Configuration

fxbot's server reads its settings from environment variables. None of them is a secret: the key that seals secrets is a file, named by FXBOT_SECRET_KEY_FILE.

Where they are set

Install	Where	Read by
A release, from `setup.sh`	`/etc/fxbot/fxbot.env`, owned by `fxbot`, mode 600	`fxbot.service`, as its `EnvironmentFile`. A change takes effect at the next restart.
A checkout	The environment, or `.env` in the repository root. The environment wins.	The server and its commands. Vite reads no `.env`.

The file setup.sh writes, with the Postgres cluster's own port:

FXBOT_DATABASE_URL=postgres:///fxbot
PGHOST=/var/run/postgresql
PGPORT=5432
FXBOT_SECRET_KEY_FILE=/etc/fxbot/secret.key
FXBOT_DATA=/var/lib/fxbot/data
FXBOT_BACKUPS=/var/lib/fxbot/backups

Variables

Variable	What it is
`FXBOT_DATABASE_URL`	Required. fxbot's Postgres, such as `postgres:///fxbot_dev` with `PGHOST=/var/run/postgresql`: the local socket with peer auth, so no password
`FXBOT_PORT`	The API's port on 127.0.0.1. Default 8787, a release install's; `npm run dev` uses 8788 unless this is set in the shell
`FXBOT_SECRET_KEY_FILE`	Required. A file outside the repo with 32 random bytes in base64. It seals every key and token fxbot stores
`FXBOT_VERCEL_CLIENT_ID`	Optional. fxbot's own Vercel OAuth app, for signing in with a Vercel account
`FXBOT_DATA`	Where libfx keeps each chat's session files. Default `./data`
`FXBOT_CLIENT_METADATA_URL`	Optional. The project's published OAuth client document, for MCP servers that sign in with one. Without it, fxbot registers itself with each server
`FXBOT_MCP_REGISTRY`	Optional. The MCP registry that fxbot mirrors hourly for search, and that registry entries come from. Default GitHub's, `https://api.mcp.github.com`
`FXBOT_MCP_EVERYTHING`	Optional. The registry that Search everything asks, once per search. Default the official one, `https://registry.modelcontextprotocol.io`
`FXBOT_LISTS_URL`	Optional. The site that publishes fxbot's own lists of MCP servers and skills, such as `https://<domain>`. fxbot reads its `mcp-registry.json` and `skills-registry.json` hourly. Without it, the lists the release shipped with
`FXBOT_BACKUPS`	Where the database and chat files are backed up before migrations run. Default `./backups`
`FXBOT_UPDATE_CHECK`	`off` stops the daily check for a newer release, which asks GitHub about the repository in `package.json`
`FXBOT_RELEASES_URL`	Optional. Where that check reads the newest release, in the shape of GitHub's `releases/latest`, for a fork or a mirror

PGHOST and PGPORT are Postgres's own: the folder of its socket, and its port.

The site

npm run build-site reads one variable of its own:

Variable	What it is
`FXBOT_SITE_BASE`	The path the site is served under, such as `/fxbot/`. Default `/`