A domain is only accepted when its suffix is public or one of a fixed list of reserved private TLDs, so a network that runs its own DNS under a TLD of its own could not finish the setup wizard, add its domains or sign in its directory's users. INBUXA_PRIVATE_TLDS names extra suffixes (comma or space separated, multi-label allowed) that is_valid_domain accepts alongside the built-in ones. It is read from the environment because the wizard runs before any configuration exists. tests/e2e/private_tlds.py boots the debug build and checks the wizard, a second domain, an account and its sign-in under a made-up TLD, and that the TLD is refused without the variable. Raised on the forum: https://community.coffeylabs.org/t/environment-settings-for-non-docker-install/94