Environments and secrets

Credentials are never stored in the flows. Each application keeps one env file per environment, in its own folder:

applications/<app>/envs/<environment>.env

The environment selected in the sidebar footer is the one every run uses, and the Applications page lets you edit those files — variable by variable, or as raw text — without leaving the UI.

PostgreSQL

The PostgreSQL client accepts either a connection string or individual parameters:

DATABASE_CONNECTION_STRING=postgres://user:password@host:5432/database

# …or
PGUSER=myuser
PGPASSWORD=mypassword
PGHOST=localhost
PGPORT=5432
PGDATABASE=mydatabase
PGQUERY_TIMEOUT=30000

DATABASE_CONNECTION_STRING wins when both are present. SSL is configured with PGSSL_ENABLED, PGSSL_REJECT_UNAUTHORIZED, PGSSL_CA, PGSSL_CERT and PGSSL_KEY.