react-app environment

VITE_ values are public and fixed at build time

Vite inlines every VITE_* variable into the JavaScript bundle when you build. Anything prefixed VITE_ ships to every browser, so never put a secret there. And a built bundle (or image) is pinned to the values it was built with: changing them at runtime does nothing. Build one bundle per environment.

Generation copies .env.example to .env. In development, Vite reads it on start; restart yarn dev after changing it.

Variable	What to set
VITE_APP_API_URL default http://localhost:5000	Backend base URL. Better Auth lives at ${VITE_APP_API_URL}/auth. Production: The API's public URL, as a build argument. Compiled into the bundle. Auth lives at <this>/auth, and requests to it carry the traceparent header.
PORT default 3000	Dev server port. Production: Not used: production is a static bundle served by nginx on port 80. The dev server's port. It's strict: a port in use makes Vite exit instead of moving.
VITE_APP_ALLOWED_HOSTS empty by default	Comma-separated hostnames the dev server will answer to, beyond localhost. Needed when you reach the dev server through a tunnel or a wildcard DNS name. Production: Not used in production. Hostnames the dev server answers beyond localhost: a tunnel or *.lvh.me.
VITE_OPENOBSERVE_URL default https://o2.aurostack.co feature telemetry	OpenObserve browser monitoring (RUM): page views, errors, slow requests, and trace headers on API calls. Leave empty and it stays off. The client token is a RUM token (OpenObserve → Ingestion → RUM): write-only and meant to ship in the bundle — never the backend's ingestion token. The instance must list this app's origin in ZO_CORS_ALLOWED_ORIGINS. Production: Your OpenObserve instance, as a build argument. Telemetry is on only when the URL, org and client token are all set.
VITE_OPENOBSERVE_ORG empty by default feature telemetry	OpenObserve browser monitoring (RUM): page views, errors, slow requests, and trace headers on API calls. Leave empty and it stays off. The client token is a RUM token (OpenObserve → Ingestion → RUM): write-only and meant to ship in the bundle — never the backend's ingestion token. The instance must list this app's origin in ZO_CORS_ALLOWED_ORIGINS. Production: The project's organization identifier, as a build argument.
VITE_OPENOBSERVE_CLIENT_TOKEN empty by default feature telemetry	OpenObserve browser monitoring (RUM): page views, errors, slow requests, and trace headers on API calls. Leave empty and it stays off. The client token is a RUM token (OpenObserve → Ingestion → RUM): write-only and meant to ship in the bundle — never the backend's ingestion token. The instance must list this app's origin in ZO_CORS_ALLOWED_ORIGINS. Production: A RUM token, as a build argument. Where to get it: OpenObserve → Ingestion → RUM. Public by design (write-only). Never the back ends' ingestion token. The instance must list this origin in ZO_CORS_ALLOWED_ORIGINS.
VITE_APP_SITE_URL empty by default feature marketing	The canonical public origin — the ONE origin that may be indexed. Must match PRODUCTION_ORIGIN in src/features/seo/routes.ts. Anything else (previews, staging, unset) is treated as non-production: the build then emits `noindex` and a disallowing robots.txt, so a preview cannot outrank production. Production: The canonical public origin, as a build argument. Must equal PRODUCTION_ORIGIN in src/features/seo/routes.ts; any other value builds as noindex with a disallowing robots.txt, so previews can't outrank production.
VITE_APP_SUPPORT_EMAIL empty by default feature marketing	Published in /.well-known/security.txt. Leave empty and the file is not emitted at all — a security contact pointing at an unmonitored mailbox is worse than none. Production: A monitored security and support address, as a build argument. Published in /.well-known/security.txt; empty skips the file.
API_DOC_URL default http://localhost:5000/openapi-json feature types	Credentials for the backend's OpenAPI document, used by `yarn gen` only. Not VITE_-prefixed on purpose: these are read by a Node script, and prefixing them would inline them into the browser bundle. Production: Not used in production: only by yarn gen. The API's OpenAPI document, <API>/openapi-json.
API_DOC_USER empty by default feature types	Credentials for the backend's OpenAPI document, used by `yarn gen` only. Not VITE_-prefixed on purpose: these are read by a Node script, and prefixing them would inline them into the browser bundle. Production: Not used in production. The API's BASIC_AUTH_USER.
API_DOC_PASSWORD empty by default feature types	Credentials for the backend's OpenAPI document, used by `yarn gen` only. Not VITE_-prefixed on purpose: these are read by a Node script, and prefixing them would inline them into the browser bundle. Production: Not used in production. The API's BASIC_AUTH_PASS.

Not in .env.example

Variable	Used by	Effect
INFISICAL_PROJECT_ID, INFISICAL_PATH	yarn secrets	See Secrets with Infisical

There is deliberately no VITE_APP_URL: absolute links (email verification callbacks) use window.location.origin. A stale URL baked into an image would send every verification link to the previous environment, invisibly, until a user clicked one.

What the API must agree with

• The API’s trusted origins and CORS must include this app’s origin (for local development, http://localhost:3000), with credentials allowed and the traceparent header permitted. See Auth, cookies and CORS.
• better-auth must be served at ${VITE_APP_API_URL}/auth.
• With types, the API’s OpenAPI document at API_DOC_URL, behind the basic auth in API_DOC_USER and API_DOC_PASSWORD.