Deploy
Dory Environment Variables
Dory deployment behavior is controlled by environment variables. Treat production values as secrets and do not commit them to source control or bake them into public images.
Required Variables
| Variable | Purpose | Example |
|---|---|---|
DS_SECRET_KEY | Runtime secret used by application security features. | openssl rand -base64 32 |
BETTER_AUTH_SECRET | Better Auth secret. | openssl rand -hex 32 |
BETTER_AUTH_URL | Public base URL users open. | https://dory.example.com |
BETTER_AUTH_URL must match the browser-facing URL, or login, callback, invitation, and email links can break.
Application Database
Dory stores its own workspace data in an application database. This is separate from the external databases you connect and query through Dory.
| Variable | Purpose |
|---|---|
DB_TYPE | Application database provider. Use pglite for local file storage or postgres for production Postgres. Defaults to pglite. |
PGLITE_DB_PATH | PGlite file path. In Docker, keep this under a mounted directory such as /app/data/dory. |
DATABASE_URL | Postgres connection string when DB_TYPE=postgres. |
POSTGRES_URL | Alternative Postgres connection string if DATABASE_URL is not set. |
POSTGRES_CONNECTION_STRING | Alternative Postgres connection string if the other Postgres URL variables are not set. |
POSTGRES_SSL | Set to true when the Postgres server requires SSL. |
POSTGRES_SSL_REJECT_UNAUTHORIZED | Set to false only when you intentionally need to skip certificate verification. |
POSTGRES_MAX_CONNECTIONS | Optional Postgres pool size limit. |
PGlite example:
DB_TYPE=pglite
PGLITE_DB_PATH=/app/data/doryPostgres example:
DB_TYPE=postgres
DATABASE_URL=postgres://dory:strong_password@postgres.example.com:5432/dory
POSTGRES_SSL=true
POSTGRES_SSL_REJECT_UNAUTHORIZED=true
POSTGRES_MAX_CONNECTIONS=10For Docker deployments using PGlite, mount /app/data to a persistent Docker volume or host directory.
AI Variables
| Variable | Purpose |
|---|---|
DORY_AI_PROVIDER | Provider key such as openai, anthropic, google, qwen, xai, meta, or openai-compatible. |
DORY_AI_MODEL | Model name. |
DORY_AI_API_KEY | Provider API key. |
DORY_AI_URL | Provider or compatible endpoint base URL. |
Auth and Login
| Variable | Purpose |
|---|---|
NEXT_PUBLIC_REQUIRE_EMAIL_VERIFICATION | Require email verification after sign-up unless set to false. |
TRUSTED_ORIGINS | Comma-separated trusted origins for auth and MCP origin checks. |
DORY_INIT_USER_EMAIL | Email for the bootstrapped initial user. |
DORY_INIT_USER_PASSWORD | Password for the bootstrapped initial user. |
GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET | GitHub OAuth login. |
GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET | Google OAuth login. |
| Variable | Purpose |
|---|---|
RESEND_API_KEY | Resend API key for verification, reset, and invitation emails. |
EMAIL_FROM | Verified sender address. |
Production Advice
- Generate strong random values for
DS_SECRET_KEYandBETTER_AUTH_SECRET. - Do not rotate auth and encryption secrets casually after deployment.
- Use HTTPS in
BETTER_AUTH_URL. - Use persistent storage for PGlite or managed backups for Postgres.
- Store
.envthrough your secret management process. - Rotate AI keys, OAuth secrets, email keys, and database credentials deliberately.