We do have a small patch applied to remove a mongo privilege escalation security risk: https://github.com/StarryInternet/genieacs/commit/e2861d63bb95cbbdcb7c0ff13135e2869b26fd3e
We have this deployed to a shared db cluster, and as a result we dont give admin privs to applications (which you need to run that command to get hostInfo). I commented on this problem in another thread: Remove dependency from db.hostInfo()
As for environment variables, these are the only ones we’re setting:
GENIEACS_CWMP_SSL_CERT
GENIEACS_CWMP_SSL_KEY
GENIEACS_UI_SSL_CERT
GENIEACS_UI_SSL_KEY
GENIEACS_MONGODB_CONNECTION_URL