's own public base URL, used to build tester/device links and return URLs in emails and views	https://tester.appcircle.io	${context:tester_external_url}
DEFAULT_SCHEME	AC_SCHEME	URL scheme this app uses when constructing its own redirect/callback URLs (defaults to https)	https	${context:external_scheme}
PrivateApiUrl	AC_API_GATEWAY_INTERNAL_BASE_URL	Internal base URL of the API gateway this app calls (fronts the tester API and signing-identity)	http://api-gateway	${context:api_gateway_internal_url}
ASPNETCORE_TESTER_API_SERVER_PATH	AC_TESTER_API_PATH	Path segment appended to the gateway base URL to reach the distribution tester API	/distribution-tester	—
ASPNETCORE_API_CONFIGURATION	AC_TESTER_API_BASE_URL	Full override for the composed tester API root; when set it replaces PrivateApiUrl + server path	http://tester-api/distribution-tester	—
AuthUrl	AC_KEYCLOAK_INTERNAL_URL	Internal base URL of Keycloak, used to build the token endpoint and the SSO OIDC token URL	http://keycloak	${context:keycloak_internal_url}
ExternalAuthUrl	AC_KEYCLOAK_EXTERNAL_URL	External base URL of Keycloak used for the browser-facing logout redirect (falls back to AuthUrl)	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_CLIENT_TOKEN_URL	AC_KEYCLOAK_TOKEN_URL	Full Keycloak client-token endpoint URL; when set it overrides AuthUrl + TOKEN_PATH	http://keycloak/auth/realms/distribute/protocol/openid-connect/token	"${context:keycloak_internal_url}/auth/realms/distribute/protocol/openid-connect/token"
TOKEN_PATH	AC_KEYCLOAK_TOKEN_PATH	Path appended to AuthUrl to form the Keycloak token endpoint when no full token URL is given	/auth/realms/distribute/protocol/openid-connect/token	—
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_OIDC_EXTERNAL_URL	External Keycloak/OIDC issuer URL whose host seeds the CSP img-src and whose scheme decides HSTS	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_KEYCLOAK_TESTERWEB_CLIENT_ID	AC_KEYCLOAK_WEB_CLIENT_ID	Keycloak client id this app presents when requesting client and SSO tokens	tester-web	"tester-web" (literal, not context)
ASPNETCORE_KEYCLOAK_TESTERWEB_SECRET_ID	AC_KEYCLOAK_WEB_CLIENT_SECRET 🔒	Keycloak client secret paired with the tester-web client id	${secret:tester-web/keycloak_client_secret}	${secret:tester-web/keycloak_client_secret} (generatable)
ASPNETCORE_KEYCLOAK_STOREWEB_CLIENT_ID	AC_KEYCLOAK_STORE_WEB_CLIENT_ID	Store-web Keycloak client id referenced only in error-log messages	store-web	"store-web" (literal, not context)
ASPNETCORE_ALLOWED_SSO_REDIRECT_HOSTS	AC_ALLOWED_SSO_REDIRECT_HOSTS	Comma-separated allow-list of hosts permitted as SSO redirect targets	appcircle.io,my.appcircle.io	not yet resolved — needs a bare-host (no-scheme) derived value
ASPNETCORE_ALLOWED_REDIRECT_HOSTS	AC_ALLOWED_REDIRECT_HOSTS	Comma-separated allow-list of hosts permitted as generic redirect targets	appcircle.io	${context:external_root_host} — matches directly, already bare
CACHE_TIMEOUT_MINUTES	AC_CACHE_TIMEOUT_MINUTES	Cache expiry in minutes for the API configuration cache (defaults to 3)	3	—
FILECACHE_ENABLED	AC_FILECACHE_ENABLED	Boolean enabling the API file cache (defaults to true)	true	—
ENABLE_CACHE	AC_CACHE_ENABLED	Boolean toggling in-memory caching of profile lists and page models (defaults to true)	true	—
ASPNETCORE_ENABLE_TOKEN_LOGING	AC_TOKEN_LOGGING_ENABLED	Boolean enabling logging of tokens (defaults to false)	false	—
ASPNETCORE_OPTIMIZE_MEMORY	AC_MEMORY_OPTIMIZE_ENABLED	When true, registers the memory-optimizer hosted service and disables server GC	true	—
ASPNETCORE_OPTIMIZE_MEMORY_IN_MINUTES	AC_MEMORY_OPTIMIZE_PERIOD_IN_MINUTES	Interval in minutes at which the memory-optimizer service runs	30	—
ASPNETCORE_BINARY_FILECACHE_ENABLED	AC_BINARY_FILECACHE_ENABLED	When true, registers the cached-binary cleaner background service	true	—
ASPNETCORE_BINARY_FILECACHE_PERIOD_IN_MINUTES	AC_BINARY_FILECACHE_PERIOD_IN_MINUTES	Interval in minutes between binary file-cache cleanup runs (defaults to 60)	60	—
ASPNETCORE_BINARY_FILECACHE_MAX_SIZE_MB	AC_BINARY_FILECACHE_MAX_SIZE_MB	Maximum binary file-cache size in MB before cleanup (defaults to 1000)	1000	—
ASPNETCORE_BINARY_FILECACHE_MAX_SIZE_DURATION_HOURS	AC_BINARY_FILECACHE_MAX_SIZE_DURATION_HOURS	Maximum age in hours a cached binary is kept before eviction (defaults to 120)	120	—
ASPNETCORE_OTP_CODE_VALIDITY_IN_MINUTES	AC_OTP_CODE_VALIDITY_IN_MINUTES	Validity window in minutes for login OTP codes	5	—
RESEND_OTP_DISABLED	AC_OTP_RESEND_DISABLED	Boolean; when true disables the resend-OTP option on the login flow	false	—
AUTH_PROXY_ENABLED	AC_AUTH_PROXY_ENABLED	When true, inserts the AuthProxyMiddleware into the request pipeline	false	—
ASPNETCORE_OPENSSL_COMMAND	AC_OPENSSL_COMMAND_PATH	Path/command used to invoke the openssl binary for signing operations (defaults to openssl)	/usr/bin/openssl	—
DEFAULT_ORGANIZATION_ID	AC_DEFAULT_ORGANIZATION_ID	Default organization GUID applied when set (self-hosted single-org handling)	00000000-0000-0000-0000-000000000000	—
ASPNETCORE_TESTER_ENCRYPTION_KEY	AC_ENCRYPTION_KEY 🔒	Encryption key used to decrypt/verify unsubscribe (email-link) tokens	${secret:tester-web/encryption_key}	${secret:tester-web/encryption_key} (generatable)
MOBILE_CONFIG_SIGN_PEM	AC_MOBILE_CONFIG_SIGN_PEM 🔒	Base64-encoded PEM certificate written to disk to sign iOS .mobileconfig profiles	${secret:tester-web/mobileconfig_sign_pem}	${secret:tester-web/mobileconfig_sign_pem} — install-provided, not generatable
MOBILE_CONFIG_SIGN_KEY	AC_MOBILE_CONFIG_SIGN_KEY 🔒	Base64-encoded private key written to disk to sign iOS .mobileconfig profiles	${secret:tester-web/mobileconfig_sign_key}	${secret:tester-web/mobileconfig_sign_key} — install-provided, not generatable
MOBILE_CONFIG_SIGN_CERT_CHAIN	AC_MOBILE_CONFIG_SIGN_CERT_CHAIN 🔒	Base64-encoded certificate chain written to disk for .mobileconfig signing	${secret:tester-web/mobileconfig_sign_cert_chain}	${secret:tester-web/mobileconfig_sign_cert_chain} — install-provided, not generatable

Tester API Service

Repository: ac-service-tester-api.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; read to pick the NLog config and toggle Swagger	production	—
ASPNETCORE_PORT	AC_PORT	This service's own HTTP listen port, bound via Kestrel.ListenAnyIP	8044	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	This service's own minimum log level, consumed by the shared NLog config	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Basic health-check path, served by app.UseBasicHealth()	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Deep health-check path, served by app.UseDeepHealth()	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic-health request logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep-health request logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_TESTER_API_SERVER_URL	AC_EXTERNAL_URL	This service's own public base URL, used to build absolute icon URLs pointing back to itself	https://tester-api.appcircle.io	not yet resolved — tester-api isn't one of the five external subdomains this system currently derives
CUSTOMCONNSTR_TESTER_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string (distributionStore database)	${secret:tester-api/db_connection_string}	${secret:tester-api/db_connection_string}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Redis host:port for the distributed cache	redis.appcircle.svc.cluster.local:6379	${context:tester_api_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own cache key prefix (Redis InstanceName, defaults to TesterApi)	TesterApi	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers, passed to KafkaHealthCheck and the shared Kafka event controller	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Keycloak server base URL used server-side for token operations	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Keycloak's externally reachable OpenID issuer URI, set as ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	license-server	"license-server" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:tester-api/keycloak_client_secret}	${secret:tester-api/keycloak_client_secret} (generatable)
ASPNETCORE_JWT_RSA_PRIVATE_KEY	AC_JWT_RSA_PRIVATE_KEY 🔒	This service's own RSA private key used by JwtHandler to sign issued JWTs	${secret:tester-api/jwt_rsa_private_key}	${secret:tester-api/jwt_rsa_private_key} (generatable, rsa(2048))
OTP_SERVICE_API_ROOT	AC_OTP_INTERNAL_URL	Base URL of the internal OTP service (health check and OtpServiceApiClient)	http://otp:8033	not yet resolved — new candidate input, not confirmed
ASPNETCORE_OTP_SERVICE_API_VERSION	AC_OTP_API_VERSION	API version of the internal OTP service	v1	—
ASPNETCORE_RESEND_OTP_DISABLED	AC_RESEND_OTP_ENABLED	Whether OTP resend is allowed (inverted from the negative RESEND_OTP_DISABLED)	true	—
RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Base URL of the internal Resource service, passed to AddResourceClient	http://resource:8012	${context:resource_internal_url}
PrivateApiUrl	AC_API_INTERNAL_URL	Internal API-gateway base URL, used as ApplicationSetting.IconBaseUrl	https://api.appcircle.io	${context:api_gateway_internal_url}
TesterWebUrl	AC_TESTER_WEB_EXTERNAL_URL	External URL of the Tester Web frontend, used to build download/icon/redirect/2FA links	https://tester.appcircle.io	${context:tester_external_url}
ASPNETCORE_DEFAULT_APP_ICON	AC_DEFAULT_APP_ICON_URL	This service's own default app-icon URL	https://cdn.appcircle.io/common/images/defaultApp.png	—
ASPNETCORE_FORCE_STREAM_DOWNLOAD	AC_FORCE_STREAM_DOWNLOAD_ENABLED	Own behavior flag forcing binary downloads to be streamed through the service	true	—
SERVE_DOWNLOADS_FROM_TESTER_WEB	AC_SERVE_DOWNLOADS_FROM_TESTER_WEB_ENABLED	Own behavior flag routing binary download links through Tester Web instead of signed URLs	true	—
SERVE_ICONS_FROM_TESTER_WEB	AC_SERVE_ICONS_FROM_TESTER_WEB_ENABLED	Own behavior flag routing icon links through Tester Web	true	—
PROFILE_LIST_ALLOW_DISK_USE	AC_PROFILE_LIST_ALLOW_DISK_USE_ENABLED	Own behavior flag enabling Mongo allowDiskUse for the profile-list query	false	—
ASPNETCORE_OPTIMIZE_MEMORY	AC_OPTIMIZE_MEMORY_ENABLED	Own behavior flag enabling the periodic MemoryOptimizerService	true	—
ASPNETCORE_OPTIMIZE_MEMORY_IN_MINUTES	AC_OPTIMIZE_MEMORY_PERIOD_MINUTES	Interval in minutes for the memory optimizer's collection cycle	1	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_JWT_RSA_PUBLIC_KEY	— (only the private key is used for signing)
ASPNETCORE_ENABLE_CACHE	— (ENABLE_CACHE is a hardcoded false field, never bound)
ASPNETCORE_STORE_WEB_SCHEME	— (code reads ASPNETCORE_TESTER_WEB_SCHEME, not set here)
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION	— (MinIO client block commented out; downloads go through Resource)
ASPNETCORE_BUCKET_PREFIX	— (never read)
ASPNETCORE_BUILD_SERVER_URL	— (ResignReportClient registration commented out)

