Coolify: keep its .env values in a Read-only context

Coolify's docker-compose.prod.yml gives /data/coolify/source/.env to the Coolify container twice: through env_file:, and as a bind mount at /var/www/html/.env. The install and upgrade scripts start Coolify with docker compose --env-file on the same file. Coolify needs a real file, so it stays on disk while Coolify runs. Automatic updates run without you, so they need it too.

The scripts also edit the file. They add names a new version needs and fill some empty ones. First they save a dated plaintext copy next to it.

bash
ls -l /data/coolify/source/.env*

Only the owner sets Read-only values, in the dashboard. Copy the file to your machine, then open the project, pick Production, and choose Import, From a .env file. Values are encrypted in the browser. Delete the local copy after.

bash
scp root@your-server:/data/coolify/source/.env ./coolify.env
# import coolify.env in the dashboard, then:
rm ./coolify.env

APP_KEY encrypts values in Coolify's database. Keep it exactly as it is.

In Project settings, Tokens, create a server token for Production with the server's IP. The server needs Node 24 or newer for npx. On the server, as root, write the file and then run Coolify's usual upgrade command:

bash
export GETMYENV_TOKEN=...   # server token for Production
npx getmyenv export -c production -o /data/coolify/source/.env --yes
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

The file is plaintext. export keeps the owner of an existing file and makes it readable only by that owner. The token holds Production's key, so the server never asks for a Vault password.

Run export without --yes. If the file differs, it lists names only in the file and values that differ, never the values, and asks before it writes. Answer no.

bash
npx getmyenv export -c production -o /data/coolify/source/.env

Add new names to Production, and update the values that changed. Otherwise the next export with --yes writes the old ones back. Then delete the dated copies the scripts left, named .env- plus a date.

bash
export GETMYENV_MACHINE_LABEL=coolify-1   # name shown on the Requests page

The token reads only from the IPs you allowed. If the machine connects over IPv6, add its IPv6 range too, like 2001:db8::/64. With Ask me, the first export from the server waits for your approval on Requests. A machine's request waits up to 5 minutes for approval. Approval gives a machine a one-time grant for 1 hour. Trust the machine to skip approval next time.