> ## Documentation Index > Fetch the complete documentation index at: https://docs.tayho.io/llms.txt > Use this file to discover all available pages before exploring further. # Configuration ownership > Service configuration registry, ownership, requiredness, and sensitivity without resolved secret values. # Configuration ownership Checked-in environment examples are schemas, not deployable values. Railway sealed variables own runtime values; deployment identity JSON owns chain/address configuration; service profiles own commands, health checks, and replica policy. ## Sensitivity classes | Class | Meaning | Documentation rule | | -------- | ------------------------------------------------------------------- | --------------------------------------------------------------------- | | Public | Safe endpoint, chain ID, cadence, or feature setting | Name and purpose may be documented | | Internal | Topology, private origin, database role name, build/release setting | Document name/purpose, never resolved private hostname if unnecessary | | Secret | API token, database/Redis credential, pepper, bearer token | Document variable name and owner only | | Signing | Private key, journal keyring, intent keyring, receipt secret | Document mount boundary only; never format, length, sample, or value | ## Shared identity and telemetry | Variables | Owner | Required | Class | Purpose | | ---------------------------------------------------- | ------------------ | --------------------------------------------: | --------------- | ------------------------------------------------------------- | | `DEPLOYMENT_ENVIRONMENT`, `DEPLOYMENT_IDENTITY_JSON` | Release/deployment | Production | Internal | Bind environment, chain, start block, and contract identities | | `CHAIN_ID`, contract-address variables | Local development | When identity JSON absent | Public | Development fallback only | | `BUILD_VERSION` | CI release | Yes | Public | Immutable image/trace correlation | | `METRICS_BEARER_TOKEN` | Observability | Production | Secret | Per-service Prometheus access | | `OTEL_EXPORTER_*` | Observability | Optional/local, required by production policy | Secret/Internal | Private traces/logs endpoint and headers | The deployment identity artifact supersedes individually supplied chain/address values in qualified environments. Every service must receive the exact same artifact for a release. ## API Source schema: `apps/api/.env.example` and `apps/api/src/config.ts`. | Variables | Required | Class | Purpose | | ---------------------------------------------------- | ------------: | --------------- | --------------------------------------------------------- | | `API_ALLOWED_ORIGINS`, `API_TRUSTED_PROXY_HOPS` | Yes | Internal | Exact CORS and client-IP boundary | | `ENGINE_URL`, `INDEXER_URL`, `ENGINE_INTERNAL_TOKEN` | Yes | Secret/Internal | Private upstream composition and engine authentication | | `API_RPC_URLS`, `API_SIMULATION_ACCOUNT` | Yes | Internal/Public | Signerless live quote/risk/simulation reads | | `REDIS_URL`, `REALTIME_STREAM_KEY` | Yes | Secret/Internal | Shared admission, ticketing, replay, and pump | | `API_DATABASE_URL`, `API_DATABASE_POOL_SIZE` | Yes | Secret/Public | Restricted API-control storage | | `API_KEY_PEPPER`, `API_KEY_POSITIVE_CACHE_SECONDS` | Yes | Secret/Public | Credential hashing and bounded positive cache | | `API_REALTIME_*`, `API_WS_*` | Yes/defaulted | Public | Ticket, replay, subscription, capacity, heartbeat policy | | `API_REQUESTS_PER_MINUTE`, `API_WS_*_PER_MINUTE` | Yes/defaulted | Public | IP safety ceilings; project quotas live in DB | | `API_UPSTREAM_TIMEOUT_MS`, `API_READ_RETRY_COUNT` | Yes/defaulted | Public | Bounded upstream behavior | | `API_ACTION_INTAKE_ENABLED` | Yes/defaulted | Internal | Emergency pause of new intake without losing status/drain | ## Indexer Source schema: `apps/indexer/.env.example` and `apps/indexer/src/config.ts`. | Variables | Required | Class | Purpose | | | ------------------------------------------------------------------------------------------------------------------------ | -----------------------------: | --------------- | ----------------------------------------------- | ------------------------------------- | | `DATABASE_URL` / `PONDER_PGLITE_DIRECTORY` | Production / local alternative | Secret/Internal | Isolated Ponder persistence | | | `PONDER_RPC_URLS`, optional `PONDER_WS_URL` | Yes / optional | Secret/Internal | Redundant ingestion; WebSocket is acceleration | | | `PONDER_START_BLOCK` | Yes | Public | Earliest deployment block; correctness-critical | | | `PONDER_ETH_GET_LOGS_BLOCK_RANGE`, `PONDER_RPC_REQUESTS_PER_MINUTE`, `PONDER_RPC_MAX_IN_FLIGHT`, `PONDER_RPC_TIMEOUT_MS` | Profile-specific | Public | Provider-qualified ingestion policy | | | `PONDER_DATABASE_POOL_MAX`, `PONDER_POLLING_INTERVAL_MS` | Defaulted | Public | Resource/cadence bounds | | | `RAILWAY_DEPLOYMENT_ID` | Railway | Railway start | Internal | Deployment-isolated schema identifier | Only indexer/Ponder may use the log-range configuration. ## Keeper roles Each role's authoritative schema is the matching file in `apps/keeper/env`. | Variable family | Roles | Class | Purpose | | ------------------------------------------------------- | ------------------------------------- | ---------------------- | ----------------------------------------------------------------------------------- | | `DATABASE_URL`, `REDIS_URL`, `QUEUE_PREFIX` | All coordinated roles | Secret/Internal | Durable state and rebuildable delivery | | `RPC_URL`, `RPC_READ_URLS`, `RPC_ALLOW_SINGLE_ENDPOINT` | Signing roles/auditor | Secret/Internal/Public | Preferred write endpoint and safety reads; exception only for development chain 998 | | `SIGNER_KEYS` | Signing roles only | Signing | Exactly the matching two-key role pool | | `TX_JOURNAL_KEYS`, `TX_JOURNAL_ACTIVE_KEY_ID` | Signing roles | Signing/Internal | Encrypt persisted signed bytes and manage rotation | | `INTENT_KEYRING`, active key ID, receipt secret | Engine/relayer as explicitly required | Signing | Encrypt accepted terms and capability-scoped status | | `ENGINE_INTERNAL_TOKEN` | Engine/API | Secret | Private API-to-engine authentication | | Role contract addresses / deployment identity | Matching roles | Public/Internal | Readiness linkage and allowlist target | | `HEALTH_HOST`, `HEALTH_PORT`, role-specific port | Each process | Public | Private liveness/readiness server | | Cadence/batch variables | Matching automation role | Public | Bounded discovery and maintenance frequency | | Source origins and bearer tokens | Oracle/attester | Secret/Internal | Independently authenticated facts | | `AUDITOR_INDEXER_URL` | Auditor | Internal | Private ordered projection; no log scanning | Startup rejects `SIGNER_KEYS` for engine and auditor. Never reuse a keyring, signer pool, source token, or metrics token across roles or environments. ## Market data and frontend Market-data configuration is owned by `apps/market-data/.env.example`: source mode/origin and cache, circuit, notional, depth-band, freshness, four distinct route tokens, metrics token, and telemetry. Route and metrics tokens are secret; numeric normalization policy is public. Production uses independently governed sources rather than treating replicas as source diversity. Frontend runtime configuration is generated from the public testnet API origin `https://api.testnet.tayho.io` and WalletConnect metadata. It receives no private service origin, database/Redis value, internal engine token, receipt secret, or worker signer. ## Change procedure 1. Change the parser/type and its tests. 2. Update the owning `.env.example` without a resolved value. 3. Update the Railway JSON profile or release wiring when shape changes. 4. Update this registry and the affected architecture/runbook. 5. Roll development, prove readiness and failure behavior, then qualify production. Do not add aliases for renamed variables. The repository intentionally has no backward-compatibility configuration paths; migrate all callers atomically.