py-worker environment

Generation copies .env.example to .env; config.py loads it with python-dotenv. Variables already set in the environment win.

HOME_PATH is required, and must be absolute

HOME_PATH is empty by default and the worker refuses to start without it. Logs (and input/, output/) resolve beneath it, so a relative path silently writes somewhere else. Locally, the project directory; in Docker, /app.

Variable	What to set
HOME_PATH empty by default	Absolute path to this project. input/, output/ and logs/ are resolved beneath it, so a relative value silently writes to the wrong place. Production: /app in the Docker image. Required and absolute: logs, input/ and output/ resolve beneath it.
DB_HOST default localhost	The same database your API owns. The SQLAlchemy models here are hand-written and must be kept in step with its schema by hand — nothing checks this. Production: The API's database host. Must be the API's database. See PostgreSQL.
DB_PORT default 5432	The same database your API owns. The SQLAlchemy models here are hand-written and must be kept in step with its schema by hand — nothing checks this. Production: 5432.
DB_USER default root	The same database your API owns. The SQLAlchemy models here are hand-written and must be kept in step with its schema by hand — nothing checks this. Production: A database user with access to the tables this worker uses.
DB_PASSWORD default postgres	The same database your API owns. The SQLAlchemy models here are hand-written and must be kept in step with its schema by hand — nothing checks this. Production: Its password.
DB_NAME default main	The same database your API owns. The SQLAlchemy models here are hand-written and must be kept in step with its schema by hand — nothing checks this. Production: The API's database name.
REDIS_HOST default localhost	The same Redis your API produces jobs to. A mismatch is silent: the worker connects fine and simply never receives anything. Production: Your Redis host; identical on the API and every worker. A worker on a different Redis connects fine and never receives a job. See Redis.
REDIS_PORT default 6379	The same Redis your API produces jobs to. A mismatch is silent: the worker connects fine and simply never receives anything. Production: Your Redis port (6379).
REDIS_USER empty by default	The same Redis your API produces jobs to. A mismatch is silent: the worker connects fine and simply never receives anything. Production: An ACL user, if your Redis uses them.
REDIS_PASSWORD empty by default	The same Redis your API produces jobs to. A mismatch is silent: the worker connects fine and simply never receives anything. Production: The Redis password.
OPENOBSERVE_URL default https://o2.aurostack.co feature telemetry	OpenTelemetry → OpenObserve: traces, logs and metrics. Leave empty and telemetry stays off. Per project: OPENOBSERVE_ORG is the organization identifier, OPENOBSERVE_TOKEN its ingestion token (IAM → Ingestion Tokens). Any other OTLP backend: set OTEL_EXPORTER_OTLP_ENDPOINT/HEADERS instead. Production: Your OpenObserve instance. Telemetry is on only when the URL, org and token are all set. See OpenObserve.
OPENOBSERVE_ORG empty by default feature telemetry	OpenTelemetry → OpenObserve: traces, logs and metrics. Leave empty and telemetry stays off. Per project: OPENOBSERVE_ORG is the organization identifier, OPENOBSERVE_TOKEN its ingestion token (IAM → Ingestion Tokens). Any other OTLP backend: set OTEL_EXPORTER_OTLP_ENDPOINT/HEADERS instead. Production: The project's organization identifier. Where to get it: OpenObserve → organization settings (or the org segment of its URLs).
OPENOBSERVE_TOKEN empty by default feature telemetry	OpenTelemetry → OpenObserve: traces, logs and metrics. Leave empty and telemetry stays off. Per project: OPENOBSERVE_ORG is the organization identifier, OPENOBSERVE_TOKEN its ingestion token (IAM → Ingestion Tokens). Any other OTLP backend: set OTEL_EXPORTER_OTLP_ENDPOINT/HEADERS instead. Production: The organization's ingestion token (o2oi_…). Where to get it: OpenObserve → IAM → Ingestion Tokens. Write-only, but secret: never use it in a browser app (front ends use a RUM token).
OTEL_SERVICE_NAME default acme-py feature telemetry	OpenTelemetry → OpenObserve: traces, logs and metrics. Leave empty and telemetry stays off. Per project: OPENOBSERVE_ORG is the organization identifier, OPENOBSERVE_TOKEN its ingestion token (IAM → Ingestion Tokens). Any other OTLP backend: set OTEL_EXPORTER_OTLP_ENDPOINT/HEADERS instead. Production: A distinct name per service: shop-api, shop-worker, shop-py. The service name on every span, and the default stream name, so each service gets its own stream.
