# Environment variables

Deliberately short. `APP_SECRET` seals stored keys; `DATA_DIR` locates the SQLite file; `COOKIE_SECURE=1` forces the
Secure flag for a direct https deploy with no proxy setting `X-Forwarded-Proto`.

Nothing about models lives here. Base URL, key, model name, extra JSON parameters, Jev key and Jev model are
per-user settings encrypted at rest, because the deployment is expected to be self-hosted and shared.

The full file list, with the reasoning for each default, is in the repository README.

Related: [[Credential vault]], [[Session cookie rules]], [[Running locally]].