Environment variables

The White Tree Digital website has exactly two kinds of configuration, and the line between them is the whole story: build-time PUBLIC_* values that get inlined into the JavaScript bundle when Astro builds, and runtime secrets the Cloudflare Worker reads fresh on each request. The first kind is fine to ship to the browser; the second must never appear in a bundle, a commit, or a PUBLIC_ name.

This page lists every variable, what it's for, where it lives locally, where it mirrors in production, and the one constant — the GTM container ID — that is deliberately not a variable at all. Deploy mechanics (how these reach the Cloudflare Workers dashboard, the two-build split) are covered in Deployment and the Two-build split page; this page is about the variables themselves.

The two layers

There is no .env file that holds "all the config." Configuration is split by when it is read and who is allowed to see it:

Both files are gitignored. Astro inlines anything prefixed PUBLIC_ (and the build switches) directly into the output at build time, so those values are baked into static HTML/JS and reach every visitor's browser. Secrets are read by the running Worker at request time from cloudflare:workers env, so they stay server-side.

Build-time public variables (.env)

These live in website/.env (copy website/.env.example and fill it) and are read anywhere with import.meta.env.PUBLIC_*. They are typed in website/src/env.d.ts.

The HubSpot IDs are intentionally public — the audit form's submit is still client-side, so the portal ID and form GUID ship in client JS by design (the HubSpot page covers the submit path). PUBLIC_SITE_URL is normalized so a stray trailing slash can't produce double-slash canonicals:

// website/src/lib/site.ts
export const siteUrl = (import.meta.env.PUBLIC_SITE_URL ?? '').replace(/\/+$/, '');

if (!import.meta.env.PUBLIC_HUBSPOT_PORTAL_ID || !import.meta.env.PUBLIC_HUBSPOT_AUDIT_FORM_ID) {
  console.error('[hubspot] PUBLIC_HUBSPOT_PORTAL_ID / PUBLIC_HUBSPOT_AUDIT_FORM_ID not set — lead not submitted');
  throw new Error('hubspot-env-missing');
}

Build switches

Two more build-time values are not content IDs but toggles that pick which of the two deployments you're producing. They're inlined as literals so the unused branch is dead-code-eliminated.

Both are documented inline in website/src/env.d.ts and consumed in website/src/layouts/Layout.astro:

// Layout.astro — staging mirror (or any workers.dev host) must not be indexed
const noindex =
  import.meta.env.PUBLIC_NOINDEX === 'true' || Astro.url.hostname.endsWith('.workers.dev');

Because BUILD_TARGET is inlined to a literal, import.meta.env.BUILD_TARGET !== 'static' short-circuits to false in the static build, so the draft-cookie read and the VisualEditing overlay are eliminated entirely from the public bundle.

Runtime secrets (.dev.vars)

These live in website/.dev.vars locally (the Cloudflare adapter auto-loads .dev.vars in dev, mirroring CF Pages behavior) and are read at request time via the cloudflare:workers module. They are typed on the Env interface in website/src/env.d.ts.

The read pattern is consistent across the server routes — cloudflare:workers env first, with an import.meta.env fallback so it also resolves in contexts where the value comes through Astro's env:

// website/src/pages/api/audit.ts
import {env} from 'cloudflare:workers';
const psiKey = env.PSI_API_KEY ?? import.meta.env.PSI_API_KEY;
if (!psiKey) return json({error: 'config'}, 500);

The same shape appears in website/src/middleware.ts, website/src/pages/api/draft-mode/enable.ts, and website/src/lib/sanity-draft.ts for SANITY_API_READ_TOKEN.

The PSI key footgun

PSI_API_KEY is a recent migration: it used to be PUBLIC_PSI_API_KEY (client-side) and is now a server secret because the audit moved server-side to /api/audit. Two consequences from the move (tracked in TODO.md):

• In Google Cloud Console the key's Application restriction must be "None", not "Websites" (HTTP referrers). The server-side call sends no Referer header, so a referrer-restricted key returns 403 "Requests from referer <empty> are blocked" — PSI silently returns nothing and every speed check degrades to unknown. Secrecy (it's a server secret now) is the protection; the old referrer rule only made sense when the key shipped in client JS.
• Don't leave a stale PUBLIC_PSI_API_KEY around — nothing reads it anymore. The live read is env.PSI_API_KEY.

The audit tool pages cover how the key feeds the checks.

Why GTM is hardcoded, not an env var

The Google Tag Manager container ID is GTM-5NDTZBHF, written directly into both the <script> and <noscript> snippets in website/src/layouts/Layout.astro. It is deliberately not an environment variable.

<!-- Layout.astro (noscript fallback) -->
<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-5NDTZBHF" ...></iframe>

The reasoning: the container ID is constant per site, and an env-driven value that silently fails to load on a misconfiguration is worse than a hardcoded constant — a missing analytics tag is invisible until you go looking for lost data. GTM is also the sole injection point for analytics on this site: GA4, the HubSpot tracking pixel, and consent tags are all configured inside the GTM container, not added as separate tags or env vars in code.

Where each variable lives in production

Local files have a production mirror. The full deploy procedure is in Deployment and the Launch operations runbook — the mirror map is summarized here. Values differ between the public and staging Workers (per the two-build split).

The two PUBLIC_* build vars and the build switches go in the dashboard as plaintext variables; SANITY_API_READ_TOKEN and PSI_API_KEY go in as encrypted Secrets (never plaintext — they are real secrets). Studio-side variables (SANITY_STUDIO_PREVIEW_URL, the deploy-hook URL) live in studio/.env.production and are baked into the Studio bundle at deploy time — see Visual editing and Deployment.

Where this lives

• website/.env — build-time PUBLIC_* values (gitignored).
• website/.env.example — the template to copy.
• website/.dev.vars — runtime secrets for local dev (gitignored).
• website/src/env.d.ts — types for both layers; documents BUILD_TARGET / PUBLIC_NOINDEX and the cloudflare:workers Env interface.
• website/src/lib/site.ts — normalizes PUBLIC_SITE_URL.
• website/src/layouts/Layout.astro — the hardcoded GTM-5NDTZBHF ID and the PUBLIC_NOINDEX / BUILD_TARGET reads.
• website/src/pages/api/audit.ts, website/src/pages/api/draft-mode/enable.ts, website/src/middleware.ts, website/src/lib/sanity-draft.ts — the cloudflare:workers env reads for the secrets.
• website/src/components/audit/hubspot.ts — the fail-fast guard on the HubSpot public IDs.
• website/CLAUDE.md ("Environment") and _TWO-BUILD-OPERATIONS.md (§6) — the authoritative prose and the per-deployment var table.
• TODO.md — the PSI-key migration checklist and restriction-must-be-"None" note.