Deploy App
Git credentials and environment variables
Deploy from private repositories with a saved token, and give your app its .env — without either being stored on your server.
Private repositories: Git credentials
A private repository needs a login. Save it once under Deploy App → Git credentials and pick it when you create an app.
A credential is a username and a personal access token for one Git host. Create a read-only token that can only see the repositories you deploy:
| Host | Where | What to choose | Username |
|---|---|---|---|
| GitHub | Settings → Developer settings → Fine-grained tokens | Only the repos you deploy · Contents: Read-only | Your GitHub username |
| GitLab | Preferences → Access tokens (or a project access token) | read_repository | Your GitLab username (any text for a project token) |
| Bitbucket | Repository settings → Access tokens | Read | x-token-auth |
How the token is protected
- It's stored encrypted in the panel and never shown again — only its last four characters.
- It's never saved on your server. For each fetch it's handed to git in memory over the SSH connection and gone when the fetch ends. It isn't in the repository's settings, in any file, or in the process list.
- It's only ever sent to the host it was saved for: a GitHub token is never sent to another address.
- The chatbot can pick a saved credential by name but never sees the token.
When a token expires, the next deploy fails with "The Git host refused the saved credential". Open Git credentials → Replace token.
Environment variables (.env)
Paste your .env on the app's Environment tab, or in the New app form. We
keep each value encrypted and show it masked; Owners and Admins can reveal one
value at a time.
- On the server they're a normal
.envfile at the project root (/var/www/<domain>/app/.env), rewritten on every deploy so it always matches this tab. Only root and the app itself can read it. Node, Next.js, PHP and Laravel apps also see it inside their container (read-only), so apps that read a.envfile work. Static and React sites don't: their files are public, so a.envthere could be downloaded. The file is never copied into the image. (Git tokens, unlike.envvalues, are never stored on the server.) NEXT_PUBLIC_…,VITE_…andREACT_APP_…variables are public. These frameworks copy them into the JavaScript sent to every visitor. Never put a secret in them.PORTis set by the panel to the app's port. Change the port in Settings.- One value per line. For something multi-line, like a private key, base64-encode it and decode it in your app.
Applying a change. Next.js and React / Vite read variables while building, so press Deploy. Everything else just needs Restart with current settings (no rebuild).
The chatbot can list your variables' names and remove variables, but never reads or sets values: paste them on the Environment tab.