Variáveis e referências
Service variables, shared variables, `${{Service.VAR}}` references between services, and the SKIFFLY_* built-ins every container gets.
Variables are stored per environment, either for one service or shared by every service in the environment. Service variables win over shared ones with the same name. Values are encrypted at rest and injected into the container as environment variables at deploy time.
Service → Variables. Shared variables live under the environment's Shared variables. The raw editor accepts .env-style text for bulk edits.
References#
A value can point at another variable instead of repeating it:
| Syntax | Meaning |
|---|---|
${{Postgres.DATABASE_URL}} | variable DATABASE_URL of the service named Postgres (name, slug or id all work) |
${{shared.REGION}} | shared variable REGION of the environment |
${{Postgres.SKIFFLY_PRIVATE_DOMAIN}} | a built-in of another service |
https://${{self.SKIFFLY_PUBLIC_DOMAIN}} | self inside templates and @skiffly/config: the service being defined |
References resolve at deploy time, recursively (a variable that references a variable that references a built-in works). Each service is rendered with its own environment, so the same reference gives the staging database in staging and the production one in production. Unresolvable references become an empty string and a warning in the deployment log.
skiffly variables set 'DATABASE_URL=${{Postgres.DATABASE_URL}}' 'REDIS_URL=${{Redis.REDIS_URL}}'The templates for Postgres, MySQL, Redis and MongoDB already expose DATABASE_URL, MYSQL_URL, REDIS_URL and MONGO_URL built from their own credentials and private hostname, so an app usually needs one reference per database.
Built-in variables#
Every container gets these, and other services can reference them:
| Variable | Value |
|---|---|
PORT | the port the service must listen on |
SKIFFLY_PUBLIC_DOMAIN | first public domain of the service (api-x1y2.skiffly.cloud or a verified custom domain); unset without a domain |
SKIFFLY_PRIVATE_DOMAIN | hostname on the private network (api) |
SKIFFLY_SERVICE_NAME, SKIFFLY_SERVICE_ID | service name and id |
SKIFFLY_PROJECT_ID | project id |
SKIFFLY_ENVIRONMENT, SKIFFLY_ENVIRONMENT_ID | environment slug (production, pr-42) and id |
SKIFFLY_DEPLOYMENT_ID | id of the running deployment |
SKIFFLY_GIT_COMMIT_SHA | commit that was built (repository services) |
PORT, SKIFFLY_DEPLOYMENT_ID, SKIFFLY_PUBLIC_DOMAIN and SKIFFLY_GIT_COMMIT_SHA are set on the service itself; when referenced from another service (${{api.SKIFFLY_PUBLIC_DOMAIN}}) they resolve from that service's current state.
Secrets#
Variables are stored encrypted (AES-256-GCM) and shown in the dashboard only to workspace members. The CLI masks values in tables and prints them only with --kv/--json; the MCP server's list-variables returns names unless the agent asks for values. In config as code use preserve() and generate() so secrets never end up in the file.