Environment variables

Reference for all environment variables used by the OWASP Nest backend.

Copy backend/.env.example to backend/.env and populate the values before starting the backend. Variables prefixed with DJANGO_ are read by django-configurations and automatically stripped of the prefix before being passed to Django settings.

All variables default to None in .env.example. The backend will fail to start for any required variable left as None.

Algolia

DJANGO_ALGOLIA_APPLICATION_ID · string · required

The application ID for the Algolia project. Used to initialize the Algolia client for search and indexing.

Example: APPID123

DJANGO_ALGOLIA_WRITE_API_KEY · string · required

The write API key for Algolia. Required for the backend to create, update, and delete records in Algolia indices.

Example: abc123writekey

DJANGO_ALGOLIA_EXCLUDED_LOCAL_INDEX_NAMES · string

A comma-separated list of index names to exclude when running locally. Prevents specific indices from being created or modified in development environments.

Example: local_chapters,local_projects

AWS

DJANGO_AWS_ACCESS_KEY_ID · string

AWS access key ID. Used to authenticate with AWS services such as S3 for static file and media storage via django-storages.

Example: AKIAIOSFODNN7EXAMPLE

DJANGO_AWS_SECRET_ACCESS_KEY · string

AWS secret access key. Used alongside DJANGO_AWS_ACCESS_KEY_ID to authenticate AWS API requests.

Example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Django core

DJANGO_CONFIGURATION · string · required

The Django settings class to load. Controls which environment-specific settings are active.

Accepted values: Local, Production, Staging, Test, E2e, Fuzz

Example: Local

DJANGO_SECRET_KEY · string · required

Django’s cryptographic signing key. Used for sessions, CSRF tokens, and password reset links. Must be kept secret and unique per environment.

Example: django-insecure-changeme

DJANGO_ALLOWED_HOSTS · string · required

Comma-separated list of hostnames the server is permitted to serve. Prevents HTTP Host header injection attacks.

Example: localhost,127.0.0.1

DJANGO_RELEASE_VERSION · string

The current release version of the backend. Used for identification in logs and Sentry releases.

Example: 1.0.5

DJANGO_PUBLIC_IP_ADDRESS · string

The public IP address to use for geographic location lookups in local development.

Example: 127.0.0.1

Database

DJANGO_DB_HOST · string · required

Hostname of the PostgreSQL server. When using Docker Compose locally, this is the container service name.

Example: db

DJANGO_DB_PORT · integer · required

Port number for the PostgreSQL connection.

Example: 5432

DJANGO_DB_NAME · string · required

Name of the PostgreSQL database.

Example: nest

DJANGO_DB_USER · string · required

Username for the PostgreSQL connection.

Example: postgres

DJANGO_DB_PASSWORD · string · required

Password for the PostgreSQL database user.

GitHub

GITHUB_TOKEN · string · required

Personal access token or app installation token for the GitHub API. Used by management commands that sync organization data, repositories, issues, and users.

Example: ghp_xxxxxxxxxxxxxxxxxxxx

OpenAI / ElevenLabs

DJANGO_OPEN_AI_SECRET_KEY · string

Secret key for the OpenAI API. Required for AI-powered features including embedding generation and the LangGraph agent.

Example: sk-xxxxxxxxxxxxxxxxxxxx

DJANGO_ELEVENLABS_API_KEY · string

API key for the ElevenLabs text-to-speech service. Used for audio generation in community snapshot videos.

Example: el_xxxxxxxxxxxxxxxxxxxx

Redis

DJANGO_REDIS_HOST · string · required

Hostname of the Redis server. Used for both the django-redis response cache and the Django RQ task queue.

Example: cache

DJANGO_REDIS_PASSWORD · string

Password for Redis authentication. Required when DJANGO_REDIS_AUTH_ENABLED is True.

Example: strongredispassword

DJANGO_REDIS_AUTH_ENABLED · boolean

Whether Redis requires password authentication. Set to False for local development without a Redis password.

Default: True

Slack

DJANGO_SLACK_BOT_TOKEN · string

OAuth bot token for the NestBot Slack app. Authenticates the bot so it can send messages and respond to events in Slack channels.

Example: xoxb-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx

DJANGO_SLACK_SIGNING_SECRET · string

Signing secret for the Slack app. Used to verify that incoming webhook payloads originate from Slack.

Example: abc123signingsecret

Sentry

DJANGO_SENTRY_DSN · string

Data Source Name (DSN) for the Sentry error-tracking service. When set, all unhandled exceptions and performance traces are sent to Sentry.

Example: https://[e-mail]/654321