Environment Variables and Secrets

Arcturus-Prime runs on Cloudflare Pages with environment variables configured in the Cloudflare dashboard. In development, variables come from .dev.vars (Wrangler’s local env file). This doc catalogs every env var the system uses.

How getEnv() Works

Arcturus-Prime uses a custom getEnv() utility from src/lib/runtime-env.ts that abstracts Cloudflare’s runtime environment:

• Production: Reads from Cloudflare Workers runtime bindings (env.VAR_NAME)
• Development: Reads from process.env (populated by .dev.vars)
• Accepts an optional default value: getEnv('VAR_NAME', 'fallback')

Similarly, getKV() returns the Cloudflare KV namespace binding for caching and data storage.

Cloudflare Access Variables

Variable	Required	Purpose
CF_ACCESS_TEAM_NAME	Yes	Cloudflare Access team domain (e.g., Arcturus-Prime)
CF_ACCESS_AUD	Yes	Application Audience (AUD) tag for JWT verification

These are used by the middleware to verify Cloudflare Access JWTs. Without them, admin auth cannot function.

Cloudflare API Variables

Variable	Required	Purpose
CF_API_TOKEN	For CF dashboard	Cloudflare API token for the /api/admin/cloudflare-status endpoint
CF_ACCOUNT_ID	For CF dashboard	Cloudflare account ID for analytics and deployment queries

Infrastructure Proxy URLs

These control where proxy routes forward requests. In production, tunnel hostnames are used. In dev, direct LAN IPs.

Variable	Production Default	Dev Default	Used By
GATEWAY_API_URL	https://gateway.Arcturus-Prime.com	http://10.42.0.194:8100	/api/gateway, /api/command
COMMAND_CENTER_URL	https://status.Arcturus-Prime.com	http://10.42.0.199:8093	/api/services, /api/proxy
SWARM_API_URL	https://swarm.Arcturus-Prime.com	http://10.42.0.100:8100	/api/swarm
SWARM_ADMIN_URL	https://swarm-admin.Arcturus-Prime.com	http://10.42.0.100:8093	/api/swarm-admin
MM_ARGOBOX_URL	https://mm-admin.Arcturus-Prime.com	http://192.168.20.50:8888	/api/mm-Arcturus-Prime
TITAN_ADMINBOX_URL	https://Tarn-Host-admin.Arcturus-Prime.com	Tailscale only	/api/Tarn-Host-adminbox
JOBS_API_URL	https://jobs-api.Arcturus-Prime.com	http://10.42.0.100:8585	/api/jobs
LAB_ENGINE_URL	https://labs.Arcturus-Prime.com	Direct	/api/labs/*, /api/playground/*
PLAYGROUND_SWITCH_URL	https://playground-switch.Arcturus-Prime.com	Direct	/api/playground/*
OPENCLAW_API_URL	https://oc.Arcturus-Prime.com	Direct	/api/admin/openclaw*
OLLAMA_API_URL	http://localhost:11434	Same	/api/status/ai-services

Backend Auth Tokens

These are injected server-side by proxy routes. The browser never sees them.

Variable	Purpose	Injected As
MM_ARGOBOX_TOKEN	Meridian-Host admin API auth	Authorization: Bearer {token}
TITAN_ADMINBOX_TOKEN	Proxmox Tarn-Host admin API auth	Authorization: Bearer {token}
SWARM_ADMIN_KEY	Build swarm admin operations	X-Admin-Key: {key}
SWARM_CONTROL_KEY	Build swarm mutation control	X-Control-Key: {key}
AUTOAPPLY_API_KEY	Job auto-apply engine auth	X-API-Key: {key}
OPENCLAW_API_TOKEN	OpenClaw AI gateway auth	Authorization: Bearer {token}
OPENCLAW_SERVICE_TOKEN_ID	CF Access bypass for OpenClaw proxy	CF-Access-Client-Id: {id}
OPENCLAW_SERVICE_TOKEN_SECRET	CF Access bypass for OpenClaw proxy	CF-Access-Client-Secret: {secret}
PLAYGROUND_ADMIN_SECRET	Playground admin operations	X-Admin-Secret: {secret}

AI Service Keys

Variable	Purpose
OPENROUTER_API_KEY	OpenRouter for multi-model AI chat
RESEND_API_KEY	Resend email service for contact form

Git Integration

Variable	Purpose
GITEA_TOKEN	Gitea API access for content CRUD, flag fetching, PR creation
GITHUB_TOKEN	GitHub API for mirror sync (/api/admin/github-sync)

Cache and KV

Variable	Purpose
CACHE_WARMUP_SECRET	Bearer token for /api/cache/warmup cron trigger
KV namespace binding	Used via getKV() for caching, user roles, dashboard profiles

Pentest Configuration

Variable	Purpose
PENTEST_IO_URL	Pentest daemon URL on Izar-Host node
PENTEST_TITAN_URL	Pentest daemon URL on Tarn-Host node

Dev vs. Prod Differences

Aspect	Development	Production
Env source	.dev.vars file	CF dashboard
Backend URLs	Direct LAN IPs	Tunnel hostnames
Auth	Auto-bypassed or uses local CF Access	Full CF Access chain
KV	Wrangler local KV	Cloudflare KV
Caching	Disabled or in-memory	KV-backed with TTLs

Adding a New Variable

1. Add to Cloudflare Pages dashboard under Settings → Environment Variables
2. Add to .dev.vars for local development
3. Access via getEnv('VAR_NAME') in SSR routes
4. Document in this file