Tester Admin Service

Repository: ac-service-tester-admin.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment that selects the NLog config and toggles Swagger	production	—
ASPNETCORE_PORT	AC_PORT	The port Kestrel binds this service to; startup throws if unset or non-numeric	8091	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap server address(es) used to build the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
CUSTOMCONNSTR_DISTRIBUTE_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string (distributionStore database)	${secret:tester-admin-service/db_connection_string}	${secret:tester-admin-service/db_connection_string}
TesterWebUrl	AC_TESTER_WEB_URL	Public base URL of the Tester web portal, used as the Keycloak client root/redirect URL when provisioning SSO clients	https://test.appcircle.io	${context:tester_external_url}
TESTER_REDIRECT_PATH	AC_TESTER_WEB_REDIRECT_PATH	Callback path appended to the Tester web URL to form the SSO login redirect URL	auth_callback	—
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Internal base URL of Keycloak used for admin/token API calls, OIDC options, and the health check	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_HEALTH_PORT	AC_KEYCLOAK_HEALTH_PORT	Internal port on the Keycloak server the health check is rewritten to target	9000	not yet resolved — port-only fragment of keycloak_internal_url
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id used to authenticate to Keycloak	distribute-admin-service	"distribute-admin-service" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:tester-admin-service/keycloak_client_secret}	${secret:tester-admin-service/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	External (public) OIDC issuer URL of Keycloak, set as ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
AuthUrl	AC_KEYCLOAK_EXTERNAL_URL	External Keycloak auth URL used to build the SSO browser login URL; duplicates ASPNETCORE_OIDC_EXTERNAL_URL	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_IS_SELF_HOSTED	AC_IS_SELF_HOSTED	Deployment-wide flag indicating whether the platform runs self-hosted	true	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog logging level (defaults to Trace)	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	This service's basic health endpoint path, used by NLog to optionally suppress request logs	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	This service's deep health endpoint path, used by NLog to optionally suppress request logs	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether health-endpoint request logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep-health request logs are emitted (inverted from the negative IGNORE form)	false	—

Store API Service

Repository: ac-service-store-api.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	The service's own Kestrel listen port; also reused to build http://localhost:<port> self-calls	8106	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment selecting the NLog config and dev behavior	Production	—
ASPNETCORE_IS_SELF_HOSTED	AC_IS_SELF_HOSTED	Deployment-wide flag toggling self-hosted vs cloud download/redirect behavior	false	—
CUSTOMCONNSTR_STORE_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	The service's own MongoDB connection string for the enterpriseStore database	${secret:store-api/db_connection_string}	${secret:store-api/db_connection_string}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Redis cache host:port used for the distributed cache and direct ConnectionMultiplexer connections	redis.appcircle.svc.cluster.local:6379	${context:store_api_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	The service's own Redis key/instance-name prefix (defaults to StoreApi)	StoreApi	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the event producer/consumer and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Base URL of the Resource service, used by the resource HTTP client and its health check	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_OTP_SERVICE_API_ROOT	AC_OTP_INTERNAL_URL	Base URL of the OTP service consumed by the OTP API client	http://otp:8033	not yet resolved — new candidate input, not confirmed
ASPNETCORE_OTP_SERVICE_API_VERSION	AC_OTP_API_VERSION	API version segment used when calling the OTP service	v1	—
ASPNETCORE_RESEND_OTP_DISABLED	AC_OTP_RESEND_ENABLED	Whether OTP resend is allowed (inverted from the negative RESEND_OTP_DISABLED)	true	—
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Internal Keycloak server base URL used by the Keycloak client	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Public Keycloak URL advertised to clients as the external OIDC issuer	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	The service's own Keycloak client id	license-server	"license-server" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	The service's own Keycloak client secret	${secret:store-api/keycloak_client_secret}	${secret:store-api/keycloak_client_secret} (generatable)
ASPNETCORE_STORE_URL	AC_STOREWEB_EXTERNAL_URL	Public Store Web base URL used to build per-organization store domains and verification/logo links	https://store.appcircle.io	${context:store_external_url}
ASPNETCORE_STOREWEB_URL	AC_STOREWEB_INTERNAL_URL	Internal Store Web service URL used for cache-invalidation calls and default-icon links	http://storeweb-headless-service:8080	not yet resolved — new candidate input, not confirmed
ASPNETCORE_STORE_WEB_SCHEME	AC_STOREWEB_SCHEME	Explicit scheme override when constructing Store Web URLs (falls back to the store URL's scheme)	https	${context:external_scheme}
PrivateApiUrl	AC_EXTERNAL_URL	This service's own external API base URL used to construct public binary/icon download links	https://api.appcircle.io	${context:api_external_url}
ASPNETCORE_JWT_RSA_PRIVATE_KEY	AC_JWT_RSA_PRIVATE_KEY 🔒	The service's own RSA private key used to sign store JWTs	${secret:store-api/jwt_rsa_private_key}	${secret:store-api/jwt_rsa_private_key} (generatable, rsa(2048))
ASPNETCORE_JWT_RSA_PUBLIC_KEY	AC_JWT_RSA_PUBLIC_KEY	The service's own RSA public key used to validate store JWTs	-----BEGIN PUBLIC KEY-----...	${secret:store-api/jwt_rsa_public_key} — public half of the row above
ASPNETCORE_FORCE_STREAM_DOWNLOAD	AC_FORCE_STREAM_DOWNLOAD_ENABLED	Toggle forcing binaries to be streamed through the service instead of redirecting	false	—
SERVE_ICONS_FROM_STORE_WEB	AC_SERVE_ICONS_FROM_STORE_WEB_ENABLED	Toggle serving app icons via Store Web rather than direct/signed URLs	false	—
SERVE_DOWNLOADS_FROM_STORE_WEB	AC_SERVE_DOWNLOADS_FROM_STORE_WEB_ENABLED	Toggle serving downloads via Store Web rather than direct/signed URLs	false	—
ASPNETCORE_ENABLE_TOKEN_LOGING	AC_TOKEN_LOGGING_ENABLED	Toggle logging of auth tokens (diagnostic switch)	false	—
ASPNETCORE_OPTIMIZE_MEMORY	AC_OPTIMIZE_MEMORY_ENABLED	Toggle registering the background MemoryOptimizerService (and disabling server GC)	true	—
ASPNETCORE_OPTIMIZE_MEMORY_IN_MINUTES	AC_OPTIMIZE_MEMORY_INTERVAL_MINUTES	Interval in minutes at which the memory optimizer runs	1	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	The service's own minimum NLog level	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path of the basic health endpoint (used by NLog to suppress its request logs)	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path of the deep health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-check request logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-check request logs are emitted (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_CACHE_DURATION_DAYS	— (never read)
ASPNETCORE_STORE_API_SERVER_URL	— (only in commented-out code)
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION / ASPNETCORE_BUCKET_PREFIX	— (MinIO client registration commented out)

Store Profile Service

Repository: ac-service-store-profile.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	The TCP port the service's Kestrel host binds to; required at startup	8105	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment selecting the NLog config and hosting environment	Production	—
CUSTOMCONNSTR_STORE_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	The service's own MongoDB replica-set connection string	${secret:store-profile/db_connection_string}	${secret:store-profile/db_connection_string}
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap server list used by the event consumer/producer and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Base URL of the internal Resource Server the service calls (also health-checked)	http://resourceserver-cluster-service:80	${context:resource_internal_url}
ASPNETCORE_STORE_SUBMIT_SERVER_URL	AC_STORE_SUBMIT_API_INTERNAL_URL	Base URL of the internal Store Submit service the StoreSubmitClient targets	http://storesubmitserver-cluster-service:80	${context:store_submit_internal_url}
PrivateApiUrl	AC_PRIVATE_API_INTERNAL_URL	Base URL of the private API gateway used to build binary download links	https://api.appcircle.io	${context:api_gateway_internal_url}
ASPNETCORE_VAULT_TOKEN	AC_VAULT_TOKEN 🔒	Token used to authenticate to HashiCorp Vault for the certificate safe-store and Vault health check	${secret:store-profile/vault-token}	eliminated (shared static token)
ASPNETCORE_VAULT_API	AC_VAULT_URL	Base API URL of the Vault server used by the Vault health check and certificate safe-store	http://vault:8200/v1/local/	eliminated (legacy direct Vault)
ASPNETCORE_VAULT_SERVICE_PREFIX	AC_VAULT_SERVICE_PREFIX	Path prefix under which this service stores its secrets in Vault	enterprise-store	becomes a sourcing-policy declaration (mount local, prefix enterprise-store)
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Base URL of the Keycloak server the Keycloak client connects to	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id (appcircle realm)	store-server	"store-server" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:store-profile/keycloak_client_secret}	${secret:store-profile/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable Keycloak OIDC issuer URL set as the client's ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_STORE_URL	AC_STORE_WEB_URL	Base URL of the enterprise store web frontend, into which the org subdomain is injected	https://store.appcircle.io	${context:store_external_url}
ASPNETCORE_STORE_WEB_SCHEME	AC_STORE_WEB_SCHEME	Optional scheme override applied when composing the store web URL	https	${context:external_scheme}
ASPNETCORE_DEFAULT_APP_ICON	AC_DEFAULT_APP_ICON_URL	Fallback application icon URL used when an app has no icon	https://cdn.appcircle.io/common/images/defaultApp.png	—
ASPNETCORE_FORCE_STREAM_DOWNLOAD	AC_FORCE_STREAM_DOWNLOAD_ENABLED	Boolean forcing artifact downloads to be streamed through the service	true	—
ASPNETCORE_FORCE_CUSTOM_DOMAIN_ENABLED	AC_FORCE_CUSTOM_DOMAIN_ENABLED	Boolean toggling enforcement of a custom domain for store settings	true	—
ASPNETCORE_FORCE_CUSTOM_DOMAIN_PER_ORGANIZATION	AC_FORCE_CUSTOM_DOMAIN_ORGANIZATIONS	Comma-separated list of organization ids/hosts for which custom-domain enforcement applies	DBF245EA-...,custom.local	—
ASPNETCORE_DELETE_OLD_ARTIFACTS_ALLOW_DEBUG_VALUES	AC_DELETE_OLD_ARTIFACTS_ALLOW_DEBUG_ENABLED	Boolean allowing debug values in the old-artifact deletion handling	true	—
ASPNETCORE_UNSUB_RIJNDAEL_KEY	AC_UNSUB_RIJNDAEL_KEY 🔒	Base64 AES-GCM key used to encrypt the unsubscribe token in notification emails	${secret:store-profile/unsub_rijndael_key}	${secret:store-profile/unsub_rijndael_key} (generatable)
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum log level applied by the NLog configuration	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	HTTP path of the basic health endpoint	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	HTTP path of the deep health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-endpoint requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-endpoint requests are logged (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
WebUrl	— (never read)
ASPNETCORE_OAUTH_CALLBACK_URL	— (only in commented-out code)
ASPNETCORE_BUILD_SERVER_URL	— (never read)
STORE_URL_test	— (leftover test value)
ASPNETCORE_UNSUB_RIJNDAEL_IV	— (AES-GCM derives its own nonce)
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION / ASPNETCORE_BUCKET_PREFIX	AC_S3_* (only in commented-out MinIO client code)

Store Web

Repository: ac-store-web.

