> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firetone.com.au/llms.txt
> Use this file to discover all available pages before exploring further.

# Every setting

> The FIRETONE_* environment the daemon reads.

## Required

| Variable                    | What it is                                                |
| --------------------------- | --------------------------------------------------------- |
| `FIRETONE_DATABASE_URL`     | PostgreSQL connection string                              |
| `FIRETONE_JWT_SECRET`       | Signs panel sessions                                      |
| `FIRETONE_PROVISION_SECRET` | Guards the directory endpoint, which serves SIP passwords |

## Strongly recommended

| Variable                   | Without it                                                              |
| -------------------------- | ----------------------------------------------------------------------- |
| `FIRETONE_SECRET_KEY`      | Provider credentials cannot be stored; virtual agents fall back to echo |
| `FIRETONE_PIN_PEPPER`      | Agent PIN sign-in is disabled                                           |
| `FIRETONE_TRUSTED_PROXIES` | Per-IP rate limits collapse onto the proxy's address                    |

## Listeners

| Variable                                         | Notes                            |
| ------------------------------------------------ | -------------------------------- |
| `FIRETONE_API_LISTEN`                            | The panel and API                |
| `FIRETONE_API_ORIGINS`                           | Allowed browser origins          |
| `FIRETONE_API_TLS_CERT` / `FIRETONE_API_TLS_KEY` | Both or neither                  |
| `FIRETONE_ESL_LISTEN`                            | Refuses `0.0.0.0`                |
| `FIRETONE_PROVISION_LISTEN`                      | Refuses `0.0.0.0`                |
| `FIRETONE_MEDIASTREAM_LISTEN`                    | Refuses `0.0.0.0`                |
| `FIRETONE_REDIS_URL`                             | Shared state across nodes        |
| `FIRETONE_WSS_URL`                               | Where browser softphones connect |

## Node and tenancy

`FIRETONE_NODE_ID`, `FIRETONE_ESL_NODE_ADDR`, `FIRETONE_ESL_NODE_PASSWORD`,
`FIRETONE_SIP_DOMAIN`, `FIRETONE_SIP_ALT_DOMAINS`, `FIRETONE_SINGLE_TENANT`.

## Provisioning the switch

| Variable               | What it is                                            |
| ---------------------- | ----------------------------------------------------- |
| `FIRETONE_FS_CONF_DIR` | FreeSWITCH's configuration directory **on this host** |

Setting it is you asserting the switch is co-hosted; it is never inferred.

<Warning>
  Without it the daemon computes what the switch should run and applies **none**
  of it. A register-mode trunk never registers, and the carriers ACL is never
  written — so adding an address under a trunk's ACL hosts changes the database
  and nothing else, and that carrier stays refused. The trunk's page reports
  *"configuration has not reached its switch"*, which is true and, until the
  variable is set, unfixable.
</Warning>

The unit must also be allowed to write there. `install-service.sh` reads this
variable and adds the three generated directories to `ReadWritePaths`;
`ProtectSystem=strict` makes everything else read-only whatever the ownership
says, so a chown alone is not enough.

## Paths

`FIRETONE_DATA_DIR`, `FIRETONE_MEDIA_DIR`, `FIRETONE_RECORDINGS_DIR`,
`FIRETONE_VOICEMAIL_DIR`, `FIRETONE_AGENT_AUDIO_DIR`.

## AI and tuning

`FIRETONE_OPENAI_URL`, `FIRETONE_GEMINI_URL`, `FIRETONE_AGENT_HOLD_DELAY_MS`,
`FIRETONE_PLAYBACK_LEAD_MS`, `FIRETONE_LOG_LEVEL`.

## Development only

`FIRETONE_DEV_CARRIER=true` is read by the **node install script**, not by the
daemon, and installs a simulated carrier so calls can be placed with no real
provider. The provider URL overrides above point the AI clients at a local
double.

<Warning>
  Neither belongs in a real deployment. The daemon logs a warning when a
  provider URL is overridden, and the install script prints which carrier
  configuration it installed — read that line rather than assuming.
</Warning>