Reference

Lookup tables for properties, secrets, runtime environment variables, and CLI flags used by sfp server init, start, stop, status, scale, and update.

---

Properties

Configured via server.json (passed to --config-file). The 🔥 marker means the change is applied with sfp server init --force, which wipes that tenant's DB, volumes, and on-disk directory — back up first. Other tenants on the same host are untouched.

Field	Default → possible values	How to change
domain — Hostname Caddy serves on and the TLS/auth base. In prod it defaults to https://<tenant>.flxbl.io; the CLI does not hard-require it, but prod config rejects localhost.	prod default by tenant → any FQDN	sfp server init --force 🔥
cicdProvider — Which CI/CD platform you trigger pipelines from. github (default) wires GitHub Actions / GitHub App webhooks; gitlab wires GitLab CI / merge-request triggers.	github → github / gitlab	sfp server init --force 🔥
supabase.mode — Where Postgres lives. self-hosted (default) runs in-stack; cloud points at Supabase Cloud. See Cloud Supabase setup.	self-hosted → self-hosted / cloud	sfp server init --force 🔥
supabase.url — Cloud Supabase URL (only when mode: cloud)	— → any HTTPS URL	sfp server init --force 🔥
tlsMode — How HTTPS is served. cloudflare — BYO cert (Origin CA + trusted_proxies, admin subdomain). letsencrypt — Caddy auto-issues via ACME. custom — Caddy on-demand TLS. none — HTTP only, external proxy terminates TLS.	cloudflare → cloudflare / letsencrypt / custom / none	sfp server init --force 🔥
workers — Background Hatchet worker count	1 → 1–10	sfp server scale --workers <n> (or sfp server update)
workerCounts — Legacy alias for workers (single number or comma-separated)	— → 1–10	sfp server update
release_cadence — Image channel. production (default) → source.flxbl.io/flxbl/sfp-pro-v3/sfp-server:v3-latest; beta → ghcr.io/flxbl-io/sfp-server-rc:beta; development → ghcr.io/flxbl-io/sfp-server-rc:development.	production → production / beta / development	sfp server update --cadence <v>
image_fqdn — Override of release_cadence registry path. Use when you mirror images to a private registry.	derived from cadence → any registry path	sfp server update (or --image at init)
image_tag — Override of release_cadence tag. Pin a specific tag for a specific build.	derived from cadence → any registry tag	sfp server update --docker-tag <tag>
image — (init flag only) full fqdn:tag image reference overriding the cadence default.	— → registry/org/image:tag	sfp server init --image <ref>
trustProxyHops — Number of reverse-proxy hops sfp-server trusts for client IP (Express trust proxy, X-Forwarded-For). Written to .env as TRUST_PROXY_HOPS. If both this and the shell TRUST_PROXY_HOPS are present, trustProxyHops in server.json wins. Controls IP attribution, rate limiting, monitoring allowlists, and audit logging; all inbound paths must have the same hop count.	2 → 0–10	Set trustProxyHops in server.json before init; for an existing tenant edit TRUST_PROXY_HOPS in .env and restart/recreate the stack
secrets.* — Registry creds, Supabase keys (cloud), JWT secret, etc.	from server.json / env / provider → any string	sfp server update (re-collects and preserves existing)
auth.useGlobalAuth — Route auth through flxbl's global auth server instead of the tenant's local GoTrue.	false (self-hosted)	server.json auth.useGlobalAuth
containerEngine — Docker or Podman.	docker → docker / podman	sfp server init --container-engine <engine>

---

Secrets

Self-hosted Supabase auto-generates every SUPABASE_* key, the Studio basic-auth pair, the Hatchet token, and object-storage S3 credentials at init. The "Cloud only" rows below apply when supabase.mode: cloud — paste them into secrets.* in your server.json.

Secret / Env Var	Required?	Where to get it
DOCKER_REGISTRY	Always	source.flxbl.io
DOCKER_REGISTRY_TOKEN	Always	Log in to source.flxbl.io → User Settings → Applications → Generate New Token → All repos + Org access, package: Read scope.
DOCKER_REGISTRY_USERNAME	Optional	Defaults to USERNAME for token-only registries; set when a named user is required.
ORIGIN_CERT	If --tls-mode cloudflare	Base64-encoded PEM certificate (see TLS config). Optional if you place certs manually.
ORIGIN_KEY	If --tls-mode cloudflare	Base64-encoded PEM private key (see TLS config).
SUPABASE_URL	Cloud only	Supabase Dashboard → Project overview → Project API → Project URL
SUPABASE_ANON_KEY	Cloud only	Supabase Dashboard → Project overview → Project API → anon/public key
SUPABASE_SERVICE_KEY	Cloud only	Supabase Dashboard → Project Settings → API Keys → service_role
SUPABASE_JWT_SECRET	Cloud only	Supabase Dashboard → Project Settings → JWT Keys → JWT Secret
SUPABASE_DB_URL	Cloud only	Dashboard → Connect → Session pooler (port 6543) for IPv4-only hosts; URL-encode @ → %40
GITHUB_APP_ID	Post-init only	Wire up after init with sfp server integration create --provider github --auth-type app (or POST /sfp/api/integrations). Not in server.json.
GITHUB_APP_PRIVATE_KEY	Post-init only	Same: passed to sfp server integration create as the credentials payload.