A .NET 8 / ASP.NET Core MVC (Kestrel) app. Program.cs calls AddEnvironmentVariables("ASPNETCORE_"), so most keys are read both prefixed and prefix-stripped.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; also picks NLog.production.config vs NLog.config	production	—
ASPNETCORE_PORT	AC_PORT	This app's own Kestrel listen port; throws at startup if unset	8035	—
ASPNETCORE_STORE_WEB_SCHEME	AC_SCHEME	This app's own external scheme, used to decide whether to send HSTS (falls back to DEFAULT_SCHEME)	https	${context:external_scheme}
DEFAULT_SCHEME / ASPNETCORE_DEFAULT_SCHEME	AC_DEFAULT_SCHEME	Fallback scheme for building redirect/callback URLs (two current vars; consolidate to one)	https	${context:external_scheme}
ASPNETCORE_API_CONFIGURATION	AC_STORE_API_INTERNAL_BASE_URL	Base URL of the Store API service this app calls server-side (also its deep health check target)	http://store-api/storeapi	${context:store_api_internal_url}
ASPNETCORE_API_VERSION	AC_STORE_API_VERSION	Version segment used when calling the Store API	v1	"v1" (literal, not context)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	External Keycloak/OIDC URL; used for forwarded headers to SSO and the CSP img-src host	https://auth.appcircle.io	${context:auth_external_url}
AuthUrl	AC_KEYCLOAK_INTERNAL_URL	Internal Keycloak base URL for building the OIDC token endpoint (AuthUrl + TOKEN_PATH)	http://keycloak	${context:keycloak_internal_url}
ExternalAuthUrl	AC_KEYCLOAK_EXTERNAL_URL	External Keycloak URL used to build the logout URL; overlaps ASPNETCORE_OIDC_EXTERNAL_URL (consolidate)	https://auth.appcircle.io	${context:auth_external_url} (dropped once consolidated into ASPNETCORE_OIDC_EXTERNAL_URL above)
ASPNETCORE_TOKEN_PATH	AC_KEYCLOAK_TOKEN_PATH	Path of the Keycloak OIDC token endpoint appended to the auth base URL	/auth/realms/appcircle/protocol/openid-connect/token	"/auth/realms/appcircle/protocol/openid-connect/token" (literal, fixed Keycloak path)
ASPNETCORE_CLIENT_TOKEN_URL	AC_STORE_API_CLIENT_TOKEN_URL	Optional explicit override for the Keycloak client-token HTTP client base address (points at Store API)	https://api.appcircle.io/storeapi/v1/auth/client-token	"${context:api_external_url}/storeapi/v1/auth/client-token" (composed)
ASPNETCORE_KEYCLOAK_STOREWEB_CLIENT_ID	AC_KEYCLOAK_WEB_CLIENT_ID	OIDC client id used when requesting client tokens from Keycloak	store-web	"store-web" (literal, not context)
ASPNETCORE_KEYCLOAK_STOREWEB_SECRET_ID	AC_KEYCLOAK_WEB_CLIENT_SECRET 🔒	OIDC client secret paired with the store-web client id	${secret:store-web/keycloak_client_secret}	${secret:store-web/keycloak_client_secret} (generatable)
ASPNETCORE_STORE_URL	AC_EXTERNAL_URL	This app's own public store URL, used to build store links (falls back to the request host)	https://store.appcircle.io	${context:store_external_url}
ASPNETCORE_CACHE_TIMEOUT_MINUTES	AC_CACHE_TIMEOUT_MINUTES	Own API-response cache timeout in minutes (default 3)	1	—
ASPNETCORE_FILECACHE_ENABLED	AC_FILE_CACHE_ENABLED	Toggles the app's file cache for API responses (default true)	true	—
ASPNETCORE_BINARY_FILECACHE_ENABLED	AC_BINARY_FILE_CACHE_ENABLED	Enables the background CachedBinaryCleanerService for downloaded binaries	false	—
ASPNETCORE_BINARY_FILECACHE_PERIOD_IN_MINUTES	AC_BINARY_FILE_CACHE_PERIOD_MINUTES	Interval between binary-cache cleanup runs (default 60)	60	—
ASPNETCORE_BINARY_FILECACHE_MAX_SIZE_MB	AC_BINARY_FILE_CACHE_MAX_SIZE_MB	Max on-disk binary cache size in MB (default 1000)	10000	—
ASPNETCORE_BINARY_FILECACHE_MAX_SIZE_DURATION_HOURS	AC_BINARY_FILE_CACHE_MAX_AGE_HOURS	Max age in hours before cached binaries are evicted (default 120)	148	—
ASPNETCORE_OPTIMIZE_MEMORY	AC_MEMORY_OPTIMIZE_ENABLED	Enables the MemoryOptimizerService background GC helper	false	—
ASPNETCORE_OPTIMIZE_MEMORY_IN_MINUTES	AC_MEMORY_OPTIMIZE_PERIOD_MINUTES	Interval between memory-optimizer runs	1	—
ASPNETCORE_ENABLE_TOKEN_LOGING	AC_TOKEN_LOGGING_ENABLED	Whether auth tokens are logged (default false)	false	—
ASPNETCORE_CAPTCHA_NOISE_LEVEL	AC_CAPTCHA_NOISE_LEVEL	Noise rate for the generated login captcha (default 600)	600	—
ASPNETCORE_CAPTCHA_DRAW_LINE_COUNT	AC_CAPTCHA_DRAW_LINE_COUNT	Number of distractor lines drawn on the captcha	5	—
ASPNETCORE_CAPTCHA_RIJNDAEL_KEY	AC_CAPTCHA_RIJNDAEL_KEY 🔒	AES/Rijndael key used to encrypt-validate captcha values	${secret:store-web/captcha_rijndael_key}	${secret:store-web/captcha_rijndael_key} (generatable)
ASPNETCORE_IS_SELF_HOSTED	AC_IS_SELF_HOSTED	Deployment-wide flag; when true suppresses in-app HSTS. Note: the read at Startup.cs:234 looks logically inverted and should be reviewed	false	—
ASPNETCORE_ALLOWED_HOSTS	AC_ALLOWED_HOSTS	Comma-separated Host header allowlist enabling HostHeaderValidationMiddleware	store.appcircle.io	not yet resolved — needs a bare-host (no-scheme) derived value
ASPNETCORE_ALLOWED_SSO_REDIRECT_HOSTS	AC_ALLOWED_SSO_REDIRECT_HOSTS	Comma-separated hosts allowed as SSO redirect targets	sso.example.com	not yet resolved — arbitrary customer-configured SSO host, not a deployment context fact
ASPNETCORE_ALLOWED_REDIRECT_HOSTS	AC_ALLOWED_REDIRECT_HOSTS	Comma-separated hosts allowed as generic post-login redirect targets	example.com	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	NLog minimum log level for this app	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Health path matched by NLog to filter health-probe log lines	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Deep-health path matched by NLog for log filtering	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether health-probe logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep-health logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_RESEND_OTP_DISABLED	AC_OTP_RESEND_ENABLED	Whether OTP resend is allowed on login (inverted from the negative RESEND_OTP_DISABLED)	true	—
ASPNETCORE_OTP_CODE_VALIDITY_IN_MINUTES	AC_OTP_CODE_VALIDITY_MINUTES	How long a login OTP code stays valid, in minutes	5	—
AUTH_PROXY_ENABLED	AC_AUTH_PROXY_ENABLED	Enables AuthProxyMiddleware (reverse-proxies auth traffic)	false	—
AUTH_PROXY_FORWARD_URI	AC_AUTH_PROXY_FORWARD_URI	Upstream URI the auth proxy forwards requests to (required when enabled)	http://auth.internal	not yet resolved — arbitrary configured upstream, no confirmed context mapping
AUTH_PROXY_LISTEN_URI	AC_AUTH_PROXY_LISTEN_URI	Public URI the auth proxy listens on / rewrites from	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_DEFAULT_ORGANIZATION_ID	AC_DEFAULT_ORGANIZATION_ID	Default organization GUID used for logo/CSS/store resolution when no org is in context	dbf245ea-...	—
TR_* / EN_* / DE_* (e.g. EN_STORE_TITLE)	AC_I18N_<LANG>_<KEY>	Optional per-language UI string overrides resolved dynamically as <UICULTURE>_<key>	EN_STORE_TITLE=UK Store	—

Removed (unused or deprecated)

Current variable	Replaced by
STOREAPIREDIS_CLUSTER_SERVICE_PORT	— (never referenced)
ASPNETCORE_DEFAULT_SCHEME	AC_DEFAULT_SCHEME (redundant with DEFAULT_SCHEME; consolidate)
ExternalAuthUrl	AC_KEYCLOAK_EXTERNAL_URL (overlaps ASPNETCORE_OIDC_EXTERNAL_URL)

Store Report Service

Repository: ac-service-store-report.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	The Kestrel port this service binds to; throws if unset	8075	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	ASP.NET hosting environment; also selects NLog.production.config vs NLog.config	Development	—
CUSTOMCONNSTR_STORE_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	MongoDB connection string for the service's own enterpriseStore database	${secret:store-report-service/db_connection_string}	${secret:store-report-service/db_connection_string}
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers used by the consumer, the outgoing event handler, and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Base URL of the Keycloak server (server-to-server, internal)	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Public Keycloak/OIDC issuer URL set as ExternalOpenIdUri for token validation	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	store-server	"store-server" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:store-report-service/keycloak_client_secret}	${secret:store-report-service/keycloak_client_secret} (generatable)
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum log level for the NLog root logger	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Basic health endpoint path (used by the NLog filter)	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Deep health endpoint path (used by the NLog filter)	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic-health request logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep-health request logs are emitted (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_REDIS_ENDPOINT	— (no Redis client registered; the service uses AddMemoryCache() only)
ASPNETCORE_DEFAULT_APP_ICON	— (never read)
AuthUrl	— (only read by the commented-out UserService)
PrivateApiUrl	— (assigned in the disabled UserService and never used)

Store Admin Service

Repository: ac-service-store-admin.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	The TCP port Kestrel binds to for this service	8030	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment selecting the NLog config file and dev-only Swagger	Development	—
ASPNETCORE_IS_SELF_HOSTED	AC_IS_SELF_HOSTED	Deployment-wide flag read in SystemBusiness to branch self-hosted behavior	true	—
CUSTOMCONNSTR_STORE_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string for the enterpriseStore database	${secret:store-admin-service/db_connection_string}	${secret:store-admin-service/db_connection_string}
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers used by the message-broker handlers and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_VAULT_API	AC_VAULT_URL	Base URL of the HashiCorp Vault API used by the Vault health check and certificate safe-store	http://vault:8200/v1/local/	eliminated (legacy direct Vault)
ASPNETCORE_VAULT_TOKEN	AC_VAULT_TOKEN 🔒	Auth token for the Vault API	${secret:store-admin-service/vault-token}	eliminated (shared static token)
ASPNETCORE_VAULT_SERVICE_PREFIX	AC_VAULT_SERVICE_PREFIX	This service's path prefix under Vault for storing store certificates	enterprise-store	becomes a sourcing-policy declaration (mount local, prefix enterprise-store)
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Internal Keycloak server URL used for the Keycloak client and health check	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_HEALTH_PORT	AC_KEYCLOAK_HEALTH_PORT	Keycloak's internal port that the service rewrites the health-check URL onto	9000	not yet resolved — port-only fragment of keycloak_internal_url, same gap as Tester Admin Service's row
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	store-admin-service	"store-admin-service" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:store-admin-service/keycloak_client_secret}	${secret:store-admin-service/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable Keycloak/OIDC URL set as ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
AuthUrl	AC_KEYCLOAK_EXTERNAL_URL	Legacy duplicate of the external auth URL used by SsoBusiness to build SSO login URLs (consolidate)	https://auth.appcircle.io	${context:auth_external_url} (dropped once consolidated into ASPNETCORE_OIDC_EXTERNAL_URL above)
STORE_URL	AC_STORE_EXTERNAL_URL	External base URL of the Store web front-end, used to compose per-organization store app root URLs	https://store.appcircle.io	${context:store_external_url}
ASPNETCORE_FORCE_STORE_SCHEME	AC_STORE_SCHEME	Forces the URL scheme used when building custom-domain store URLs (defaults to https)	http	${context:external_scheme}
STORE_REDIRECT_PATH	AC_STORE_REDIRECT_PATH	Path appended to the store app root URL as the SSO auth callback redirect	auth_callback	"auth_callback" (literal, fixed path)
ASPNETCORE_K8_HOST	AC_KUBERNETES_URL	Kubernetes API server URL used by the shared K8Client for ingress management	https://kubernetes.default.svc	not yet resolved — no confirmed context mapping
ASPNETCORE_K8_TOKEN	AC_KUBERNETES_TOKEN 🔒	Service-account bearer token the K8Client uses to call the Kubernetes API	${secret:store-admin-service/kubernetes-token}	not yet resolved — platform-projected ServiceAccount token, not ours to provision
ASPNETCORE_K8_NAMESPACE	AC_KUBERNETES_NAMESPACE	Kubernetes namespace the K8Client operates in	appcircle	not yet resolved — new candidate input, not confirmed
ASPNETCORE_K8_DISABLED	AC_KUBERNETES_ENABLED	Toggle for the Kubernetes/ingress integration (inverted from the negative K8_DISABLED)	true	—
ASPNETCORE_OPENSHIFT_SUPPORT	AC_OPENSHIFT_ENABLED	Boolean switch enabling OpenShift-specific behavior in the K8Client	false	—
ASPNETCORE_HELM_RELEASE_NAME	AC_HELM_RELEASE_NAME	Helm release name passed to K8ClientOptions for naming managed ingress resources	appcircle	not yet resolved — new candidate input, not confirmed
ASPNETCORE_INGRESS_CLASS_NAME	AC_INGRESS_CLASS_NAME	Ingress class name the K8Client sets on managed ingresses	nginx	—
ASPNETCORE_INGRESS_PATH	AC_INGRESS_PATH	Ingress path the K8Client configures for store web routing	/	—
ASPNETCORE_INGRESS_PATH_TYPE	AC_INGRESS_PATH_TYPE	Ingress pathType value the K8Client sets	Prefix	—
ASPNETCORE_INGRESS_NAME_SUFFIX	AC_INGRESS_NAME_SUFFIX	Suffix appended to the generated ingress resource name	store	—
ASPNETCORE_STORE_WEB_SERVICE_NAME	AC_STORE_WEB_SERVICE_NAME	Kubernetes service name of the Store web front-end the managed ingress routes to	store-web	—
ASPNETCORE_STORE_WEB_SERVICE_PORT	AC_STORE_WEB_SERVICE_PORT	Kubernetes service port of the Store web front-end used in the ingress backend	80	—
ASPNETCORE_DISABLE_CUSTOM_DOMAIN_CERTIFICATION_SYNC	AC_CUSTOM_DOMAIN_CERTIFICATION_SYNC_ENABLED	Toggle for custom-domain certificate sync (inverted from the negative DISABLE_ form)	true	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog logging level for this service	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	This service's basic health endpoint path	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	This service's deep health endpoint path	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-check requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-check requests are logged (inverted from the negative IGNORE form)	false	—

