Environment Variables and Secrets
Audience: Deployment Administrator, System Admin Related: Raspberry Pi · Gcp · Configuration · Security And Scoping
Store deployment-specific secrets and environment overrides in /etc/blackcap/blackcap.env or another root-protected environment file referenced by systemd. The checked-in INI example contains placeholders and non-secret defaults; it is not an appropriate location for production database passwords, provider keys, SMTP passwords, OAuth secrets, or DNS credentials.
PostgreSQL deployments should normally provide BLACKCAP_DATABASE_URL through the environment. Provider credentials configured through the application are stored using the application’s protected configuration model. Examples in documentation use blackcap.example.com and must never be copied from a live deployment.
Common locations
| Item | Raspberry Pi | GCP |
|---|---|---|
| Application | /home/pi/Blackcap-Pi |
/opt/Blackcap |
| Virtual environment | /home/pi/inky_env |
/opt/blackcap_env |
| Environment file | /etc/blackcap/blackcap.env |
/etc/blackcap/blackcap.env |
| Runtime data | Application data/ by default |
/var/lib/blackcap |
| GeoIP data | Application data/geoip/ |
/var/lib/blackcap/geoip/ |
Protect secret files with root ownership and restrictive permissions.