Environment variables

Required on the control-plane host

Variable	Meaning
`TINY_TOKEN_SECRET`	platform token-signing seed
`TINY_SECRET_KEY`	envelope-encryption root key
`TINY_SESSION_SECRET`	gateway session and OIDC-state secret
`TINY_BROKER_URL`	public HTTPS control-plane URL used by workloads
`TINY_FIRECRACKER_KERNEL`	guest kernel path
`TINY_FIRECRACKER_ROOTFS`	read-only base rootfs path

TINY_SECRET_KEY is the root of all sealed connection credentials and secrets. Losing it makes them unrecoverable; leaking it compromises all of them.

Ingress and authentication — pick one mode

Single-host mode	Hosted / wildcard mode
`TINY_PUBLIC_URL=https://cloud.example.com`	`TINY_APP_DOMAIN=apps.example.com`
`TINY_LOCAL_AUTH_EMAIL`	`TINY_OIDC_ISSUER`
`TINY_LOCAL_AUTH_PASSWORD`	`TINY_OIDC_CLIENT_ID`
Apps route below `/apps/…`	`TINY_OIDC_REDIRECT_URI`

TINY_OIDC_CLIENT_SECRET is optional for public clients and required when the provider expects a confidential client. Single-host mode is what tools/setup-cloud.sh produces.

TINY_MODE and TINY_ALLOW_DEV_LOGIN are not supported. createControlPlane() refuses insecure development defaults.

Server options

Variable	Default	Meaning
`TINY_DATA_DIR`	`.tiny/control-plane`	database, artifacts, and instance state
`TINY_API_PORT`	`8787`	control-plane port
`TINY_GATEWAY_PORT`	`8080`	embedded gateway port
`TINY_BIND_HOST`	`0.0.0.0` in production	API and gateway bind address

Firecracker

Variable	Default	Meaning
`TINY_FIRECRACKER_BIN`	`/usr/bin/firecracker`	VMM executable
`TINY_FIRECRACKER_JAILER`	`/usr/bin/jailer`	jailer executable
`TINY_FIRECRACKER_UID`	`10000`	jailer UID
`TINY_FIRECRACKER_GID`	`10000`	jailer GID
`TINY_FIRECRACKER_BROKER_PORT`	`8787`	guest destination allowed by host nftables
`TINY_FIRECRACKER_SERIAL_TELEMETRY`	`true`	mirror guest logs and usage to the VM serial console

Builds — optional

Variable	Default	Meaning
`TINY_FIRECRACKER_BUILD_ROOTFS`	unset	build image path; builds are unavailable without it
`TINY_BUILD_MEMORY_MIB`	`2048`	build VM memory
`TINY_BUILD_CPU_MILLIS`	`2000`	build VM CPU
`TINY_BUILD_DISK_MIB`	`4096`	build VM disk, which must hold `node_modules`

Postgres — optional

Variable	Default	Meaning
`TINY_POSTGRES_ADMIN_URL`	unset	admin URL able to `CREATE ROLE` and `CREATE DATABASE`
`TINY_POSTGRES_STATEMENT_TIMEOUT_MS`	`15000`	server-side statement timeout for application sessions

Direct egress — optional, off by default

Variable	Default	Meaning
`TINY_FIRECRACKER_ALLOW_EGRESS`	unset	set to `true` to honour `network.egress.mode: allowlist`
`TINY_EGRESS_RESOLVER`	`1.1.1.1`	the single DNS resolver an egress-enabled guest may reach

CLI and MCP clients

Variable	Meaning
`TINY_API_URL`	remote control-plane URL, below an explicit `--api` flag
`TINY_TOKEN`	bearer token, below an explicit `--token` flag
`TINY_CONFIG`	credential-file path instead of `~/.tiny/credentials.json`

Testing

Variable	Meaning
`TINY_TEST_POSTGRES_URL`	a throwaway cluster whose role may `create role` and `create database`; enables `tests/postgres-live.test.ts`
`TINY_SETUP_PASSWORD`	non-interactive `tools/setup-cloud.sh`

Reserved namespace

TINY_* is reserved for platform configuration delivered to the guest. A manifest that declares a secret in that namespace is rejected at validation, so nothing an app declares can shadow a platform variable.

​Required on the control-plane host

​Ingress and authentication — pick one mode

​Server options

​Firecracker

​Builds — optional

​Postgres — optional

​Direct egress — optional, off by default

​CLI and MCP clients

​Testing

​Reserved namespace

Required on the control-plane host

Ingress and authentication — pick one mode

Server options

Firecracker

Builds — optional

Postgres — optional

Direct egress — optional, off by default

CLI and MCP clients

Testing

Reserved namespace