Skip to content

What --sync-env pushes

Always pushed

  • DASHBOARD_PASSWORD
  • DASHBOARD_SESSION_SECRET
  • DASHBOARD_USERNAME
  • DATABASE_URL
  • GITHUB_APP_ID
  • GITHUB_APP_INSTALLATION_ID
  • GITHUB_APP_PRIVATE_KEY
  • GITHUB_TARGET_REPO
  • GITHUB_WEBHOOK_SECRET
  • RENDER_API_KEY

Plus GITHUB_APP_INSTALLATION_ID once it is set locally (it is optional, so an empty value is not an error).

Never pushed: per-slot model, project, and location

  • GEMINI_MODEL
  • GROQ_MODEL
  • VERTEX_MODEL

These are not Render env vars. Since the 2026-09-08 slotted-config change, the model in force -- and, for Vertex, the GCP project and location -- live per credential slot in the slot_config database table, so different key slots can run different models and regions with no redeploy. The values above are read from .env.config exactly once, as the seed for the active provider's slot 0, the first time --sync-env runs against a database with no row for it. After that, change them in the dashboard's Environment tab (or uv run python -m scripts.set_override <provider> --index N --model M) -- editing .env.config and redeploying does nothing.

Provider credentials

  • GEMINI_API_KEY
  • GROQ_API_KEY
  • VERTEX_GCP_SERVICE_ACCOUNT_KEY

The selected provider's is always pushed. Another provider's is pushed only if you happen to have it set locally -- an unselected provider's key is never demanded.

Each credential also has numbered key-rotation slots: additional vars named {credential}_2, {credential}_3, and so on -- the naming scheme is registry.slot_env_name()'s ({base} for slot 0, {base}_{n} for slot n>=1). Any slot that is configured locally is pushed too, for every provider, the same as the base credential above; this reference cannot say how many exist for you, since that would mean reading your local configured values, which this generator never does.

Operational settings

Never pushed: database-only settings

  • DISPATCHER_BACKOFF_JITTER_SECONDS
  • DISPATCHER_DEFAULT_RETRY_AFTER_SECONDS
  • DISPATCHER_FAILURE_BASE_BACKOFF_SECONDS
  • DISPATCHER_FAILURE_MAX_BACKOFF_SECONDS
  • DISPATCHER_IDLE_SLEEP_SECONDS
  • DISPATCHER_MAX_FAILURE_ATTEMPTS
  • DISPATCHER_MAX_NOTICE_POST_ATTEMPTS
  • DISPATCHER_MIN_RETRY_AFTER_SECONDS
  • DISPATCHER_NOTICE_SWEEP_BATCH_SIZE
  • DISPATCHER_REREVIEW_COOLDOWN_FACTOR
  • DISPATCHER_REREVIEW_COOLDOWN_MAX_SECONDS
  • DISPATCHER_REREVIEW_COOLDOWN_SECONDS
  • KEY_USAGE_RESET_TIME_UTC
  • KEY_USAGE_TOKEN_CAP
  • LLM_REQUEST_TIMEOUT_SECONDS
  • REVIEW_DRAFT_PRS
  • VERTEX_GCP_LOCATION
  • VERTEX_GCP_PROJECT

These live only in the runtime_config table, never as a Render env var, because the dispatcher must be able to change them with no redeploy. uv run python -m scripts.deploy --sync-config-db pushes them there. Editing one and redeploying does nothing on its own.

Never pushed: operator-machine settings

  • DEMO_BOT_URL
  • DEMO_LAUNCHER_PING_PATH
  • DEMO_WIZARD_URL
  • GUIDE_BASE_URL
  • PUBLIC_BASE_URL
  • REAL_WIZARD_URL
  • RENDER_SERVICE_NAME

These configure your local tooling, not the service. Setting them on Render would create dead env vars.