env_audit_apr2026
Env Audit: /root/config/.env — April 2026
Written: 2026-04-11 01:15 MSK (Feanor worker, auto-level)
Verified: no scripts use the stale keys (grep across /root/scripts/, /root/claude-tg/ = 0 matches)
Summary
28 environment variables total. 4 confirmed stale (safe to remove). 4 uncertain (need Daniil to confirm).
Confirmed Stale — Can Remove
| Key | Why Stale |
|---|---|
FLIGHTS_AVIASALES_API_TOKEN |
VPS IP blocked by Aviasales captcha — confirmed in MEMORY.md. Flights now via fli-mcp (Google Flights) + kiwi MCP. Zero script usage. |
FLIGHTS_AVIASALES_MARKER |
Same as above — Aviasales affiliate marker, unused. |
MAX_PROACTIVE_DAILY |
Old pulse system config (replaced by heartbeat Mar 2026). Zero script usage. |
QUIET_HOURS_START / QUIET_HOURS_END |
Pulse-era quiet hours config. Heartbeat uses hardcoded night mode (23:00-07:59 MSK). Zero script usage. |
PROACTIVE_INTERVAL_MINUTES |
Pulse interval config. Heartbeat uses cron (30 min). Zero script usage. |
Total: 6 variables safe to remove.
Active and Necessary
| Key | Used By |
|---|---|
CLAUDE_TG_TRIGGER_PORT |
claude-tg bot, curl triggers (9357) |
TELEGRAM_BOT_TOKEN |
claude-tg bot |
TELEGRAM_CHAT_ID |
claude-tg, heartbeat DIRECT messages |
TELEGRAM_API_ID / TELEGRAM_API_HASH |
Telegram MCP (ListDialogs, ListMessages) |
TELEGRAM_SESSION_STRING |
Telegram MCP session |
GOOGLE_CALENDAR_ID |
Google Calendar MCP |
GOOGLE_CREDENTIALS_PATH |
Google Calendar MCP |
TODOIST_TOKEN |
Todoist MCP |
OURA_ACCESS_TOKEN / OURA_CLIENT_ID / OURA_CLIENT_SECRET |
Oura MCP |
GARMIN_EMAIL / GARMIN_PASSWORD |
Garmin token refresh script (garmin_token_refresh.py) |
GARTH_TOKEN |
Garmin API (expires periodically, auto-refresh cron пн 4:00 UTC) |
JEFIT_USERNAME / JEFIT_PASSWORD |
Jefit MCP |
GROQ_API_KEY |
Whisper STT in claude-tg (voice→text ONLY, not for LLM) |
OBSIDIAN_PATH |
Silmaril MCP, vault operations |
VAULT_USER / VAULT_PASS |
rclone vault sync credentials |
TAVILY_API_KEY |
Tavily adapter (localhost:8000) — SearXNG wrapper, still used |
Uncertain — Confirm with Daniil
| Key | Question |
|---|---|
TAVILY_API_KEY |
SearXNG/Tavily adapter still uses real Tavily API? Or fully local now? |
GARTH_TOKEN |
Is the inline token still needed or is it redundant with garmin_token_refresh.py? |
Action Plan
-
Remove confirmed stale (6 vars):
FLIGHTS_AVIASALES_API_TOKEN,FLIGHTS_AVIASALES_MARKER,MAX_PROACTIVE_DAILY,QUIET_HOURS_START,QUIET_HOURS_END,PROACTIVE_INTERVAL_MINUTES
- These are zero-usage, confirmed by grep. Safe to remove after Daniil glances at the list.
- This saves ~1 line of env parsing per service start and reduces attack surface. -
Clarify Tavily: if SearXNG now fully replaces Tavily → remove
TAVILY_API_KEY(free the paid API account)
Note: .env format has no export prefix — correct for systemd EnvironmentFile. Scripts use set -a; source; set +a.