Configuration

The three required values, and the handful of optional ones.

Three variables are required. Everything else has a working default.

generate each once
openssl rand -base64 24     # POSTGRES_PASSWORD
openssl rand -base64 32     # JWT_SECRET
openssl rand -base64 24     # ENCRYPTION_KEY

JWT_SECRET signs session tokens. ENCRYPTION_KEY encrypts every credential Talos stores. Both have published fallbacks in a public repository, so the backend refuses to start if either is missing or left at its default — the check runs before anything opens a network connection, which means a refused boot has written nothing.

ENCRYPTION_KEY cannot be changed once you have data. Back it up alongside your database, not only in .env on the server.

Optional

FRONTEND_URL is where users reach Talos in a browser; it is used for links inside invitation and password-reset emails, so set it if you are not on localhost. FRONTEND_PORT and BACKEND_PORT move the host ports off 3000 and 3001. TALOS_VERSION pins an image version instead of tracking latest, which is recommended in production.