---

Runtime environment

These values are not secrets. They live in the generated tenant .env and can be edited after init.

Env Var	Required?	Purpose
TRUST_PROXY_HOPS	Optional	Number of reverse-proxy hops to trust for X-Forwarded-For (Express trust proxy). Range 0–10, default 2 (covers Cloudflare → Caddy → app or customer LB → Caddy → app). Set to 3 for Cloudflare → customer LB → Caddy → app. All inbound paths must have the same hop count. Too-high values let client-controlled X-Forwarded-For affect IP attribution, rate limits, logs, and allowlists. Restart/recreate the stack after changing. X-Forwarded-Proto and X-Forwarded-Host are read separately and must be preserved by the same chain.
ALLOWED_IPS	Optional	Comma-separated IPs/CIDRs allowed to reach the IP-restricted admin surfaces (Hatchet dashboard, npm registry, Studio). Default 88.216.59.233.

---

CLI flags

Flags for sfp server init. Other lifecycle commands accept the shared --tenant, --base-dir, SSH, and secrets-provider flags.

Flag	Default	When you need it
--tenant, -t <name>	required	[a-z0-9-] only; one tenant = one isolated install.
--mode, -m <dev|prod>	prod	dev skips TLS + domain requirements and serves on http://localhost:3029.
--workers, -w <1-10>	1	--workers 4 — background Hatchet worker count.
--domain, -d <fqdn>	prod defaults to https://<tenant>.flxbl.io	FQDN used in TLS and auth callbacks; prod rejects localhost.
--config-file <path>	—	Path to your server.json.
--compose-file <path>	—	Point at a custom docker-compose.yml.
--base-dir <path>	./sfp-server	Install path on the target box.
--image <fqdn:tag>	cadence default	Full image reference override (equivalent of image_fqdn+image_tag).
--no-caddy	off	Deprecated — ignored. Caddy is required for auth routing; a warning is printed.
--tls-mode <cloudflare|letsencrypt|custom|none>	cloudflare	See TLS config.
--supabase-mode <self-hosted|cloud>	self-hosted	self-hosted auto-generates credentials; cloud requires --supabase-url + secrets.
--supabase-url <url>	—	Cloud Supabase URL (only when self-hosted is not in use).
--print-credentials	off	Dump admin creds to stdout. Insecure in CI/CD — by default they go to {tenantDir}/credentials.json (mode 600).
--interactive, -i / --no-interactive	non-interactive	Default is non-interactive (reads server.json/env/provider). Pass --interactive to prompt for missing values.
--container-engine <docker|podman>	docker	Select Podman (rootless RHEL/Fedora).
--secrets-provider <custom|infisical|aws-secretsmanager>	custom	Where init reads secrets from. custom reads env vars and server.json; infisical pulls from Infisical; aws-secretsmanager pulls from AWS (currently environment-variable fallback).
--infisical-token <t>	—	Required when --secrets-provider=infisical. Env var INFISICAL_TOKEN is recommended over the flag.
--aws-region <r>	—	Required in prod when --secrets-provider=aws-secretsmanager.
--aws-access-key-id / --aws-secret-access-key	—	Optional AWS credentials (instance profile fallback allowed).
--force, -f	off	Re-init an existing tenant. 🔥 wipes tenant DB + volumes + on-disk tenant dir.
--ssh-connection <user@host[:port]>	—	Run init remotely. Omit --ssh-connection AND --identity-file (both, together) to install on the local box.
--identity-file <path>	—	SSH private key (paired with --ssh-connection). Tilde expanded; ~/.ssh/config aliases are not read.
--passphrase <p>	—	Only if your SSH key is encrypted.

---

Cloud Supabase setup

Use cloud mode when you must reuse an existing Supabase project. You provide the five SUPABASE_* secrets (where to find each: see Secrets above). Self-hosted is the default and auto-generates those keys at init.

{
  "domain": "sfp.yourcompany.com",
  "supabase": { "mode": "cloud", "url": "https://project.supabase.co" },
  "secrets": {
    "DOCKER_REGISTRY": "source.flxbl.io",
    "DOCKER_REGISTRY_TOKEN": "your-source-flxbl-pat",
    "SUPABASE_URL": "https://project.supabase.co",
    "SUPABASE_ANON_KEY": "eyJhbGciOi...",
    "SUPABASE_SERVICE_KEY": "eyJhbGciOi...",
    "SUPABASE_JWT_SECRET": "your-jwt-secret",
    "SUPABASE_DB_URL": "postgresql://postgres:[e-mail]:5432/postgres"
  }
}

In cloud mode init tests DB connectivity (supabase db dump on the local workstation) and creates the admin user directly via the Supabase admin API.