OmniDock GitHub

$ man omnidock/runtime-secrets

OmniDock Runtime Variables and Secrets

Set OmniDock runtime variables and Worker secrets for admin password, Cloudflare API token, primary domain, management host, password reset sender, and external email credentials.

Secrets

Secrets are sensitive values that must not be committed, stored in D1 as plaintext, or written to browser storage.

SecretUse
ADMIN_PASSWORDInitial admin password. The app should store a salted PBKDF2 hash in D1.
CLOUDFLARE_API_TOKENCloudflare sync, routing checks, and rule automation. Use least privilege.
External account secretsGmail app passwords or OAuth/provider credentials referenced by external account metadata.

Plaintext runtime variables

VariableUse
PRIMARY_DOMAINFirst managed email domain. This is not a secret.
MANAGEMENT_HOSTCustom dashboard host such as mail.example.com or dock.example.com.
PASSWORD_RESET_FROMVerified sender address for reset emails, if password reset is enabled.
WORKER_SCRIPT_NAMENeeded by rule automation when the script name differs from defaults.

External account credentials

The UI should collect provider metadata and secret reference names, not raw passwords. D1 stores the email account metadata, provider settings, sync state, last error, and secret reference. The actual credential value stays in Worker secrets.