App Parser Server

Repository: ac-server-appparser.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment name; selects the NLog config file and is surfaced as the service-info env	production	—
ASPNETCORE_PORT	AC_PORT	This service's own Kestrel listen port; throws at startup if empty	8017	—
ASPNETCORE_RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Full HTTP base URL of the Resource Server this service calls (via AddResourceClient) and health-checks	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap server list used by the consumer/producer and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_PARSE_TOOL	AC_PARSE_TOOL	Name/path of the Android aapt binary the parser invokes to dump APK badging (falls back to aapt)	aapt	—
ASPNETCORE_PARSE_APK_SIGNER	AC_PARSE_APK_SIGNER	Name/path of the apksigner binary used to read signing certificates (falls back to apksigner)	apksigner	—
ASPNETCORE_PARSE_TIMEOUT_SEC	AC_PARSE_TIMEOUT_SEC	Optional per-parse timeout in seconds applied to the cancellation token; no timeout when unset	600	—
ASPNETCORE_MAX_JAVA_MEMORY_SIZE	AC_MAX_JAVA_MEMORY_SIZE	JVM -Xmx argument passed to bundletool/apktool when parsing AAB files (defaults to -Xmx4000M)	-Xmx4000M	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	This service's minimum NLog log level	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	This service's basic health-check endpoint path	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	This service's deep health-check endpoint path	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-check requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-check requests are logged (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION	AC_S3_* (only in commented-out Startup.cs code)

Build Server

Repository: ac-server-build. Component: BUILD_API.

The host binds env vars two ways: the default builder verbatim, plus AddEnvironmentVariables("ASPNETCORE_") (prefix stripped). Current names below are as set in launchSettings.json / appsettings.json.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; selects the NLog config and enables dev-only Git OAuth handling	Production	—
ASPNETCORE_PORT	AC_PORT	Own Kestrel listen port; throws at startup if unset	8023	—
SupportedCultures	AC_SUPPORTED_CULTURES	Own list of localization cultures fed to UseSupportedCulture	en,tr	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Own minimum log level consumed by the shared NLog setup	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Own basic health-check path	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Own deep health-check path	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-probe requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-probe requests are logged (inverted from the negative IGNORE form)	false	—
BUILD_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	Own MongoDB connection string for the buildStore database	${secret:build-server/db_connection_string}	${secret:build-server/db_connection_string}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Redis host:port used for the distributed cache and build-log stream health check	redis.appcircle.svc.cluster.local:6379	${context:build_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	Own Redis key/instance-name prefix (defaults to BuildServer)	BuildServer	—
ASPNETCORE_REDIS_STREAM_ENDPOINT	AC_REDIS_STREAM_ADDRESS	Redis host:port used to provision per-agent build-log stream connections	redis:6379	—
ASPNETCORE_PIN_MIGRATION_REDIS_ENDPOINT	AC_REDIS_MIGRATION_ADDRESS	Redis host:port used by the pin-data migration MigrationV16	redis:6379	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for producing/consuming build events and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_BUCKET_PREFIX	AC_S3_BUCKET_PREFIX	Object-storage bucket-name prefix for build/backup/temp artifacts	appcircle-resource-	— (own value; storage goes through ${context:resource_internal_url}, no S3 credentials here)
ASPNETCORE_CACHE_COMPONENT_PROVIDER_TYPE	AC_CACHE_PROVIDER_TYPE	Object-storage provider selector for the agent-cache feature (GCLOUD vs S3/MinIO)	GCLOUD	— (own feature-selector value, same reasoning as the row above)
ASPNETCORE_VAULT_API	AC_VAULT_URL	Vault API base URL used by VaultClient and the Vault health check	http://vault:8200/v1/local/	eliminated (legacy direct Vault)
ASPNETCORE_VAULT_TOKEN	AC_VAULT_TOKEN 🔒	Vault token sent as X-Vault-Token	${secret:build-server/vault-token}	eliminated (shared static token)
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Keycloak base URL for the UserClient and Keycloak client options	http://keycloak:8080	${context:keycloak_internal_url}
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable Keycloak/OIDC URL (ExternalOpenIdUri)	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	Own Keycloak client id (also used as authorization audience)	build-server	"build-server" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	Own Keycloak client secret (named SECRET_ID but is the client secret)	${secret:build-server/keycloak_client_secret}	${secret:build-server/keycloak_client_secret} (generatable)
RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Base URL of the Resource service HTTP client	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_SIGNING_IDENTITY_SERVER_URL	AC_SIGNING_IDENTITY_API_INTERNAL_URL	Base URL of the Signing Identity service SigningIdentityClient	http://signingidentity:8022	${context:signing_identity_internal_url}
ASPNETCORE_DISTRIBUTE_SERVER_URL	AC_DISTRIBUTION_INTERNAL_URL	Base URL of the Distribution service DistributionClient	http://distribution:8016	${context:distribution_internal_url}
ASPNETCORE_PUBLISH_SERVER_URL	AC_PUBLISH_INTERNAL_URL	Base URL of the Publish service PublishClient	http://publish:8032	${context:publish_internal_url}
ASPNETCORE_STORE_SUBMIT_SERVER_URL	AC_STORE_SUBMIT_API_INTERNAL_URL	Base URL of the Store Submit service StoreSubmitClient	http://storesubmit:8027	${context:store_submit_internal_url}
SCHEDULE_SERVICE_URL	AC_SCHEDULE_INTERNAL_URL	Base URL of the Schedule service ScheduleServiceClient	http://schedule:8029	${context:schedule_manager_internal_url} (env name unconfirmed)
ASPNETCORE_AGENTCACHESERVICE_CLUSTER_SERVICE_SERVICE_HOST	AC_AGENT_CACHE_ADDRESS	Host:port of the Agent Cache service CacheServiceClient	agentcache:8068	not yet resolved — needs a bare host:port, same fragment gap as elsewhere
WebUrl	AC_WEB_URL	Public web-frontend base URL used for OAuth redirect responses and host resolution	https://my.appcircle.io	${context:tester_external_url}
ASPNETCORE_AGENT_OBJECTIVEC_SWIFT_URL	AC_AGENT_OBJECTIVEC_SWIFT_URL	Base URL of the iOS (ObjectiveC/Swift) build-agent pool	http://ios-builders:8080/api/v1/builders	not yet resolved — customer/install-specific build-farm address, no confirmed context mapping
ASPNETCORE_AGENT_JAVA_KOTLIN_URL	AC_AGENT_JAVA_KOTLIN_URL	Base URL of the Android (Java/Kotlin) build-agent pool	http://android-builders:8080/api/v1/builders	not yet resolved — same as above
ASPNETCORE_MOCK_AGENT_OBJECTIVEC_SWIFT_URL	AC_AGENT_MOCK_OBJECTIVEC_SWIFT_URL	Base URL of the mock iOS build-agent pool	http://ios-builders:8080/api/v1/builders?mock=true	not yet resolved — same as above
ASPNETCORE_MOCK_AGENT_JAVA_KOTLIN_URL	AC_AGENT_MOCK_JAVA_KOTLIN_URL	Base URL of the mock Android build-agent pool	http://android-builders:8080/api/v1/builders?mock=true	not yet resolved — same as above
ASPNETCORE_AGENT_CALLBACK_PUBLIC_URL	AC_AGENT_CALLBACK_EXTERNAL_URL	Own externally reachable callback URL handed to build agents	https://api.appcircle.io/build/v1/callback	"${context:api_external_url}/build/v1/callback" (composed)
ASPNETCORE_AGENT_CALLBACK_CLUSTER_URL	AC_AGENT_CALLBACK_INTERNAL_URL	Own in-cluster callback URL handed to build agents	http://build:8023/build/v1/callback	"${context:build_internal_url}/build/v1/callback" (composed)
ASPNETCORE_AGENT_TOKEN_KEY	AC_AGENT_TOKEN_KEY 🔒	Secret key used to sign/validate agent tokens	${secret:build-server/agent_token_key}	${secret:build-server/agent_token_key} (generatable)
ASPNETCORE_QUEUE_LIMIT	AC_QUEUE_LIMIT	Own max concurrent build-queue size in ApplicationSetting	4	—
ASPNETCORE_GITSETTINGS__* (e.g. …__OAUTHS__0__CLIENTID, …__OAUTHS__0__CLIENTSECRET, …__OAUTHS__0__APIURL, …__REDIRECTURL, …__HOOKURLFORMAT)	AC_GIT_SETTINGS__*	Structured Git-provider OAuth/connector config (GitHub/GitLab/Bitbucket/Azure DevOps client ids, secrets, API/redirect/hook URLs) bound into GitSetting. Client-secret leaves are secrets 🔒	AC_GIT_SETTINGS__OAUTHS__0__CLIENTID=Iv1.abc123	not yet resolved — structured config, not a single expression
ASPNETCORE_PLATFORMSETTINGS__n__TYPE, …__USEPUBLICADDRESS	AC_PLATFORM_SETTINGS__*	Structured per-platform build settings (platform type + whether the agent uses the public address) bound into PlatformSetting[]	AC_PLATFORM_SETTINGS__0__TYPE=ObjectiveCSwift	—
ASPNETCORE_CONNECTION_TOKEN_SOURCE	AC_CONNECTION_TOKEN_SOURCE	Selects where Git connection tokens are read from - vault (default) vs db	vault	—
ASPNETCORE_USE_INTERNAL_GIT_ADDRESS	AC_INTERNAL_GIT_ADDRESS_ENABLED	Toggle to rewrite repository clone URLs to an internal Git address	false	—
ASPNETCORE_LOCAL_AGENT	AC_LOCAL_AGENT_ENABLED	Toggle enabling local-agent behavior in queue handling	false	—
ASPNETCORE_USE_LOCAL_DEBUG_AGENT_TOKEN	AC_LOCAL_DEBUG_AGENT_TOKEN_ENABLED	Toggle to accept a local debug agent token instead of a real one	false	—
ASPNETCORE_ENABLE_WEBHOOK_SECURITY_CHECK_ENABLED	AC_WEBHOOK_SECURITY_CHECK_ENABLED	Toggle for verifying inbound Git webhook signatures (disabled only when literally false)	true	—
ASPNETCORE_ENABLE_SERVER_DIAGNOSTIC_COMPONENT	AC_SERVER_DIAGNOSTIC_COMPONENT_ENABLED	Toggle enabling the server-diagnostic component in callback handling	true	—
ASPNETCORE_DELETE_INCONSISTENT_RESOURCE	AC_DELETE_INCONSISTENT_RESOURCE_ENABLED	Toggle enabling the DeleteInconsistentResourceJob background cleanup	true	—
ASPNETCORE_DELETE_OLD_ARTIFACTS_ALLOW_DEBUG_VALUES	AC_DELETE_OLD_ARTIFACTS_DEBUG_VALUES_ENABLED	Toggle allowing debug values in the old-artifact deletion license flow	false	—
ASPNETCORE_CLOSING_METRIC_DATA_SENDING	AC_CLOSING_METRIC_DATA_SENDING_ENABLED	When true, suppresses agent-scaling metric emission in QueueTimeoutJob	false	—
ASPNETCORE_METRIC_DATA_SENDING_ENVIRONMENT	AC_METRIC_DATA_SENDING_ENVIRONMENT	Own environment label tagged onto emitted auto-scale metrics	prod-appcircle	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_RIJNDAEL_KEY / ASPNETCORE_RIJNDAEL_IV	— (agent-payload key is derived from the queue-item id, not these)
ASPNETCORE_IDENTITY_SERVER_URL	— (never read; only SIGNING_IDENTITY_SERVER_URL is used)
ASPNETCORE_MOCK	— (mock routing is chosen per-request)
PrivateApiUrl	— (not read in runtime code)
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION	AC_S3_* (only in commented-out code)

