Environment Variables

This page provides a comprehensive reference for all environment variables used to configure Terrateam Self-Hosted.

Required Variables

These environment variables are required for Terrateam Self-Hosted to function properly:

Database Configuration

Variable	Description	Example
`DB_HOST`	Database host address	`localhost`, `db.example.com`
`DB_NAME`	Database name	`terrateam`
`DB_USER`	Database username	`terrateam`
`DB_PASS`	Database password	`secure_password_123`
`DB_PORT`	Database port	`5432`

GitHub Application Settings

Required when using GitHub as your VCS provider:

Variable	Description	Example
`GITHUB_APP_ID`	GitHub application ID	`123456`
`GITHUB_APP_CLIENT_ID`	GitHub application client ID	`Iv1.8ea942184ee41c0b`
`GITHUB_APP_CLIENT_SECRET`	GitHub application client secret	`8dab6d1de78a2cdbc9o014dubcf4a55ca44a3c81`
`GITHUB_APP_PEM`	GitHub application private key (PEM format)	`-----BEGIN RSA PRIVATE KEY-----\nMIIE...`
`GITHUB_WEBHOOK_SECRET`	GitHub webhook secret for security	`02d87878a0ac61d75d25cz8fec1d1af509f9a6d9`

GitLab Application Settings

Required when using GitLab as your VCS provider:

Variable	Description	Example
`GITLAB_APP_ID`	GitLab application ID	`abc123def456`
`GITLAB_APP_SECRET`	GitLab application secret	`gloas-1234567890abcdef`
`GITLAB_ACCESS_TOKEN`	GitLab personal access token	`glpat-xxxxxxxxxxxxxxxxxxxx`

Server Configuration

Variable	Description	Example
`TERRAT_API_BASE`	Public-facing API base URL (includes `/api`)	`https://terrateam.example.com/api`
`TERRAT_WEB_BASE_URL`	Public-facing web base URL	`https://terrateam.example.com`
`TERRAT_UI_BASE`	Public-facing UI base URL (required for UI)	`https://terrateam.example.com`

Optional Variables

These environment variables provide additional configuration options:

GitHub Enterprise Server

For GitHub Enterprise Server deployments:

Variable	Description	Default	Example
`GITHUB_API_BASE_URL`	GitHub API base URL	`https://api.github.com`	`https://api.github.example.com`
`GITHUB_WEB_BASE_URL`	GitHub web base URL	`https://github.com`	`https://github.example.com`

GitLab Self-Hosted

For self-hosted GitLab instances:

Variable	Description	Default	Example
`GITLAB_API_BASE_URL`	GitLab API base URL	`https://gitlab.com/api`	`https://gitlab.example.com/api`
`GITLAB_WEB_BASE_URL`	GitLab web base URL	`https://gitlab.com`	`https://gitlab.example.com`

Proxy Configuration

For environments requiring HTTP proxies:

Variable	Description	Example
`HTTP_PROXY`	URL for HTTP proxy	`https://proxy.local:8080`
`HTTPS_PROXY`	URL for HTTPS proxy	`https://proxy.local:8080`
`NO_PROXY`	Comma-separated list of hosts to bypass proxy	`localhost,127.0.0.1,internal.com`

Proxy Authentication

For proxies requiring authentication, include credentials in the URL:

HTTP_PROXY=https://username:password@proxy.local:8080
HTTPS_PROXY=https://username:password@proxy.local:8080

Custom CA Certificates

For environments that use a private Certificate Authority (such as a corporate TLS-inspecting proxy, a self-hosted GitHub Enterprise Server with an internal CA, or a private artifact registry), Terrateam can install additional trusted CA certificates into the container’s trust store at startup.

Variable	Description	Example
`CUSTOM_CA_CERT`	One or more PEM-encoded CA certificates to install into the container’s system trust store	`-----BEGIN CERTIFICATE-----\nMIID...\n-----END CERTIFICATE-----`

When CUSTOM_CA_CERT is set, Terrateam parses every -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- block from the value, writes each one to /usr/local/share/ca-certificates/, and runs update-ca-certificates so the certificates are trusted system-wide inside the container. Any existing custom certificates installed by a previous startup are removed first, so the variable always reflects the full set of custom CAs you want trusted.

If CUSTOM_CA_CERT is not set, no custom certificates are installed and Terrateam starts up normally using only the certificates baked into the image.

Providing a single certificate

CUSTOM_CA_CERT="-----BEGIN CERTIFICATE-----
MIIDdz...long base64 body...
-----END CERTIFICATE-----"

Providing multiple certificates

Concatenate the PEM blocks. Terrateam splits them apart automatically:

CUSTOM_CA_CERT="-----BEGIN CERTIFICATE-----
MIID...root CA...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIE...intermediate CA...
-----END CERTIFICATE-----"

Loading from a file

When using Docker Compose, load the certificate from a file on the host:

services:
  terrat:
    image: ghcr.io/terrateamio/terrat:latest
    environment:
      CUSTOM_CA_CERT: ${CUSTOM_CA_CERT}

export CUSTOM_CA_CERT="$(cat /path/to/your-ca-bundle.pem)"
docker compose up -d

Only PEM-format certificates are supported. DER-encoded certificates must be converted first:

openssl x509 -inform DER -in your-ca.der -out your-ca.pem

For troubleshooting configuration issues, see the Troubleshooting Guide.