Configuration

All environment variables and Docker images for self-hosted BuildBase.

Environment Variables

Installation (Required)

These are provided by the BuildBase dashboard when you create an Installation.

Variable	Description
`INSTALLATION_API_KEY`	Installation API key (from dashboard)
`INSTALLATION_ID`	Installation ID (from dashboard)

Server (Required)

Variable	Description
`NODE_ENV`	Set to `production`
`PORT`	Server port (default: `3000`)
`MONGO_CONNECTION_URL`	MongoDB connection string
`REDIS_HOST`	Redis hostname (default: `localhost`)
`REDIS_PORT`	Redis port (default: `6379`)
`SERVER_URL`	Public URL of the tenant server (default: `http://localhost:4101`)
`APPLICATION_URL`	Public URL of the client app (default: `http://localhost:4100`)
`AUTH_SERVER_URL`	Public URL of the auth portal (default: `http://localhost:4103`)
`JWT_PASS`	JWT signing secret
`DB_ENCRYPTION_KEY`	Database field encryption key
`SECRET_KEY`	General application secret
`OAUTH2_SECRET`	OAuth2 token secret
`INSTALLATION_API_KEY`	Installation API key (from BuildBase dashboard)
`INSTALLATION_ID`	Installation ID (from BuildBase dashboard)

Client App

Variable	Description
`NEXT_PUBLIC_SERVER_URL`	Tenant server URL
`NEXT_PUBLIC_DEFAULT_TENANT_SERVER_URL`	Default tenant server URL
`NEXT_PUBLIC_INSTALLATION_ID`	Installation ID (for org filtering)

CORS

Variable	Description
`CORS_WHITELISTED_DOMAINS`	Comma-separated list of allowed origins

The platform origins (console.buildbase.app) are always allowed by default.

Redis

Variable	Description	Default
`REDIS_PASSWORD`	Password (if required)	—
`REDIS_DB`	Database number	`0`

Optional Services

Variable	Description
`GOOGLE_AUTH_CLIENT_ID`	Google OAuth client ID (for Google vendor + Gmail sender)
`GOOGLE_AUTH_CLIENT_SECRET`	Google OAuth client secret
`GOOGLE_STORAGE_ASSETS_BUCKET_NAME`	GCS bucket for file uploads
`MAILGUN_API_KEY`	Mailgun API key (for transactional emails)

Generating Secrets

All secret values should be unique, random strings. Generate them with:

openssl rand -hex 32

Or generate all required secrets at once:

for i in JWT_PASS DB_ENCRYPTION_KEY SECRET_KEY OAUTH2_SECRET; do echo "$i=$(openssl rand -hex 32)"; done

Docker Images

Image	Description	Port	Health Check
`buildbaseapp/tenant-server`	Backend API server	3000	`GET /api/ready`
`buildbaseapp/client`	Web dashboard (Next.js SSR)	3000	`GET /`
`buildbaseapp/auth`	Auth portal (Next.js)	3000	`GET /health`

All images are multi-arch (linux/amd64, linux/arm64), built on Node.js 22 Alpine. docker pull selects the correct variant for the host automatically. 32-bit ARM (linux/arm/v7) is not supported — see Supported architectures.

Architecture

Loading diagram...

Your data never leaves your infrastructure. The central server only handles authentication tokens, installation licensing, and organization metadata.