License Server

Repository: ac-server-license. Component: LICENSE_API.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	Kestrel listen port; required at boot (throws if unset)	8024	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	.NET host environment; also selects NLog.production.config vs NLog.config	production	—
ENABLE_ERROR_HANDLING	AC_ERROR_HANDLING_ENABLED	Toggle for the shared EnableErrorHandler global error-handler middleware	false	—
SupportedCultures	AC_SUPPORTED_CULTURES	Comma-separated localization cultures for the shared UseSupportedCulture middleware	en,tr	—
CUSTOMCONNSTR_LICENSE_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string for the licenseStore database	${secret:license-server/db_connection_string}	${secret:license-server/db_connection_string}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Host:port of the Redis distributed cache (no scheme)	redis.appcircle.svc.cluster.local:6379	${context:license_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own Redis key prefix (defaults to LicenseServer)	LicenseServer	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the event controller and Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Base URL of the Keycloak server (realm appcircle)	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	license-server	"license-server" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:license-server/keycloak_client_secret}	${secret:license-server/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Public OpenID issuer URL of Keycloak (ExternalOpenIdUri)	https://auth.appcircle.io	${context:auth_external_url}
RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Internal base URL of the Resource server (client + HTTP health check)	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_STORE_PROFILE_SERVICE_URL	AC_STORE_PROFILE_INTERNAL_URL	Internal base URL for the enterprise store-profile service	http://store-profile:8105	${context:store_profile_internal_url}
WebUrl	AC_WEB_EXTERNAL_URL	Public web dashboard URL used to build the redirect link in required-action emails	https://my.appcircle.io	${context:tester_external_url}
ASPNETCORE_PAYMENT_PRODUCTS	AC_STRIPE_PRODUCTS	Comma-separated Stripe product ids passed into StripeOptions	prod_ABC,prod_DEF	—
ASPNETCORE_PAYMENT_PUBLISHABLE_KEY	AC_STRIPE_PUBLISHABLE_KEY	Stripe publishable (public) API key	pk_test_...	—
ASPNETCORE_PAYMENT_SECRET_KEY	AC_STRIPE_SECRET_KEY 🔒	Stripe secret API key (assigned to StripeConfiguration.ApiKey)	${secret:license-server/stripe_secret_key}	${secret:license-server/stripe_secret_key} (externally issued by Stripe, not generatable)
ASPNETCORE_PAYMENT_WEBHOOK_KEY	AC_STRIPE_WEBHOOK_SECRET 🔒	Stripe webhook signing secret used to validate incoming payment webhooks	${secret:license-server/stripe_webhook_secret}	${secret:license-server/stripe_webhook_secret} (externally issued by Stripe, not generatable)
ASPNETCORE_DISABLE_PAYMENT_SIGNATURE	AC_STRIPE_SIGNATURE_ENABLED	Whether Stripe webhook signature verification is enforced (inverted from the negative DISABLE flag)	true	—
ASPNETCORE_GITHUB_MARKETPLACE_HOOK_SECRET	AC_GITHUB_MARKETPLACE_HOOK_SECRET 🔒	Shared secret used to verify GitHub Marketplace webhook signatures	${secret:license-server/github_marketplace_hook_secret}	${secret:license-server/github_marketplace_hook_secret} (externally issued by GitHub, not generatable)
ASPNETCORE_DELETE_USER_HOURS	AC_DELETE_USER_HOURS	Age threshold in hours after which pending users are deleted (default 24)	24	—
ASPNETCORE_SEND_EXPIRING_INFO_EMAILS	AC_EXPIRING_INFO_EMAILS_ENABLED	Toggle enabling license-expiration informing emails	true	—
ASPNETCORE_BLOCK_MULTI_EMAILS_PER_ORGANIZATION	AC_BLOCK_MULTI_EMAILS_PER_ORGANIZATION_ENABLED	When true, blocks sending multiple informing emails per organization	false	—
ASPNETCORE_SEND_DOWNGRADE_EMAILS	AC_DOWNGRADE_EMAILS_ENABLED	Toggle enabling downgrade notification emails in StripeService	false	—
ASPNETCORE_DELETE_TRASH_USERS_PASSIVE_IN_DAYS	AC_DELETE_TRASH_USERS_PASSIVE_IN_DAYS	Passive-days threshold when purging trash users (default 90)	90	—
ASPNETCORE_DELETE_OLD_ARTIFACTS	AC_DELETE_OLD_ARTIFACTS_ENABLED	Toggle enabling the old-artifact cleaner	false	—
ASPNETCORE_DELETE_OLD_ARTIFACTS_MODE	AC_DELETE_OLD_ARTIFACTS_MODE	Retention mode for the artifact cleaner	0	—
ASPNETCORE_DELETE_OLD_STARTER_ARTIFACTS_HOURS	AC_DELETE_OLD_STARTER_ARTIFACTS_HOURS	Retention age in hours for starter-plan artifacts before deletion	720	—
ASPNETCORE_DELETE_OLD_ARTIFACTS_ITEM_PER_EVENT	AC_DELETE_OLD_ARTIFACTS_ITEM_PER_EVENT	Batch size of artifacts per fired delete event	25	—
ASPNETCORE_DELETE_OLD_ARTIFACTS_WAIT_SECONDS_AFTER_FIRE_EVENT	AC_DELETE_OLD_ARTIFACTS_WAIT_SECONDS_AFTER_FIRE_EVENT	Seconds the cleaner waits after firing each delete event	60	—
ASPNETCORE_DELETE_OLD_ARTIFACTS_DATA_RETRIVE_PAGE_SIZE	AC_DELETE_OLD_ARTIFACTS_PAGE_SIZE	Mongo page size when retrieving artifacts to delete (source key has a RETRIVE typo)	100	—
ASPNETCORE_DELETE_OLD_ARTIFACTS_SERVICE_LOCK_HOURS	AC_DELETE_OLD_ARTIFACTS_SERVICE_LOCK_HOURS	Distributed lock duration in hours for the artifact cleaner run	70	—
ASPNETCORE_DELETE_ARTIFACT_ORGANIZATION_LIMIT	AC_DELETE_ARTIFACT_ORGANIZATION_LIMIT	Optional organization allowlist limiting artifact deletion and expiration emails	org-id-1,org-id-2	—
ASPNETCORE_CLEAN_ORPHANED_RESOURCES_ENABLED	AC_CLEAN_ORPHANED_RESOURCES_ENABLED	Toggle enabling the orphaned-resource cleaner	true	—
ASPNETCORE_CLEAN_ORPHANED_RESOURCES_MODE	AC_CLEAN_ORPHANED_RESOURCES_MODE	Run mode for the orphaned-resource cleaner (Log vs delete)	Log	—
ASPNETCORE_CLEAN_ORPHANED_RESOURCES_ORG_LIMIT	AC_CLEAN_ORPHANED_RESOURCES_ORG_LIMIT	Optional organization allowlist restricting orphaned-resource cleanup	org-id-1	—
ASPNETCORE_CLEAN_ORPHANED_RESOURCES_WAIT_SECONDS	AC_CLEAN_ORPHANED_RESOURCES_WAIT_SECONDS	Seconds to wait between orphaned-resource cleanup events (default 5)	5	—
ASPNETCORE_CLEAN_ORPHANED_RESOURCES_PAGE_SIZE	AC_CLEAN_ORPHANED_RESOURCES_PAGE_SIZE	Page size for scanning resources during orphan cleanup (default 100)	100	—
ASPNETCORE_CLEAN_ORPHANED_RESOURCES_LOCK_HOURS	AC_CLEAN_ORPHANED_RESOURCES_LOCK_HOURS	Distributed lock duration in hours for the orphaned-resource cleaner	69	—
ASPNETCORE_CLEAN_ORPHANED_RESOURCES_ENTERPRISE_BUFFER_DAYS	AC_CLEAN_ORPHANED_RESOURCES_ENTERPRISE_BUFFER_DAYS	Grace-period days before enterprise-plan orphaned resources are cleaned	0	—
ASPNETCORE_CLEAN_ORPHANED_RESOURCES_STARTER_BUFFER_DAYS	AC_CLEAN_ORPHANED_RESOURCES_STARTER_BUFFER_DAYS	Grace-period days before starter-plan orphaned resources are cleaned	0	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog level	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Basic health endpoint path used by the NLog request filter	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Deep health endpoint path used by the NLog request filter	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health requests are logged (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ConnectionStrings:DistributionServerDbConnection / ElasticSearchConnection	— (never read)
ConnectionStrings:Redis_Connection	AC_REDIS_ADDRESS (Redis comes from ASPNETCORE_REDIS_ENDPOINT)
ASPNETCORE_DELETE_TRASH_USERS	— (deprecated; read is commented out)
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION / ASPNETCORE_BUCKET_PREFIX	AC_S3_* (MinIO client block commented out)

Notification Server

Repository: ac-server-notification.

