Deployment
Environment reference Every variable the hub, the dashboard and the agent read, and which deployment sets it.
With the docker compose deployment these come from .env at the repo root (copy
.env.example). On Coolify, the SERVICE_* ones are generated and shown in the
resource's Environment tab; the rest have defaults.
Variable Default What it is EDGE_PORT8080Host port the edge publishes, in plain HTTP. Your own reverse proxy terminates TLS and forwards here. Compose deployment only. MAGNEMITE_PUBLIC_URL— The base URL handed to agents. Artifact URLs are built from it , so it must be what the boxes can actually reach. On Coolify this is the edge domain. MAGNEMITE_DASHBOARD_URLMAGNEMITE_PUBLIC_URLThe dashboard's own origin, checked by Better Auth. Only needs setting when the two audiences are on separate domains. BETTER_AUTH_URLMAGNEMITE_DASHBOARD_URLBase URL for auth callbacks. Falls back to Coolify's SERVICE_FQDN_WEB; a bare host with no scheme is accepted. HUB_URLhttp://hub:3001Where the dashboard reaches the hub's internal API, over the compose network.
Variable Default What it is POSTGRES_USERmagnemiteThe database user. POSTGRES_PASSWORD— Generated by Coolify as SERVICE_PASSWORD_POSTGRES. POSTGRES_DBmagnemiteThe database name. DATABASE_URL— Only used when running Prisma or the apps outside Docker. Inside compose it is built from the POSTGRES_* values and points at the postgres service.
Variable Default What it is AUTH_SECRET— Signs Better Auth cookies. openssl rand -base64 32. Coolify generates SERVICE_BASE64_64_AUTHSECRET. ADMIN_EMAIL[email protected] [email protected] Login identifier for the seeded admin. Nothing is ever sent to it, but it must be a well-formed address — admin@localhost is rejected. ADMIN_PASSWORD— Seeded admin password. Coolify generates SERVICE_PASSWORD_ADMIN.
ADMIN_EMAIL and ADMIN_PASSWORD are set on the hub service, because the seed runs in that
container and there is no .env file inside it. Re-running the seed resets that address's
password — which is the way back in if you lose the login.
Variable Default What it is HUB_PORT3001HUB_INTERNAL_SECRET— Shared secret for web → hub internal calls (SSE, dispatch nudges, rollout control). Coolify generates SERVICE_PASSWORD_HUBSECRET. ARTIFACT_DIR/data/artifacts in composeWhere cached .apkm bundles live. Must match the volume mounted into Caddy as /srv/artifacts. SERVE_ARTIFACTSfalseServe /files/* from Node. Leave false in both deployments; true only for local development without Caddy. MAX_CONCURRENT_JOBS10Fleet-wide cap on devices downloading or installing at the same time. JOB_STALL_TIMEOUT900Seconds without a job_progress message before a job is treated as stalled and re-queued. AGENT_AUTO_UPDATEtrueTell boxes on an older build to update themselves to the binary this hub image ships. See updating the agent . AGENT_UPDATE_CONCURRENCY5How many boxes may be swapping their agent binary at once. AGENT_BIN_DIR/app/agent-binWhere the hub image keeps those binaries, next to the VERSION they were built from.
Variable Default What it is SOURCE_POLL_MINUTES10080 in .env.example, 15 in composeHow often every enabled source is polled. MIRROR_INDEX_URLthe two defaults Comma-separated index URLs the seed starts with. Read once; after that, sources are edited in the dashboard.
The sources themselves are rows in the database, managed in Settings → Version
sources — see APKs sources .
Variable Default What it is ROTOM_ENABLEDfalseSee Rotom . ROTOM_URL— RotomNG's HTTP listener, usually :7072. /api is appended, so either form works. ROTOM_SECRET— Matches secret under http_listener in the Rotom config.
Coolify replaces every SERVICE_* placeholder on first deploy and shows the
result in the Environment tab.
Placeholder Becomes SERVICE_FQDN_WEBthe dashboard's domain SERVICE_FQDN_EDGEthe agents' domain SERVICE_FQDN_DOCSthe documentation site's domain (docs compose file only) SERVICE_URL_WEB / SERVICE_URL_EDGEthe same, with the scheme SERVICE_USER_POSTGRES / SERVICE_PASSWORD_POSTGRESdatabase credentials SERVICE_PASSWORD_HUBSECRETHUB_INTERNAL_SECRETSERVICE_BASE64_64_AUTHSECRETAUTH_SECRETSERVICE_PASSWORD_ADMINthe first admin's password
Per-box, in /data/adb/magnemite/config.json, or as flags:
Flag Config key What it is -serverserverUrlThe hub URL — MAGNEMITE_PUBLIC_URL, never the dashboard's. -enroll-tokenenrollmentTokenUsed once on first run, then deleted from the config. -namenameFriendly name for the box. -config— Path to config.json. -work-dir— Scratch directory for downloads and extraction. -fake-root— Simulate an Android box. See Testing without hardware . -fake-serial— Serial to report in -fake-root mode. -version— Print the agent version and exit.
