Reference
Lookup tables for properties, secrets, runtime environment variables, and CLI flags used by sfp server init, start, stop, status, scale, and update.
Properties
Configured via server.json (passed to --config-file). The 🔥 marker means the change is applied with sfp server init --force, which wipes that tenant's DB, volumes, and on-disk directory — back up first. Other tenants on the same host are untouched.
| Field | Default → possible values | How to change |
|---|---|---|
domain — Hostname Caddy serves on and the TLS/auth base. In prod it defaults to https://<tenant>.flxbl.io; the CLI does not hard-require it, but prod config rejects localhost. | prod default by tenant → any FQDN | sfp server init --force 🔥 |
cicdProvider — Which CI/CD platform you trigger pipelines from. github (default) wires GitHub Actions / GitHub App webhooks; gitlab wires GitLab CI / merge-request triggers. | github → github / gitlab | sfp server init --force 🔥 |
supabase.mode — Where Postgres lives. self-hosted (default) runs in-stack; cloud points at Supabase Cloud. See Cloud Supabase setup. | self-hosted → self-hosted / cloud | sfp server init --force 🔥 |
supabase.url — Cloud Supabase URL (only when mode: cloud) | — → any HTTPS URL | sfp server init --force 🔥 |
tlsMode — How HTTPS is served. cloudflare — BYO cert (Origin CA + trusted_proxies, admin subdomain). letsencrypt — Caddy auto-issues via ACME. custom — Caddy on-demand TLS. none — HTTP only, external proxy terminates TLS. | cloudflare → cloudflare / letsencrypt / custom / none | sfp server init --force 🔥 |
workers — Background Hatchet worker count | 1 → 1–10 | sfp server scale --workers <n> (or sfp server update) |
workerCounts — Legacy alias for workers (single number or comma-separated) | — → 1–10 | sfp server update |
release_cadence — Image channel. production (default) → source.flxbl.io/flxbl/sfp-pro-v3/sfp-server:v3-latest; beta → ghcr.io/flxbl-io/sfp-server-rc:beta; development → ghcr.io/flxbl-io/sfp-server-rc:development. | production → production / beta / development | sfp server update --cadence <v> |
image_fqdn — Override of release_cadence registry path. Use when you mirror images to a private registry. | derived from cadence → any registry path | sfp server update (or --image at init) |
image_tag — Override of release_cadence tag. Pin a specific tag for a specific build. | derived from cadence → any registry tag | sfp server update --docker-tag <tag> |
image — (init flag only) full fqdn:tag image reference overriding the cadence default. | — → registry/org/image:tag | sfp server init --image <ref> |
trustProxyHops — Number of reverse-proxy hops sfp-server trusts for client IP (Express trust proxy, X-Forwarded-For). Written to .env as TRUST_PROXY_HOPS. If both this and the shell TRUST_PROXY_HOPS are present, trustProxyHops in server.json wins. Controls IP attribution, rate limiting, monitoring allowlists, and audit logging; all inbound paths must have the same hop count. | 2 → 0–10 | Set trustProxyHops in server.json before init; for an existing tenant edit TRUST_PROXY_HOPS in .env and restart/recreate the stack |
secrets.* — Registry creds, Supabase keys (cloud), JWT secret, etc. | from server.json / env / provider → any string | sfp server update (re-collects and preserves existing) |
auth.useGlobalAuth — Route auth through flxbl's global auth server instead of the tenant's local GoTrue. | false (self-hosted) | server.json auth.useGlobalAuth |
containerEngine — Docker or Podman. | docker → docker / podman | sfp server init --container-engine <engine> |
Secrets
Self-hosted Supabase auto-generates every SUPABASE_* key, the Studio basic-auth pair, the Hatchet token, and object-storage S3 credentials at init. The "Cloud only" rows below apply when supabase.mode: cloud — paste them into secrets.* in your server.json.
| Secret / Env Var | Required? | Where to get it |
|---|---|---|
DOCKER_REGISTRY | Always | source.flxbl.io |
DOCKER_REGISTRY_TOKEN | Always | Log in to source.flxbl.io → User Settings → Applications → Generate New Token → All repos + Org access, package: Read scope. |
DOCKER_REGISTRY_USERNAME | Optional | Defaults to USERNAME for token-only registries; set when a named user is required. |
ORIGIN_CERT | If --tls-mode cloudflare | Base64-encoded PEM certificate (see TLS config). Optional if you place certs manually. |
ORIGIN_KEY | If --tls-mode cloudflare | Base64-encoded PEM private key (see TLS config). |
SUPABASE_URL | Cloud only | Supabase Dashboard → Project overview → Project API → Project URL |
SUPABASE_ANON_KEY | Cloud only | Supabase Dashboard → Project overview → Project API → anon/public key |
SUPABASE_SERVICE_KEY | Cloud only | Supabase Dashboard → Project Settings → API Keys → service_role |
SUPABASE_JWT_SECRET | Cloud only | Supabase Dashboard → Project Settings → JWT Keys → JWT Secret |
SUPABASE_DB_URL | Cloud only | Dashboard → Connect → Session pooler (port 6543) for IPv4-only hosts; URL-encode @ → %40 |
GITHUB_APP_ID | Post-init only | Wire up after init with sfp server integration create --provider github --auth-type app (or POST /sfp/api/integrations). Not in server.json. |
GITHUB_APP_PRIVATE_KEY | Post-init only | Same: passed to sfp server integration create as the credentials payload. |
Runtime environment
These values are not secrets. They live in the generated tenant .env and can be edited after init.