Operational config comes entirely from environment variables (appsettings.json holds only AllowedHosts/SupportedCultures). The host calls AddEnvironmentVariables("ASPNETCORE_") (prefix stripped); the Mongo DSN arrives via the CUSTOMCONNSTR_ prefix.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	Kestrel listen port; also surfaced to the UI-server settings	8019	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Hosting environment name; selects the NLog config file	Production	—
CUSTOMCONNSTR_NOTIFICATION_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string	${secret:notification-server/db_connection_string}	${secret:notification-server/db_connection_string}
ASPNETCORE_IS_SELF_HOSTED	AC_IS_SELF_HOSTED	Deployment-wide flag toggling scoped vs singleton mail/email/Vault wiring	true	—
ASPNETCORE_MAIL_PROVIDER	AC_MAIL_PROVIDER	Selects the mail sender implementation	SMTP | SendGrid | MailKitSMTP	—
ASPNETCORE_SMS_PROVIDER	AC_SMS_PROVIDER	Selects the SMS sender implementation	WebhookSmsSender	—
ASPNETCORE_WEBHOOK_SMS_URL	AC_WEBHOOK_SMS_URL	Base URL of the external webhook the SMS sender POSTs to	https://example.pipedream.net	not yet resolved — arbitrary third-party webhook endpoint, no confirmed context mapping
ASPNETCORE_SMTP_HOST	AC_SMTP_HOST	SMTP server hostname of the mail dependency	smtp.sendgrid.net	—
ASPNETCORE_SMTP_PORT	AC_SMTP_PORT	SMTP server port (defaults to 587 if unparseable)	587	—
ASPNETCORE_SMTP_USERNAME	AC_SMTP_USERNAME	Username to authenticate to the SMTP server	apikey	—
ASPNETCORE_SMTP_PASSWORD	AC_SMTP_PASSWORD 🔒	Password/API key to authenticate to the SMTP server	${secret:notification-server/smtp_password}	${secret:notification-server/smtp_password} (externally issued, not generatable)
ASPNETCORE_SMTP_FROM	AC_SMTP_FROM	Default from-address for outgoing mail	noreply@appcircle.io	—
ASPNETCORE_SMTP_FROM_NAME	AC_SMTP_FROM_NAME	Sender display name used when building the from header	Appcircle Inc.	—
ASPNETCORE_SMTP_FROM_DISPLAY_NAME	AC_SMTP_FROM_DISPLAY_NAME	Alternate sender display name (takes precedence over SMTP_FROM_NAME)	Appcircle Inc.	—
ASPNETCORE_SMTP_DOMAIN	AC_SMTP_DOMAIN	SMTP HELO/EHLO domain	appcircle.io	—
ASPNETCORE_SMTP_USE_SSL	AC_SMTP_SSL_ENABLED	Whether the SMTP connection uses SSL	true	—
ASPNETCORE_SMTP_START_TLS	AC_SMTP_START_TLS_ENABLED	Whether STARTTLS is used on the SMTP connection	false	—
ASPNETCORE_SMTP_AUTH	AC_SMTP_AUTH_ENABLED	Whether SMTP authentication is performed	true	—
ASPNETCORE_SMTP_VALIDATE_SERVER_CERT	AC_SMTP_SERVER_CERT_VALIDATION_ENABLED	Whether the SMTP server certificate is validated	false	—
ASPNETCORE_SENDGRID_APIKEY	AC_SENDGRID_API_KEY 🔒	API key for the SendGrid mail provider	${secret:notification-server/sendgrid_api_key}	${secret:notification-server/sendgrid_api_key} (externally issued, not generatable)
ASPNETCORE_SENDGRID_HEALTH_CHECK_KEYWORD	AC_SENDGRID_HEALTH_CHECK_KEYWORD	Keyword expected on SendGrid's status page for the health check	All Systems Operational	—
ASPNETCORE_SUPPORT_EMAIL	AC_SUPPORT_EMAIL	Fallback support recipient address for certain notifications	support@appcircle.io	—
ASPNETCORE_UNSUB_RIJNDAEL_KEY	AC_UNSUBSCRIBE_ENCRYPTION_KEY 🔒	Base64 AES-GCM key used to encrypt the unsubscribe-link payload in emails	${secret:notification-server/unsubscribe_encryption_key}	${secret:notification-server/unsubscribe_encryption_key} (generatable)
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the message broker and Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Base URL of the Keycloak server this service authenticates against	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_REALM	AC_KEYCLOAK_REALM	Keycloak realm name (defaults to appcircle)	appcircle	"appcircle" (literal, fixed realm name)
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	notification-server	"notification-server" (literal)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:notification-server/keycloak_client_secret}	${secret:notification-server/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable OIDC/Keycloak issuer URL	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_VAULT_API	AC_VAULT_URL	Base URL (with path) of the Vault instance used for SMTP-config storage/health	http://vault:8200/v1/local/	eliminated (legacy direct Vault)
ASPNETCORE_VAULT_TOKEN	AC_VAULT_TOKEN 🔒	Vault access token sent as X-Vault-Token	${secret:notification-server/vault-token}	eliminated (shared static token)
RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Base URL of the Resource server dependency (client + HTTP health check)	http://resource:8012	${context:resource_internal_url}
PrivateApiUrl	AC_API_INTERNAL_URL	Base URL of the internal (private) API gateway, injected into notification templates	https://api.appcircle.io	${context:api_external_url}
WebUrl	AC_WEB_URL	Base URL of the Appcircle web app, used to build links in notifications	https://my.appcircle.io	${context:tester_external_url}
TesterWebUrl	AC_TESTER_WEB_URL	Base URL of the Appcircle tester web app, used in notification links	https://my.appcircle.io	${context:tester_external_url}
SmfUrl	AC_SMF_URL	Base URL of the short-URL (SMF) service used to shorten notification links	https://smf.to	not yet resolved — external third-party dependency, no confirmed context mapping
ASPNETCORE_OAUTH_CALLBACK_URL	AC_OAUTH_CALLBACK_URL	This service's own OAuth callback URL for app-integration authorization	https://api.appcircle.io/notification/v1/app/authorized	"${context:api_external_url}/notification/v1/app/authorized" (composed)
ASPNETCORE_CALLBACK_SERVER_URL	AC_CALLBACK_SERVER_URL	Base URL of the UI/hook (web-event) callback server	http://hook:8080	${context:webhook_internal_url}
ASPNETCORE_CALLBACK_SERVER_PATH	AC_CALLBACK_SERVER_PATH	URL path appended when calling the web-event callback server	/notifications	"/notifications" (literal, fixed path)
ASPNETCORE_ENABLED_MULTI_UI_SERVER	AC_MULTI_UI_SERVER_ENABLED	Whether events are broadcast to multiple UI-server instances	true	—
ASPNETCORE_APPSETTINGS__<n>__*	AC_APPSETTINGS__<n>__* 🔒	Indexed array of third-party integration OAuth apps (Slack/Froged/Jira) bound via Configuration.Bind; each entry has NAME, CLIENTID, CLIENTSECRET, SCOPE, AUTHORIZEURL, TOKENURL, APIURL, DISPLAY. CLIENTSECRET leaves are secrets	AC_APPSETTINGS__0__NAME=Slack	not yet resolved — same structured-config gap as Build Server's GITSETTINGS__*
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum log level for this service	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path for the basic health endpoint	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path for the deep health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic-health requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep-health requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_RIJNDAEL_KEY	AC_ENCRYPTION_KEY 🔒	AES-GCM key backing the shared encryption helper used to encrypt OAuth state in the app-authorization flow	${secret:notification-server/encryption_key}	${secret:notification-server/encryption_key} (generatable)

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_RIJNDAEL_IV / ASPNETCORE_UNSUB_RIJNDAEL_IV	— (AES-GCM uses a random nonce; no static IV)
ASPNETCORE_FROGED_API_URL	AC_APPSETTINGS__<n>__APIURL (Froged config comes from the APPSETTINGS array)
ASPNETCORE_FROGED_API_KEY	AC_APPSETTINGS__<n>__CLIENTSECRET (Froged config comes from the APPSETTINGS array)
ASPNETCORE_SMS_2FA_VERIFY_TEXT	— (not read by the configured SMS sender)

Signing Identity Server

Repository: ac-server-signingidentity. Component: SIGNING_IDENTITY_API.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	Kestrel listen port this service binds; required (startup throws if unset)	8022	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; selects NLog.production.config vs NLog.config and the service-info banner	Production	—
CUSTOMCONNSTR_SIGNINGIDENTITY_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string for the signingIdentityStore database	${secret:signing-identity-server/db_connection_string}	${secret:signing-identity-server/db_connection_string}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Host:port of the Redis instance used for the distributed cache (no scheme)	redis.appcircle.svc.cluster.local:6379	${context:signing_identity_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own Redis key/instance-name prefix (defaults to SigningIdentityServer)	SigningIdentityServer	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the incoming/outgoing message broker	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_KEYTOOL	AC_KEYTOOL_PATH	Filesystem path to the Java keytool executable the keystore controllers shell out to for Android keystore operations	/usr/lib/jvm/java-21-openjdk-amd64/bin/keytool	—
ASPNETCORE_VAULT_TOKEN	AC_VAULT_TOKEN 🔒	Token used to authenticate to HashiCorp Vault (Vault health check and SafeStore secret storage)	${secret:signing-identity-server/vault-token}	eliminated (shared static token)
ASPNETCORE_VAULT_API	AC_VAULT_URL	Full base URL of the Vault API this service reads/writes signing secrets against	http://vault:8200/v1/local/	eliminated (legacy direct Vault)
ASPNETCORE_VAULT_SERVICE_PREFIX	AC_VAULT_SERVICE_PREFIX	Per-service path segment under which this service's P12/keystore passwords are namespaced in Vault	signing	becomes a sourcing-policy declaration (mount local, prefix signing)
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Internal base URL of the Keycloak server used for token validation (appcircle realm)	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	signing-identity-server	"signing-identity-server" (literal)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:signing-identity-server/keycloak_client_secret}	${secret:signing-identity-server/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	External (public) OIDC issuer URL set as ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Internal base URL of the Resource service, wired via AddResourceClient	http://resource:8012	${context:resource_internal_url}
WebUrl	AC_WEB_EXTERNAL_URL	External URL of the Appcircle web frontend, used when building device-registration email links	https://my.appcircle.io	${context:tester_external_url}
TesterWebUrl	AC_TESTER_WEB_EXTERNAL_URL	External URL of the tester web portal, used for device-registration links	https://my.appcircle.io	${context:tester_external_url}
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog log level for this service	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path of the basic (liveness) health endpoint	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path of the deep (dependency) health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-endpoint request logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-endpoint request logs are emitted (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_UNSUB_RIJNDAEL_KEY / ASPNETCORE_UNSUB_RIJNDAEL_IV	— (leftover unsubscribe-token AES key/IV; not read anywhere)

Task Server

Repository: ac-server-task.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Runtime environment; selects NLog.production.config vs NLog.config and drives env.IsDevelopment()	Production	—
ASPNETCORE_PORT	AC_PORT	The service's own Kestrel listen port; throws if unset	8028	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers used as the consumer/producer BootstrapServers and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Redis host:port for the StackExchange distributed cache (no scheme)	redis.appcircle.svc.cluster.local:6379	${context:task_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own Redis cache key prefix (InstanceName, defaults to TaskServer)	TaskServer	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum log level for the NLog logger rule (defaults to Info)	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Basic health endpoint path, consumed by NLog to optionally suppress health-check logs	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Deep health endpoint path, consumed by NLog to optionally suppress deep-health logs	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic-health request logs are written (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep-health request logs are written (inverted from the negative IGNORE form)	false	—

Agent Cache Service

Repository: ac-service-agent-cache.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	Kestrel listen port this service binds to; startup throws if unset	8068	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; selects the NLog config file and the service-info banner	Production	—
CUSTOMCONNSTR_AGENTCACHE_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	MongoDB connection string for this service's own agentCacheStore database	${secret:agent-cache-service/db_connection_string}	${secret:agent-cache-service/db_connection_string}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Redis host:port used as the StackExchange distributed cache backend	redis.appcircle.svc.cluster.local:6379	${context:agentcache_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own key namespace (defaults to AgentCacheService)	AgentCacheService	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the message broker and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_BUCKET_NAME	AC_S3_BUCKET_NAME	Object-storage bucket name holding the agent cache blobs; used when presigning upload/download URLs and in the signed-URL health check	appcircle-agent-cache	— (own value; presigning is delegated to Resource Server, see Removed table below)
ASPNETCORE_CACHE_DURATION_DAYS	AC_CACHE_DURATION_DAYS	Retention window in days; the expired-cache cleaner deletes entries older than this	30	—
ASPNETCORE_LICENSE_CACHE_LIMIT	AC_LICENSE_CACHE_LIMIT	Per-license-tier cache size caps (GB), parsed into a tier=limit map to enforce quotas	starter=5,professional=20,enterprise=30	—
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Base URL of the Keycloak server this service authenticates against (realm appcircle)	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	agent-cache-service	"agent-cache-service" (literal)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:agent-cache-service/keycloak_client_secret}	${secret:agent-cache-service/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable OpenID/Keycloak issuer URL (ExternalOpenIdUri)	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Internal base URL of the Resource service; passed to AddResourceClient for presign/metadata calls	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_RESOURCE_URL	AC_RESOURCE_API_EXTERNAL_URL	External base URL of the Resource service, read in SignUrlHelper when generating signed download/upload URLs	https://resource.appcircle.io	not yet resolved — no confirmed external subdomain, same gap as Resource Server's own row
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog log level for this service	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path for the basic liveness health endpoint	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path for the deep (dependency-checking) health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-path request logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-path request logs are emitted (inverted from the negative IGNORE form)	false	—
SupportedCultures	AC_SUPPORTED_CULTURES	Comma-separated locales this service localizes responses into	en,tr	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_BUILD_SERVER_URL	— (loaded into settings but the only consumer is commented out)
ASPNETCORE_GCLOUD_SERVICE_ACC_PATH	— (GCS signing delegated to the Resource client; consumer commented out)
ASPNETCORE_CACHE_UPLOAD_URL_SIGNER_TYPE	— (signer chosen by the Resource client; selection switch commented out)
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION	AC_S3_* (commented out; not read)

Webhook Service

Repository: ac-service-webhook.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; picks the NLog config file and drives the framework host	production	—
ASPNETCORE_PORT	AC_PORT	This service's own Kestrel listen port; throws at startup if unset	8076	—
CUSTOMCONNSTR_WEBHOOK_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string for the webhookStore database (and Mongo deep-health)	${secret:webhook-service/db_connection_string}	${secret:webhook-service/db_connection_string}
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the message-broker handlers and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Internal base URL of the Resource service, passed to AddResourceClient	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Internal base URL of the Keycloak server used to build the Keycloak client	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable Keycloak/OIDC issuer URL set as ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_KEYCLOAK_REALM	AC_KEYCLOAK_REALM	Keycloak realm name for the Keycloak client (defaults to appcircle)	appcircle	"appcircle" (literal, fixed realm name)
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	webhook-service	"webhook-service" (literal)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:webhook-service/keycloak_client_secret}	${secret:webhook-service/keycloak_client_secret} (generatable)
WebUrl	AC_WEB_EXTERNAL_URL	Public Appcircle web-app base URL used to build user-facing links inside webhook notification payloads	https://my.appcircle.io	${context:tester_external_url}
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum log level, consumed by the shared logging middleware	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path of this service's basic health endpoint	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path of this service's deep (dependency) health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-endpoint request logs are emitted (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-endpoint request logs are emitted (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_REDIS_ENDPOINT	— (no Redis client referenced; dead)
AuthUrl / PrivateApiUrl	— (only read by the commented-out UserService)

