Environment variables
Inject runtime config and secrets into your app — encrypted at rest, applied on restart.
Environment variables are how you hand runtime configuration — database URLs, API keys, feature flags — to your app without baking them into the image. In VAC, every variable is encrypted at rest.
Setting variables
Open an app, go to its Environment section, and edit the key/value table. You can add and
remove rows inline, or paste a block in .env format / JSON to import several at once. Save to
apply the full set (saving replaces the whole set, so deleting a row removes the variable).
The importer auto-flags likely secrets — keys ending in _SECRET, _PASSWORD, _TOKEN, _KEY
— as sensitive.
Encryption at rest
All values are sealed with AES-256-GCM (crypto.Box), keyed by VAC_MASTER_KEY. There is no
plaintext column anywhere on disk — the sensitive flag only controls read-back in the UI, not
whether a value is encrypted.
Environment variables depend on VAC_MASTER_KEY. Without it configured, VAC can't seal or unseal values and env operations are rejected. It's set automatically by the installer — just don't lose it. See Disaster recovery.
Sensitive and write-only
Each variable has two optional flags:
| Flag | Behavior |
|---|---|
| sensitive | The value is hidden in the list view. You can reveal it on demand (an audited action). |
| write-only | Stronger: the value can never be read back — only replaced. Reveal is refused. |
Use write-only for credentials you never need to see again after setting. To keep an existing write-only value while editing other variables, leave it untouched — VAC carries the sealed bytes forward rather than wiping it.
Plaintext secret values are never written to logs; revealing one records only who revealed which key, never the value.
How variables reach your app
At deploy time VAC decrypts your variables and renders them into a Compose env file (mode 0600)
that docker compose reads. The values are injected into your containers at runtime.
- They're app-wide: every service in the stack receives every variable.
- They're not available at image build time unless your build explicitly reads the env file.
Changes need a restart
Saving env vars stores them immediately, but running containers keep their old environment until restarted. VAC shows a "restart to apply" prompt after a save — restart the app (or redeploy) to pick up the new values. There is no automatic restart.