Environment Variable Inventory
Executive Overview — all summaries for decision-makers.
Keine Secrets in diesem Dokument. Werte nur in Render Dashboard / Azure / Cloudflare setzen.
Production — Backend (mqa-backend)
| Variable | Pflicht | Beschreibung | Quelle |
|---|---|---|---|
DATABASE_URL | ✅ | PostgreSQL Connection String | Render Postgres (auto) |
NODE_ENV | ✅ | production | render.yaml |
PORT | ✅ | 3000 | render.yaml |
JWT_SECRET | ✅ | JWT Signing (min. 32 Zeichen) | Render generate |
CORS_ORIGIN | ✅ | https://portal.mqa.group | render.yaml |
FRONTEND_URL | ✅ | https://portal.mqa.group | render.yaml |
CRON_SECRET | ✅ | Header x-cron-secret für /api/jobs/run | Render generate |
SKIP_OAUTH_VALIDATION | ✅ | Muss false sein in Production | render.yaml |
OAUTH_CLIENT_ID | ✅ | Azure App Registration | Azure Portal |
OAUTH_CLIENT_SECRET | ✅ | Azure App Secret | Azure Portal |
OAUTH_TENANT_ID | ✅ | Azure Tenant ID | Azure Portal |
OAUTH_REDIRECT_URI | ✅ | https://api.mqa.group/api/auth/callback | Azure + Render |
ANTHROPIC_API_KEY | ✅ | Claude API | Anthropic Console — siehe AI-SERVICES |
OPENROUTER_API_KEY | ⚪ | Alternative LLM Route | OpenRouter — siehe AI-SERVICES |
RESEND_API_KEY | ⚪ | E-Mail via Resend | Resend — siehe RESEND |
MICROSOFT_SENDER_EMAIL | ⚪ | Graph E-Mail Absender | Azure |
R2_ACCOUNT_ID | ✅ | Cloudflare R2 Account | Cloudflare (MQA-Org) |
R2_ACCESS_KEY_ID | ✅ | R2 API Key | Cloudflare |
R2_SECRET_ACCESS_KEY | ✅ | R2 API Secret | Cloudflare |
R2_BUCKET_NAME | ✅ | z.B. mqa-media | Cloudflare |
R2_PUBLIC_URL | ✅ | Public R2 CDN URL | Cloudflare |
ADMIN_MAINTENANCE_SECRET | ⚪ | /api/admin/maintenance/* | openssl rand |
EMAIL_WEBHOOK_SECRET | ⚪ | /api/email-tracking/delivered | openssl rand |
OPENSANCTIONS_API_KEY | ⚪ | KYC Screening | OpenSanctions |
HIDE_PORTAL_DEMO_CONTENT | ⚪ | Demo-Inhalte ausblenden | true in Prod |
Production — Frontend (mqa-frontend)
| Variable | Pflicht | Beschreibung |
|---|---|---|
VITE_API_BASE_URL | ✅ | https://api.mqa.group/api |
VITE_APP_ENV | ✅ | production |
VITE_DOCS_URL | ✅ | https://docs.mqa.group (externe VitePress-Site) |
NODE_VERSION | ✅ | 20 |
Niemals Secrets unter VITE_* — landen im Browser-Bundle.
Production — Developer Docs (mqa-docs)
| Variable | Pflicht | Beschreibung |
|---|---|---|
DOCS_PASSWORD | ✅ | HTTP Basic Auth für docs.mqa.group — ohne Wert ist die Site öffentlich |
DOCS_USERNAME | ⚪ | Basic-Auth-Benutzer (Default mqa) |
PORT | ✅ | Von Render gesetzt |
NODE_VERSION | ✅ | 20 |
Staging (geplant)
Gleiche Keys wie Production, andere Werte:
CORS_ORIGIN/FRONTEND_URL→https://staging.portal.mqa.groupVITE_API_BASE_URL→https://staging.api.mqa.group/api- Eigene
DATABASE_URL,JWT_SECRET, OAuth-App
Local Development
| Datei | Git |
|---|---|
backend/.env | ❌ gitignored |
.env.local | ❌ gitignored |
backend/ENV_TEMPLATE.txt | ✅ Template |
Rotation
| Secret | Empfohlene Frequenz | Trigger |
|---|---|---|
JWT_SECRET | 12 Monate | Invalidiert alle Sessions |
CRON_SECRET | 12 Monate | Render Cron Job Header updaten |
| R2 Keys | Bei Account-Migration | Sofort |
| OAuth Secret | 24 Monate (Azure Policy) | Azure Portal |
ADMIN_MAINTENANCE_SECRET | Bei Team-Wechsel | Manuell |
Siehe SECURITY-STATUS.