| Env Var | Required? | Purpose |
|---|---|---|
TRUST_PROXY_HOPS | Optional | Number of reverse-proxy hops to trust for X-Forwarded-For (Express trust proxy). Range 0–10, default 2 (covers Cloudflare → Caddy → app or customer LB → Caddy → app). Set to 3 for Cloudflare → customer LB → Caddy → app. All inbound paths must have the same hop count. Too-high values let client-controlled X-Forwarded-For affect IP attribution, rate limits, logs, and allowlists. Restart/recreate the stack after changing. X-Forwarded-Proto and X-Forwarded-Host are read separately and must be preserved by the same chain. |
ALLOWED_IPS | Optional | Comma-separated IPs/CIDRs allowed to reach the IP-restricted admin surfaces (Hatchet dashboard, npm registry, Studio). Default 88.216.59.233. |
CLI flags
Flags for sfp server init. Other lifecycle commands accept the shared --tenant, --base-dir, SSH, and secrets-provider flags.
| Flag | Default | When you need it |
|---|---|---|
--tenant, -t <name> | required | [a-z0-9-] only; one tenant = one isolated install. |
--mode, -m <dev|prod> | prod | dev skips TLS + domain requirements and serves on http://localhost:3029. |
--workers, -w <1-10> | 1 | --workers 4 — background Hatchet worker count. |
--domain, -d <fqdn> | prod defaults to https://<tenant>.flxbl.io | FQDN used in TLS and auth callbacks; prod rejects localhost. |
--config-file <path> | — | Path to your server.json. |
--compose-file <path> | — | Point at a custom docker-compose.yml. |
--base-dir <path> | ./sfp-server | Install path on the target box. |
--image <fqdn:tag> | cadence default | Full image reference override (equivalent of image_fqdn+image_tag). |
--no-caddy | off | Deprecated — ignored. Caddy is required for auth routing; a warning is printed. |
--tls-mode <cloudflare|letsencrypt|custom|none> | cloudflare | See TLS config. |
--supabase-mode <self-hosted|cloud> | self-hosted | self-hosted auto-generates credentials; cloud requires --supabase-url + secrets. |
--supabase-url <url> | — | Cloud Supabase URL (only when self-hosted is not in use). |
--print-credentials | off | Dump admin creds to stdout. Insecure in CI/CD — by default they go to {tenantDir}/credentials.json (mode 600). |
--interactive, -i / --no-interactive | non-interactive | Default is non-interactive (reads server.json/env/provider). Pass --interactive to prompt for missing values. |
--container-engine <docker|podman> | docker | Select Podman (rootless RHEL/Fedora). |
--secrets-provider <custom|infisical|aws-secretsmanager> | custom | Where init reads secrets from. custom reads env vars and server.json; infisical pulls from Infisical; aws-secretsmanager pulls from AWS (currently environment-variable fallback). |
--infisical-token <t> | — | Required when --secrets-provider=infisical. Env var INFISICAL_TOKEN is recommended over the flag. |
--aws-region <r> | — | Required in prod when --secrets-provider=aws-secretsmanager. |
--aws-access-key-id / --aws-secret-access-key | — | Optional AWS credentials (instance profile fallback allowed). |
--force, -f | off | Re-init an existing tenant. 🔥 wipes tenant DB + volumes + on-disk tenant dir. |
--ssh-connection <user@host[:port]> | — | Run init remotely. Omit --ssh-connection AND --identity-file (both, together) to install on the local box. |
--identity-file <path> | — | SSH private key (paired with --ssh-connection). Tilde expanded; ~/.ssh/config aliases are not read. |
--passphrase <p> | — | Only if your SSH key is encrypted. |
Cloud Supabase setup
Use cloud mode when you must reuse an existing Supabase project. You provide the five SUPABASE_* secrets (where to find each: see Secrets above). Self-hosted is the default and auto-generates those keys at init.
{
"domain": "sfp.yourcompany.com",
"supabase": { "mode": "cloud", "url": "https://project.supabase.co" },
"secrets": {
"DOCKER_REGISTRY": "source.flxbl.io",
"DOCKER_REGISTRY_TOKEN": "your-source-flxbl-pat",
"SUPABASE_URL": "https://project.supabase.co",
"SUPABASE_ANON_KEY": "eyJhbGciOi...",
"SUPABASE_SERVICE_KEY": "eyJhbGciOi...",
"SUPABASE_JWT_SECRET": "your-jwt-secret",
"SUPABASE_DB_URL": "postgresql://postgres:password@db.project.supabase.co:5432/postgres"
}
}In cloud mode init tests DB connectivity (supabase db dump on the local workstation) and creates the admin user directly via the Supabase admin API.