TEMPORAL_ADDRESS default localhost:7233 feature temporal	Temporal: this process also runs the workflows in temporal/. Locally, the API's dev server (its compose.yml; UI on http://localhost:8233), no TLS. In production, the server address, the project's namespace and its mTLS client certificate (plus the CA that signed the server's), as PEM. Escaped \n are accepted, so each fits on one line. Production: Your Temporal frontend, e.g. temporal-grpc.example.com:7233. See Temporal.
TEMPORAL_NAMESPACE default default feature temporal	Temporal: this process also runs the workflows in temporal/. Locally, the API's dev server (its compose.yml; UI on http://localhost:8233), no TLS. In production, the server address, the project's namespace and its mTLS client certificate (plus the CA that signed the server's), as PEM. Escaped \n are accepted, so each fits on one line. Production: The project's namespace, the same on the API and its workers.
TEMPORAL_TASK_QUEUE default python feature temporal	Temporal: this process also runs the workflows in temporal/. Locally, the API's dev server (its compose.yml; UI on http://localhost:8233), no TLS. In production, the server address, the project's namespace and its mTLS client certificate (plus the CA that signed the server's), as PEM. Escaped \n are accepted, so each fits on one line. The queue this worker polls. Its own, not the Node worker's: a workflow task handed to a worker that doesn't know the type fails and retries. Start Python workflows on this queue. Production: This worker's own queue (python). Keep Python workflows on a queue no Node worker polls: a workflow task handed to a worker that doesn't know the type fails and retries. The API starts Python workflows on this queue.
TEMPORAL_TLS_CA empty by default feature temporal	Temporal: this process also runs the workflows in temporal/. Locally, the API's dev server (its compose.yml; UI on http://localhost:8233), no TLS. In production, the server address, the project's namespace and its mTLS client certificate (plus the CA that signed the server's), as PEM. Escaped \n are accepted, so each fits on one line. The queue this worker polls. Its own, not the Node worker's: a workflow task handed to a worker that doesn't know the type fails and retries. Start Python workflows on this queue. Production: The CA that signed the server's certificate, as PEM; empty if it's publicly trusted. Escaped \n are accepted, so it fits on one line.
TEMPORAL_TLS_CERT empty by default feature temporal	Temporal: this process also runs the workflows in temporal/. Locally, the API's dev server (its compose.yml; UI on http://localhost:8233), no TLS. In production, the server address, the project's namespace and its mTLS client certificate (plus the CA that signed the server's), as PEM. Escaped \n are accepted, so each fits on one line. The queue this worker polls. Its own, not the Node worker's: a workflow task handed to a worker that doesn't know the type fails and retries. Start Python workflows on this queue. Production: The project's client certificate, as PEM. Where to get it: Issued by whoever runs your Temporal (the gateway's CA). Set it together with TEMPORAL_TLS_KEY, or startup fails.
TEMPORAL_TLS_KEY empty by default feature temporal	Temporal: this process also runs the workflows in temporal/. Locally, the API's dev server (its compose.yml; UI on http://localhost:8233), no TLS. In production, the server address, the project's namespace and its mTLS client certificate (plus the CA that signed the server's), as PEM. Escaped \n are accepted, so each fits on one line. The queue this worker polls. Its own, not the Node worker's: a workflow task handed to a worker that doesn't know the type fails and retries. Start Python workflows on this queue. Production: The client certificate's private key, as PEM. A secret: keep it in your secret store.

Not in .env.example

Variable	Used by	Effect
APP_ENV	telemetry	Sets deployment.environment.name (default development)
OPENOBSERVE_STREAM	telemetry	Stream name; defaults to OTEL_SERVICE_NAME
OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS	telemetry	Any OTLP backend instead of OpenObserve; takes precedence
OTEL_SDK_DISABLED=true	telemetry	Turns telemetry off