Slotlock

Host a copy with our keys and logs.

• DATABASE_URL — postgres:// URL of a PostgreSQL 16 or newer database the container can reach, as a role that is not a superuser and has no BYPASSRLS: serve refuses one, since row-level security would not confine it. Without SLOTLOCK_MIGRATE_DATABASE_URL this role also applies the schema, so it must be able to create it.
• SLOTLOCK_AUTH_TOKEN — Optional bearer token for SLOTLOCK_TENANT, with read and write (never admin): at least 32 random characters (openssl rand -hex 32). Leave it unset to accept only API keys (slotlock key create).
• SLOTLOCK_CONFIRMATION_SECRET — Signs pending write confirmations: at least 32 random characters, different from the token. Required unless SLOTLOCK_CONFIRM_WRITES is none.
• SLOTLOCK_METRICS_TOKEN — Serves Prometheus metrics at /metrics to this bearer token: at least 32 random characters, different from every other secret. Off without it.
• PORT — Port the server listens on inside the container.
• SLOTLOCK_MIGRATE_DATABASE_URL — postgres:// URL of the schema owner. When set, migration runs as this role and grants the DATABASE_URL role only what it needs at runtime.
• SLOTLOCK_CONFIRM_WRITES — Writes that wait for a person to confirm them: none, all, or a comma-separated list of slotlock_create_event, slotlock_book_together, slotlock_book_pool, slotlock_update_event, slotlock_delete_event. Clients without MCP 2026-07-28 form elicitation have guarded writes refused.
• SLOTLOCK_AVAILABILITY — JSON array of weekly bookable-hours rules, e.g. [{"rrule":"FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR","startMinutes":540,"durationMinutes":480}]. Without rules no slot is ever offered.
• SLOTLOCK_REST_API — on: also serve the tools as a REST API under /v1, and the application API (resources, bookable hours, holds, reservations, coverage, maintenance) for admin keys, described by an OpenAPI 3.1 document at /openapi.json. Writes that wait for confirmation answer 428 there. off: MCP and A2A only.
• SLOTLOCK_RETENTION_DAYS — Days of history kept: the change feed (who made each change included) and how far back a cursor reaches, and ended waitlist entries; retried writes are answered for at least 30 days whatever it is. 1-3650; default 30.
• SLOTLOCK_SHARED_LIMITS — on: tenant request budgets (SLOTLOCK_LIMITS' tenant_* and app_*) are shared by every server of a deployment through PostgreSQL, so N servers allow a tenant its rate once, not N times. off: each server keeps its own.
• SLOTLOCK_WEBHOOKS — on: deliver each tenant's changes to its webhooks (POST /v1/webhooks), signed as Standard Webhooks; never to a private network address. private: those too, for testing. off: keep the change feed (GET /v1/changes), send nothing.
• SLOTLOCK_TENANT — The tenant SLOTLOCK_AUTH_TOKEN acts in; API keys act in their own tenant.