Resign Service

Repository: ac-service-resign.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; picks the NLog config and drives the ASP.NET host	Production	—
ASPNETCORE_PORT	AC_PORT	The port Kestrel listens on; throws if unset	8031	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers used by the message-broker services and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
CUSTOMCONNSTR_RESIGN_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string for the resignStore database	${secret:resign-service/db_connection_string}	${secret:resign-service/db_connection_string}
ASPNETCORE_BUILD_SERVER_URL	AC_BUILD_API_INTERNAL_URL	Base URL of the Build service, used for the ResignReportClient and a build-server health check	http://build:8023	${context:build_internal_url}
ASPNETCORE_STORE_SUBMIT_SERVER_URL	AC_STORE_SUBMIT_API_INTERNAL_URL	Base URL of the Store Submit service, used for the StoreSubmitClient	http://storesubmit:8027	${context:store_submit_internal_url}
RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Base URL of the Resource service, passed to AddResourceClient	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Keycloak server base URL for the Keycloak client (appcircle realm)	http://keycloak:8080	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	resign-service	"resign-service" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:resign-service/keycloak_client_secret}	${secret:resign-service/keycloak_client_secret} (generatable)
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog logging level	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path for the basic health endpoint	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path for the deep health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-check requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-check requests are logged (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_OIDC_EXTERNAL_URL	— (not referenced; auth goes through the Keycloak client vars)
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION / ASPNETCORE_BUCKET_PREFIX	AC_S3_* (only in commented-out code)
ASPNETCORE_FASTLANE_VERSION	— (read commented out; fastlane version hardcoded to latest)

Publish Service

Repository: ac-service-publish.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	The TCP port Kestrel binds to; startup throws if unset	8032	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Hosting environment; selects the NLog config file	Production	—
CUSTOMCONNSTR_PUBLISH_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	The service's own MongoDB connection string for the publishStore database	${secret:publish-service/db_connection_string}	${secret:publish-service/db_connection_string}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Host:port of the Redis instance backing the StackExchange distributed cache	redis.appcircle.svc.cluster.local:6379	${context:publish_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own Redis key/instance-name prefix (defaults to PublishServer)	PublishServer	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap server list used by the event controller and Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
SupportedCultures	AC_SUPPORTED_CULTURES	Comma-separated locales enabled for JSON localization	en,tr	—
PrivateApiUrl	AC_API_INTERNAL_URL	Internal API gateway base URL embedded in ApplicationSetting for building API links	https://api.appcircle.io	${context:api_external_url}
ASPNETCORE_DEFAULT_APP_ICON	AC_DEFAULT_APP_ICON_URL	Fallback app-icon URL used when a published app has no icon	https://cdn.appcircle.io/common/images/defaultApp.png	—
RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Base URL of the internal Resource service (file storage), registered via AddResourceClient	http://resource:8012	${context:resource_internal_url}
STORE_SUBMIT_SERVER_URL	AC_STORE_SUBMIT_API_INTERNAL_URL	Base URL of the internal Store Submit service HttpClient	http://storesubmit:8027	${context:store_submit_internal_url}
BUILD_SERVER_URL	AC_BUILD_API_INTERNAL_URL	Base URL of the internal Build service HttpClient	http://build:8023	${context:build_internal_url}
ASPNETCORE_DISTRIBUTE_SERVER_URL	AC_DISTRIBUTION_INTERNAL_URL	Base URL of the internal Distribution service HttpClient	http://distribution:8016	${context:distribution_internal_url}
ASPNETCORE_SIGNING_IDENTITY_SERVER_URL	AC_SIGNING_IDENTITY_API_INTERNAL_URL	Base URL of the internal Signing-Identity service HttpClient	http://signingidentity:8022	${context:signing_identity_internal_url}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Keycloak base URL used to construct the Keycloak client (realm appcircle)	http://keycloak:8080	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id	publish-server	"publish-server" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:publish-service/keycloak_client_secret}	${secret:publish-service/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable Keycloak/OIDC URL set as ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_VAULT_API	AC_VAULT_URL	HashiCorp Vault API base URL for VaultClient and the Vault health check	http://vault:8200/v1/local/	eliminated (legacy direct Vault)
ASPNETCORE_VAULT_TOKEN	AC_VAULT_TOKEN 🔒	Vault access token sent as the X-Vault-Token header	${secret:publish-service/vault-token}	eliminated (shared static token)
ASPNETCORE_APPSTORECONNECT_API_URL	AC_APPSTORE_API_URL	Apple App Store Connect API base URL	https://api.appstoreconnect.apple.com	—
ASPNETCORE_PLAYSTORE_API_URL	AC_GOOGLEPLAY_API_URL	Google Play (Android Publisher) API base URL	https://androidpublisher.googleapis.com/	—
ASPNETCORE_INTUNE_API_URL	AC_INTUNE_API_URL	Microsoft Intune Graph API base URL used by IntuneService	https://graph.microsoft.com	—
ASPNETCORE_INTUNE_LOGIN_URL	AC_INTUNE_LOGIN_URL	Microsoft Intune/Azure AD login (token) base URL used by IntuneService	https://login.microsoftonline.com	—
ASPNETCORE_STORE_STATUS_UPDATE_INTERVAL_MINUTES	AC_STORE_STATUS_UPDATE_INTERVAL_MINUTES	Polling interval (minutes) for the App Store / Play Store status-update background services	60	—
ASPNETCORE_SUPPORTED_XCODE_LIST	AC_SUPPORTED_XCODE_LIST	Comma-separated list of supported Xcode versions returned by the component controller	16.2.x,16.1.x	—
ASPNETCORE_FFMEG_PATH	AC_FFMPEG_PATH	Filesystem path to the ffmpeg binary (defaults to ffmpeg)	/usr/bin/ffmpeg	—
ASPNETCORE_UPLOAD_MAX_FILE_SIZE	AC_UPLOAD_MAX_FILE_SIZE	Maximum allowed upload size (bytes) applied to the Resource client configuration	524288000	—
ASPNETCORE_DELETE_OLD_ARTIFACTS_ALLOW_DEBUG_VALUES	AC_DELETE_OLD_ARTIFACTS_DEBUG_VALUES_ENABLED	Whether the license/artifact-cleanup event handler is allowed to use debug values	false	—
ASPNETCORE_UNSUB_RIJNDAEL_KEY	AC_UNSUB_RIJNDAEL_KEY 🔒	Rijndael/AES key used to encrypt unsubscribe tokens in publish email links	${secret:publish-service/unsub_rijndael_key}	${secret:publish-service/unsub_rijndael_key} (generatable)
FORCE_STREAM_DOWNLOAD	AC_FORCE_STREAM_DOWNLOAD_ENABLED	When true, forces artifact streaming instead of a direct download URL	false	—

Removed (unused or deprecated)

Current variable	Replaced by
WebUrl / ASPNETCORE_PUBLISH_EXTERNAL_SCHEME / ASPNETCORE_PUBLISH_EXTERNAL_URL	— (never read)
ASPNETCORE_VAULT_SERVICE_PREFIX	— (never read; VaultClient uses only token + API URL)
ASPNETCORE_UNSUB_RIJNDAEL_IV	— (only in commented-out code; active crypto uses the key alone)
ASPNETCORE_FASTLANE_VERSION	— (read commented out; hardcoded latest)
ASPNETCORE_BUCKET_PREFIX / MINIO_ENDPOINT / MINIO_ACCESS_KEY / MINIO_SECRET_KEY / MINIO_REGION	AC_S3_* (commented-out MinIO block)
ASPNETCORE_OAUTH_CALLBACK_URL	— (only in a commented-out block)

Schedule Service

Repository: ac-service-schedule.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; selects the NLog config file and toggles Swagger	production	—
ASPNETCORE_PORT	AC_PORT	The port this service's Kestrel server listens on; throws if unset	8036	—
SCHEDULE_SERVICE_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	Full MongoDB connection string for this service's own scheduleServiceStore (jobs store)	${secret:schedule-service/db_connection_string}	${secret:schedule-service/db_connection_string}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Redis host:port (no scheme) used for the IConnectionMultiplexer and distributed cache	redis.appcircle.svc.cluster.local:6379	${context:schedule_manager_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own Redis cache key prefix (defaults to ScheduleService)	ScheduleService	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers used to publish outgoing events	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Base URL of the Keycloak server this service authenticates against (realm appcircle)	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own OIDC client id	schedule-service	"schedule-service" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own OIDC client secret	${secret:schedule-service/keycloak_client_secret}	${secret:schedule-service/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Public external OpenID issuer URL of Keycloak, passed as ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog level for this service's logs	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path for this service's basic health endpoint	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path for this service's deep (Mongo-checking) health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-endpoint requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-endpoint requests are logged (inverted from the negative IGNORE form)	false	—

Store Submit Server

Repository: ac-server-storesubmit. Component: STORE_SUBMIT_API.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	Kestrel listen port for this service; throws if unset	8027	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Runtime environment; selects the NLog config file	Production	—
CUSTOMCONNSTR_STORESUBMIT_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	MongoDB connection string for this service's own store	${secret:store-submit-server/db_connection_string}	${secret:store-submit-server/db_connection_string}
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the consumer/producer and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Redis host:port used as the StackExchange distributed-cache configuration	redis.appcircle.svc.cluster.local:6379	${context:store_submit_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own Redis cache key/instance prefix (defaults to StoreSubmitServer)	StoreSubmitServer	—
RESOURCE_SERVER_URL	AC_RESOURCE_API_INTERNAL_URL	Base URL of the Resource service; used by AddResourceClient and an HTTP health check	http://resource:8012	${context:resource_internal_url}
ASPNETCORE_VAULT_API	AC_VAULT_URL	Base URL of the Vault API used to store/read store credentials; also probed by the Vault health check	http://vault:8200/v1/local/	eliminated (legacy direct Vault)
ASPNETCORE_VAULT_TOKEN	AC_VAULT_TOKEN 🔒	Auth token for the Vault API	${secret:store-submit-server/vault-token}	eliminated (shared static token)
ASPNETCORE_VAULT_SERVICE_PREFIX	AC_VAULT_SERVICE_PREFIX	Per-service path prefix under which this service's secrets are scoped in Vault	store-submit	becomes a sourcing-policy declaration (mount store, prefix store-submit)
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Base URL of the Keycloak server the shared Keycloak client authenticates against	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id (realm appcircle)	store-submit-server	"store-submit-server" (literal)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:store-submit-server/keycloak_client_secret}	${secret:store-submit-server/keycloak_client_secret} (generatable)
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable OIDC/Keycloak issuer URL set as ExternalOpenIdUri	https://auth.appcircle.io	${context:auth_external_url}
PrivateApiUrl	AC_API_INTERNAL_URL	Internal API-gateway base URL used as the icon base URL when building app-icon download links	https://api.appcircle.io	${context:api_external_url}
ASPNETCORE_DEFAULT_APP_ICON	AC_DEFAULT_APP_ICON_URL	Fallback app-icon URL used when a profile has no icon	https://cdn.appcircle.io/common/images/defaultApp.png	—
ASPNETCORE_APPSTORECONNECT_API_URL	AC_APPSTORECONNECT_API_URL	Base URL of Apple's App Store Connect API used by the Apple connector	https://api.appstoreconnect.apple.com	—
ASPNETCORE_VALIDATE_APPLE_CREDENTIALS	AC_APPLE_CREDENTIALS_VALIDATION_ENABLED	When not false, validates Apple App Store credentials before saving	true	—
ASPNETCORE_VALIDATE_HUAWEI_CREDENTIALS	AC_HUAWEI_CREDENTIALS_VALIDATION_ENABLED	When not false, validates Huawei AppGallery credentials before saving	true	—
ASPNETCORE_VALIDATE_PLAYSTORE_CREDENTIALS	AC_GOOGLEPLAY_CREDENTIALS_VALIDATION_ENABLED	When not false, validates Google Play credentials before saving	true	—
ASPNETCORE_VALIDATE_INTUNE_CREDENTIALS	AC_INTUNE_CREDENTIALS_VALIDATION_ENABLED	When not false, validates Microsoft Intune credentials before saving	true	—
ASPNETCORE_VALIDATE_STORE_CREDENTIALS	AC_STORE_CREDENTIALS_VALIDATION_ENABLED	Generic switch; when not false, store-credential validation is performed before saving	true	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog log level	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Basic health-check URL path	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Deep health-check URL path	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic-health request logs are written (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep-health request logs are written (inverted from the negative IGNORE form)	false	—
SupportedCultures	AC_SUPPORTED_CULTURES	Comma-separated locales this service localizes responses for	en,tr	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_BUILD_SERVER_URL	— (never read; would be AC_BUILD_API_INTERNAL_URL)
FASTLANE_BUNDLE_INSTALL_PATH	— (local-dev leftover, not read)
ASPNETCORE_MINIO_ENDPOINT / _ACCESS_KEY / _SECRET_KEY / _REGION / ASPNETCORE_BUCKET_PREFIX	— (MinIO client commented out; object access goes through the Resource service)
ConnectionStrings:StoreSubmitServerDbConnection	AC_DB_CONNECTION_STRING (code reads STORESUBMIT_DB_CONNECTION_STRING)
ConnectionStrings:Redis_Connection	AC_REDIS_ADDRESS (code reads ASPNETCORE_REDIS_ENDPOINT)
ConnectionStrings:ElasticSearchConnection	— (no ElasticSearch usage)

