The core reads configuration from environment variables and command-line flags. The exact deployment requirements depend on the selected storage, encryption, email, authentication, and billing integrations.
Common settings
| Variable | Purpose |
|---|---|
NOKKU_BASE_URL | Public base URL of the deployment |
NOKKU_PORT | Port the core listens on |
NOKKU_SECRET | 32-byte self-hosted encryption secret |
KMS_URI | External key-management URI used when NOKKU_SECRET is not set |
NOKKU_LICENSE_KEY | Enterprise license key for self-hosted instances |
NOKKU_TRUSTED_PROXIES | Comma-separated reverse-proxy IPs/CIDRs (e.g. Traefik) whose forwarded client IP headers are honored |
PostgreSQL is required by the core. Consult the deployment environment and the core configuration package for the complete set of integration-specific variables.
Secret rotation
Stop the core before rotating encrypted data:
./nokku rotate-secrets --new secret:NEW_SECRETTo use a KMS URI:
./nokku rotate-secrets --new kms:hcvault://localhost:8200/transit/keys/nokkuThe command re-encrypts the stored data in one transaction. Update the runtime environment after it succeeds, then start the core.
Health check
The core exposes /healthz. Use it to verify that the process is reachable before diagnosing CLI or daemon authentication.