Per-variable editor. For each variable declared in this target's .env.example
you can set a literal, load from the config registry or the vault,
generate a value (fernet key, uuid, password, ...), save the current
value back into registry or vault under a label, or toggle
active/commented. Rendering annotates each line with its source.
Loading model…
No variables to edit yet.
This target has neither a .env.example spec nor any
variables in its current .env. Upload a release to
seed a spec, or add variables to the target .env
directly (raw editor above) — they will show up here as
editable extras.
Registry entry
Alphanumeric, dots, hyphens, colons, underscores. 1–63 chars. Immutable after create.
Set value
Variable:
Value taken from variable
The value stored will be this variable's current resolved value
(whatever Render → .env would write). If you
want to store a different value, cancel and use
Set or Gen first, then
come back to → Reg / → Vault.
This variable has no resolved value yet.
Save would fail. Cancel and use Set,
Gen, ← Reg, or
← Vault first to establish a value.
Rendered .env (preview — not written to disk)
env-studio resolver — preview
Kind legend + syntax help
Syntax VAR=@@LABEL — reference: RR fetches value from vault (preferred) or config-registry. VAR=###create_password 32 alphanumsym### — directive: RR generates value, persists in vault as label=VAR, substitutes inline. Idempotent by label: redeploy reuses; use ###rotate_*### to overwrite. VAR=${OTHER} — Docker/shell expansion. RR does NOT touch. Expanded at container start. Directive verbs: create_password N charset · create_hex N · create_uuid · create_fernet_key · create_rsa_keypair bits (+ rotate_* variants). Charsets: alphanum · alphanumsym · hex.
Directive parse errors — Apply is blocked until these are fixed in the .env editor
L#
Kind
Variable
Action / Source / Verb
Section B suggestion — canonical-name normalization for downstream apps:
Diff (secrets masked; only registry-sourced references shown in clear):
Pre-flight images
Ogni immagine che questo release riferisce (compose image: + Dockerfile FROM).
Ti dice cosa hai già in locale e cosa manca, così puoi tirarle giù prima della pipeline
invece che farla fallire a metà build. Auth locale testata automaticamente,
Docker Hub non richiede login.
🔍 Scanning tarball...
Secrets vault
🔒 encrypted
Sensitive values only: API keys, passwords, tokens,
private credentials. Stored encrypted at rest; reveal is audited.
Reusable across targets via ← Vault on any variable —
the label is your name for it, independent of the env var name in
any specific module. For non-sensitive config (profiles, hostnames,
paths, feature flags) use the Config registry
card below.
Config registry
📄 plaintext
Non-sensitive config only: profile names, host names,
feature flags, shared paths, default numeric limits. Values are
stored and displayed in plaintext (no encryption, no audit — this
is not a place for secrets). Reusable across targets via
← Reg on any variable. For secrets (API keys, passwords,
tokens) use the Secrets vault card above.
No config entries yet. Click + Add config below, or
→ Reg on any variable row inside the Studio to promote
its value into a reusable label.
PyDeepCheck
Checking...
⚙ Configuration
31 analyzer
Configurazione degli analyzer PyDeepCheck v3-S53 eseguiti allo
Stage 1 (PYDEEPCHECK) di ogni deploy.
Tre categorie: A static analyzer core (sempre attivi),
B external tool bridges (auto-detect nel $PATH),
D LLM security batteries (Advanced, opt-in con API key).
●
Cat. A — Static analyzers (19, sempre eseguiti)
Caricamento…
●
Cat. B — External tools (4, auto-detect nel $PATH)
Caricamento…
●
Cat. D — LLM security batteries (8) · Advanced
Caricamento…
Richiedono API key + budget. OFF per default.
Gate mode
●
Storia versioni (0)
Caricamento…
Adopt Legacy Tar
Bootstrap a RELEASE_PLAYBOOK.json onto a legacy tarball
(from before the playbook-mandatory era) so it can pass the pipeline's
playbook check. Filename is LLM-parsed; generated playbook is
verified end-to-end before delivery.
BuildKit cache (r49 companion — reclaim disk after switching off buildx)
Software installato
Per ogni target, la versione attualmente in esecuzione (ultimo deploy con PASS).
Fallimenti esclusi. Aggiornato in tempo reale ogni 5 secondi.
Caricamento…
Runs
No runs yet
QUEUED
Logs
Summary
System
🔑 API Tokens
(admin — logged-in operator only)
▶
Bearer tokens used by orchestrators (project-graph, edg,
release-importer, ci-cron, ...). Each token has a human label
and is stored bcrypt-hashed. Raw tokens are shown ONCE at
creation — copy immediately, they can't be recovered.
Label
Prefix
Created
Last used
Status
Actions
Click header to load
🔑 New API token created
⚠️ This is the ONLY time the raw token is shown. Copy it now — it cannot be recovered later.
Add saved value
🔐 New registry auth
Editing existing entry. Host:port cannot be
changed (it's part of the vault label). To move this entry to a
different host, delete it and recreate it here.
Adds a Docker registry credential to the vault following the
r82a convention. The label is derived from host:port
so multiple registries can coexist; the tag registry-auth
is added automatically so the RR startup hook discovers this
entry. All fields are encrypted at rest. The legacy
REGISTRY_AUTH_URL/USER/PASS env-var path (r10)
remains available as a fallback.