Reporting Server

Repository: ac-server-reporting.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_PORT	AC_PORT	Kestrel listen port; required at boot (throws if unset)	8025	—
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	.NET host environment; selects the NLog config and dev exception page	Production	—
CUSTOMCONNSTR_REPORTING_DB_CONNECTION_STRING	AC_DB_CONNECTION_STRING 🔒	This service's own MongoDB connection string for the reportingStore database	${secret:reporting-server/db_connection_string}	${secret:reporting-server/db_connection_string}
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers used by the consumer/producer factories and the Kafka health check	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_KEYCLOAK_SERVER_URL	AC_KEYCLOAK_INTERNAL_URL	Internal Keycloak base URL used to validate tokens / build the Keycloak client	http://keycloak:9302	${context:keycloak_internal_url}
ASPNETCORE_OIDC_EXTERNAL_URL	AC_KEYCLOAK_EXTERNAL_URL	Externally reachable Keycloak/OIDC issuer URL (ExternalOpenIdUri)	https://auth.appcircle.io	${context:auth_external_url}
AuthUrl	AC_KEYCLOAK_EXTERNAL_URL	External Keycloak base URL used by UserService for admin realm calls; overlaps ASPNETCORE_OIDC_EXTERNAL_URL (consolidate)	https://auth.appcircle.io	${context:auth_external_url} (dropped once consolidated into ASPNETCORE_OIDC_EXTERNAL_URL above)
ASPNETCORE_KEYCLOAK_CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	This service's own Keycloak client id (also the token audience)	reporting-server	"reporting-server" (literal, not context)
ASPNETCORE_KEYCLOAK_SECRET_ID	AC_KEYCLOAK_CLIENT_SECRET 🔒	This service's own Keycloak client secret	${secret:reporting-server/keycloak_client_secret}	${secret:reporting-server/keycloak_client_secret} (generatable)
CLIENT_ID	AC_KEYCLOAK_CLIENT_ID	Legacy duplicate client id read by UserService for its papi-token flow (consolidate with ASPNETCORE_KEYCLOAK_CLIENT_ID)	reporting-server	"reporting-server" (dropped once consolidated into ASPNETCORE_KEYCLOAK_CLIENT_ID above)
CLIENT_SECRET	AC_KEYCLOAK_CLIENT_SECRET 🔒	Legacy duplicate client secret read by UserService (has a hard-coded fallback in code; consolidate)	${secret:reporting-server/keycloak_client_secret}	${secret:reporting-server/keycloak_client_secret} (consolidated above)
DISTRIBUTION_SERVER_URL	AC_DISTRIBUTION_INTERNAL_URL	Base URL of the Distribution service, used as the DistributionServiceClient address and in MigrationV4	http://distribution:8016	${context:distribution_internal_url}
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum log level for this service	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path of this service's basic health endpoint	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path of this service's deep health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-check requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-check requests are logged (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_REDIS_ENDPOINT	— (never read; service uses in-memory AddMemoryCache)
ASPNETCORE_DEFAULT_APP_ICON	— (never read)
PrivateApiUrl	— (read into UserService but the field is never used; dead)

OTP Service

Repository: ac-service-otp.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Deployment environment; picks NLog.production.config vs NLog.config and toggles Swagger	Production	—
ASPNETCORE_PORT	AC_PORT	This service's own HTTP listen port; throws if unset	8033	—
ASPNETCORE_KAFKA_SERVER_URLS	AC_KAFKA_BOOTSTRAP_SERVERS	Kafka bootstrap servers for the Kafka health check and the message-broker layer publishing notification events	kafka:9092	${context:kafka_bootstrap_servers}
ASPNETCORE_REDIS_ENDPOINT	AC_REDIS_ADDRESS	Host:port of the Redis instance backing the distributed OTP cache	redis.appcircle.svc.cluster.local:6379	${context:otp_redis_address}
ASPNETCORE_REDIS_PREFIX	AC_REDIS_PREFIX	This service's own Redis key prefix / cache instance name (defaults to OtpService)	OtpService	—
ASPNETCORE_MAX_RESEND_COUNT	AC_MAX_RESEND_COUNT	Maximum number of OTP resends allowed per organization+recipient before a new code is required (default 3)	3	—
ASPNETCORE_OTP_CODE_VALIDITY_IN_MINUTES	AC_CODE_VALIDITY_IN_MINUTES	Lifetime in minutes of a generated OTP code and its cache entry (default 60)	300	—
ASPNETCORE_LOG_MIN_LEVEL	AC_LOG_MIN_LEVEL	Minimum NLog log level for this service	Info	—
ASPNETCORE_HEALTH_PATH	AC_HEALTH_PATH	Path of this service's basic health endpoint	/health	—
ASPNETCORE_DEEP_HEALTH_PATH	AC_DEEP_HEALTH_PATH	Path of this service's deep health endpoint	/health/deep	—
ASPNETCORE_IGNORE_HEALTH_LOGS	AC_HEALTH_LOGS_ENABLED	Whether basic health-probe requests are logged (inverted from the negative IGNORE form)	false	—
ASPNETCORE_IGNORE_DEEP_HEALTH_LOGS	AC_DEEP_HEALTH_LOGS_ENABLED	Whether deep health-probe requests are logged (inverted from the negative IGNORE form)	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_MAX_VALIDATE_ATTEMPT	— (never read; the validate-attempt limit is hardcoded to 3)
ASPNETCORE_MAX_RETRY_ATTEMPT	— (not referenced anywhere)

CodePush Proxy

Repository: ac-service-codepush-proxy.

Current variable	Target name	Description	Example	Context/Secret Expression
ASPNETCORE_ENVIRONMENT	AC_ENVIRONMENT	Selects the deployment environment; picks the NLog config and gates the dev exception page / Swagger via env.IsDevelopment()	production	—
ASPNETCORE_PORT	AC_PORT	The TCP port Kestrel binds to; throws at startup if unset	8787	—
CODEPUSH_PROXY_LISTEN_URI	AC_EXTERNAL_URL	This proxy's own listen URI; the middleware matches the incoming request host/port against it before proxying	https://codepush.appcircle.io	not yet resolved — no confirmed external subdomain
ASPNETCORE_API_CONFIGURATION	AC_CODEPUSH_UPSTREAM_URL	Full URL of the upstream CodePush API root used by ApiClient; when set it overrides the PrivateApiUrl + path composition	http://codepush-api/codepush	not yet resolved — distinct upstream backend, not this proxy's own address
PrivateApiUrl	AC_CODEPUSH_UPSTREAM_BASE_URL	Base URL of the upstream Appcircle CodePush (private) API; the HttpClient base address and deep health-check target	http://codepush-api	not yet resolved — same upstream-dependency gap as the row above
ASPNETCORE_CODEPUSH_API_SERVER_PATH	AC_CODEPUSH_UPSTREAM_PATH	Path segment appended to PrivateApiUrl to build the upstream API root and health-check URL	/codepush	"/codepush" (literal, fixed path)
CODEPUSH_PROXY_FORWARD_URI	AC_CODEPUSH_UPSTREAM_FORWARD_URL	Full URL the middleware forwards allowed CodePush requests to; service refuses to start if it is not a valid absolute URI	http://codepush-api	not yet resolved — same upstream-dependency gap
CODEPUSH_PROXY_MODULE_PREFIX	AC_CODEPUSH_UPSTREAM_MODULE_PREFIX	Path prefix prepended to the forwarded request path when building the upstream URL	codepush	"codepush" (literal, fixed prefix)
ASPNETCORE_BINARY_FILECACHE_ENABLED	AC_BINARY_FILE_CACHE_ENABLED	Enables on-disk caching of downloaded JS bundles (gates the local serve/save path and the cleaner service)	true	—
ASPNETCORE_BINARY_FILECACHE_PERIOD_IN_MINUTES	AC_BINARY_FILE_CACHE_CLEANUP_PERIOD_MINUTES	Interval in minutes between runs of the cached-binary cleaner (default 60)	60	—
ASPNETCORE_BINARY_FILECACHE_MAX_SIZE_MB	AC_BINARY_FILE_CACHE_MAX_SIZE_MB	Maximum total size of the bundle cache in MB; the cleaner frees ~30% once exceeded (default 1000)	1000	—
ASPNETCORE_BINARY_FILECACHE_MAX_SIZE_DURATION_HOURS	AC_BINARY_FILE_CACHE_MAX_AGE_HOURS	Maximum age in hours a cached bundle is kept before deletion (default 120)	120	—
CACHE_TIMEOUT_MINUTES	AC_CACHE_TIMEOUT_MINUTES	Read into ApiConfiguration.CacheTimeoutMinutes (default 3) but currently not consumed downstream; effectively a no-op	3	—
FILECACHE_ENABLED	AC_FILE_CACHE_ENABLED	Read into ApiConfiguration.FileCacheEnabled (default true) but not consumed; superseded by ASPNETCORE_BINARY_FILECACHE_ENABLED	true	—
ASPNETCORE_ENABLE_TOKEN_LOGING	AC_TOKEN_LOGGING_ENABLED	Read into ApiConfiguration.LogTokens (default false) but not consumed downstream; effectively a no-op	false	—

Removed (unused or deprecated)

Current variable	Replaced by
ASPNETCORE_DEFAULT_SCHEME	— (set in launchSettings but never read)
ASPNETCORE_IS_SELF_HOSTED	— (not read here; deployment-wide AC_IS_SELF_HOSTED covers it elsewhere)

MCP Service

Repository: ac-service-mcp.

Current variable	Target name	Description	Example	Context/Secret Expression
APPCIRCLE_ACCESS_TOKEN	AC_API_GATEWAY_ACCESS_TOKEN 🔒	Appcircle API access token the server uses to authenticate its outbound calls to the Appcircle API; read only on the stdio transport path (HTTP clients each pass their own bearer token)	${secret:mcp-service/api_gateway_access_token}	${secret:mcp-service/api_gateway_access_token} (an operator-issued API access token, not generatable)
APPCIRCLE_API_URL	AC_API_GATEWAY_BASE_URL	Full base URL of the Appcircle API the tools call, overridable for self-hosted (defaults to the public API)	https://api.appcircle.io	${context:api_external_url}
APPCIRCLE_MCP_ALLOWED_HOST	AC_EXTERNAL_HOST	This server's own public hostname (no scheme or port); on the streamable-http transport it enables DNS-rebinding protection so only this Host header is accepted	mcp.appcircle.io	not yet resolved — own bare hostname, not one of the 5 derivable subdomains
APPCIRCLE_MCP_PORT	AC_PORT	This server's own HTTP bind port for the streamable-http transport (used when --port is not passed; defaults to 8000)	8080	—
APPCIRCLE_EXCLUDED_TOOLSETS	AC_EXCLUDED_TOOLSETS	Comma-separated list of this server's own toolsets to skip registering (merged with the --exclude-toolsets CLI flags)	build_module,report	—
LOG_LEVEL	AC_LOG_MIN_LEVEL	Minimum log level for this server's logger (defaults to INFO)	INFO	—