Configure an environment

Outcome

Each process receives only the configuration required by its current role, and invalid origins or missing production credentials fail explicitly.

Prerequisites

Choose the environment (local, preview, staging, or production) and its app, worker, or migration role. Review the generated setting names; it is the current code truth for Settings, WorkerSettings, and MigrationSettings, including their cross-field validators.

Steps

1. Set LUMEN_ENVIRONMENT to exactly local, preview, staging, or production. Only local may use development database roles, development auth, filesystem artifacts, loopback private origins, local Temporal, or local Docker.
2. Put non-secret local values in the ignored environment file or current shell. Put hosted secrets in the provider's secret manager.
3. Give migration administration credentials only to the pre-deploy migration job. Give the app, gateway, and worker distinct remote least-privilege PostgreSQL credentials.
4. For every non-local app profile, select Supabase authentication and R2, remove the development bearer token, configure the attempt-capability signer, and use a non-development runtime profile digest.
5. For every non-local worker profile, configure remote TLS Temporal with an API key, explicit namespace, and immutable worker build; select Daytona for both attempt and kernel runtimes; require DAYTONA_EGRESS_POLICY=block_all; and set an immutable runtime build, repository-digest-pinned image, and RUNTIME_PLATFORM.
6. Use non-loopback private service origins. Remote origins use HTTPS; HTTP is accepted only for a *.railway.internal host on Railway private networking.
7. In production, set PUBLIC_API_ORIGIN=https://api.lumenai.dev, set CORS_ORIGINS to exactly https://lumenai.dev and https://www.lumenai.dev, and configure an OTLP/HTTP endpoint.
8. Restart the owning process after configuration changes.

Do not copy example values into production. Do not place database administration, Temporal, object administration, compute organization, connector, or model-provider credentials inside a sandbox. Local Docker remains a local-development implementation. Production notebook execution uses one dedicated Daytona sandbox per document runtime-session generation, separate from any Pi attempt sandbox.

OpenAI, Anthropic, Parallel, and Exa keys are optional activation gates. Leaving them absent keeps those providers visibly unconfigured without blocking the keyless production profile.

Verify

Run pnpm check, each process readiness check, and the contract suite for every selected adapter. Production verification must additionally prove the effective role and secret boundary, not merely that environment variables exist. Incomplete R2, Daytona, authentication, telemetry, origin, and runtime profiles must fail during typed startup validation. A passing startup preflight is not proof that the managed service, DNS, TLS, or provider path has passed its live smoke.

Recover

If startup rejects a value, restore the last known-good environment revision and fix the named field. If a secret may have crossed a boundary, revoke and rotate it before restarting work, then inspect logs and artifacts for exposure.

Next task

Review the deployment topology.