Which file is read
docker compose reads the root .env and nothing else. It passes that file to
the backend and the agent containers, and passes the VITE_ values to the
frontend as build arguments.
The per-service files exist for running one service by hand:
A value in the wrong file gives you a stack that works one way and not the
other. Start with the root file.
Required
Nothing runs without these six.
Console mode needs the last three only.
Identity
The service token
One secret with two names. The agent sendsBACKEND_API_TOKEN, the backend
checks it against AGENT_SERVICE_TOKEN.
Set them with
openssl rand -hex 32. Without the pair the worker keeps its own
LiveKit credentials and the Calls page stays empty.
Console and API
Database and environment
Compose has a working default for each, so the root.env only needs them when
you point at a Postgres that is not the bundled one.
AGENT_PROMPT_FILE is set literally in docker-compose.yml and is not
overridable there. It has to name the mounted prompts directory, and pointing
it elsewhere writes a persona the worker never reads.