Environment Variables

Compose files use environment variables for configuration. dockmesh extends this with global variables injected into every stack, plus host-scoped variables that only apply to stacks on specific hosts.

Precedence

When a stack deploys, dockmesh resolves variables in this order (highest wins):

1. Stack .env file (in the stack directory on disk)
2. Stack-level vars configured in the UI for this specific stack
3. Host-scoped globals matching the stack’s host
4. Organization globals (apply everywhere)
5. System defaults (if the Compose file has ${VAR:-default})

This lets you set TZ=Europe/Berlin once as a global and have it injected into every container, while still overriding it for a specific stack if needed.

Global variables

Environment in the sidebar manages organization-wide variables.

Common globals:

Variable	Example	Why
TZ	Europe/Berlin	Consistent timezone across containers
PUID / PGID	1000 / 1000	LinuxServer.io convention for file ownership
SMTP_HOST	mail.example.com	Shared email server across all apps
LOKI_URL	http://loki:3100	Shared log shipping
SENTRY_DSN	https://...	Shared error tracking

Host-scoped variables

Some variables should differ per environment. Tag globals with a host tag:

• DATABASE_HOST=prod-db.internal — only on hosts tagged prod
• DATABASE_HOST=staging-db.internal — only on hosts tagged staging
• LOG_LEVEL=debug — only on hosts tagged dev

Secrets

Any variable with a name matching *_PASSWORD, *_SECRET, *_TOKEN, *_KEY is stored encrypted at rest and masked in the UI by default. A Show secrets toggle (RBAC-gated) reveals the raw values.

For rotating secrets, edit in place — new deploys pick up the new value. Already-running containers need to be restarted.

For production secrets you don’t want in the dockmesh database at all, use Docker’s native secrets with an external secret store (Vault, SOPS, etc.) and reference them in your Compose file directly.

Import from .env file

Environment → Import accepts a standard .env file:

TZ=Europe/Berlin
PUID=1000
SMTP_HOST=mail.example.com
DATABASE_PASSWORD=s3cr3t

Lines starting with # are preserved as comments.

Export

Environment → Export dumps the current globals to a .env file for backup or migration to another dockmesh instance.

Using in Compose

Reference globals like any env var:

services:
  app:
    image: nginx
    environment:
      - TZ
      - PUID
      - DATABASE_URL=postgres://user:${DATABASE_PASSWORD}@db/app

Short form (- TZ) imports the variable by name from the environment. Long form with = uses interpolation.

Audit

Every change to a global variable is logged — who changed what, when, from where. Use this to trace “who changed the SMTP password at 2am”.

See also

• Stack Management — where stack-level vars are edited
• Audit Log — env var change history
• RBAC — env.read_secrets permission