> ## Documentation Index
> Fetch the complete documentation index at: https://docs.eigenpal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure EigenPal

> Choose where settings belong and connect a model provider.

EigenPal reads process settings from environment variables and model connections from `eigenpal.config.yaml`. Helm mounts the YAML file and supplies environment variables to each workload.

## Add a model

Add this to your Helm values. Replace the model and endpoint with values your gateway supports:

```yaml theme={null}
config:
  models:
    - id: openai-compatible/company-model
      source: openai-compatible
      provider: openai-compatible
      model: company-model
      baseUrl: https://llm.example.com/v1
      apiKey: ${LLM_API_KEY}
      roles: [workflowStep, workflowBuilder, agentInference]
configEnv:
  - name: LLM_API_KEY
    valueFrom:
      secretKeyRef:
        name: model-credentials
        key: api-key
```

`configEnv` reaches both app and worker. Use `app.extraEnv` or `worker.extraEnv` for a setting that belongs to one process. Use a dedicated chart key when one exists.

The first model assigned to a role is its default. Assign only roles the model supports. Scanned documents need an OCR or vision provider too; see [model fields](https://docs.eigenpal.com/self-hosting/yaml-reference.md#language-models).

## Keep secrets and access local

Store credentials in Kubernetes Secrets or your secrets manager. Configure API keys, webhook endpoints, email servers, groups and sharing in Studio, separately for each environment.

Keep `EIGENPAL_SECRETS_WRAPPING_KEY` stable and identical on app and worker. It must decode to 32 bytes in base64url format. Back it up with the database: changing it can make stored integration credentials unreadable.

Restart affected pods after changing process settings, provider YAML or mounted credentials.

## Configuration details

> [accordion] File loading and precedence
>
> Set `EIGENPAL_CONFIG_PATH` to the mounted YAML file. Without it, the loader searches the working directory, `config/` and parent directories. The chart supplies an explicit path.
>
> `${VARIABLE_NAME}` interpolates an environment variable within a YAML string. Shell syntax such as `${NAME:-default}` is unsupported. Supply every referenced variable.
>
> Overrides depend on the setting:
>
> * `S3_REGION`, `S3_ACCESS_KEY` and `S3_SECRET_KEY` override their `AWS_*` fallbacks.
> * `EIGENPAL_MULTIPART_MAX_BYTES` overrides `deployment.multipartMaxBytes`; `none`, `null` and `unlimited` keep transfers on the app server.
> * `EIGENPAL_ARCHIVE_MAX_BYTES` overrides `deployment.archiveMaxBytes`.
> * Provider environment variables supply credentials; models still need registry entries.
>
> Use the [Helm reference](https://docs.eigenpal.com/self-hosting/helm-values.md) for chart defaults and the [environment reference](https://docs.eigenpal.com/self-hosting/environment-variables.md) for process defaults.

> [accordion] Model roles and parsing
>
> Roles are `workflowStep`, `workflowBuilder`, `agentInference`, `agentTraining`, `judge`, `vision` and `ocr`. OCR entries use `kind: ocr`; LLM entries cannot take the `ocr` role. Model IDs must be unique. `capabilityRank` sorts the picker without changing role defaults.
>
> `deployment.parsing.ocrProvider` and `visionProvider` select model IDs. `allowedProviders` also contains model IDs, despite its name. Provider credentials, timeouts and supported fields are in the [YAML reference](https://docs.eigenpal.com/self-hosting/yaml-reference.md).

> [accordion] External file sources
>
> ```yaml theme={null}
> fileSources:
>   incoming-documents:
>     type: s3
>     region: eu-central-1
>     allowedContainers: incoming
>     accessKeyId: ${SOURCE_ACCESS_KEY_ID}
>     secretAccessKey: ${SOURCE_SECRET_ACCESS_KEY}
> ```
>
> Add this under `config`, and expose the credentials through `configEnv`. A connection in YAML is read-only in Studio. Omit it to manage that connection in Studio instead.
>
> Configure the same connection name in each environment that runs the workflow, with local endpoints and credentials. Promotion checks that the connection exists and leaves its credentials local.
>
> S3-compatible storage, Azure Blob and GPFS/GFR have [provider-specific fields](https://docs.eigenpal.com/self-hosting/yaml-reference.md#file-sources). GPFS also requires `FILE_SOURCE_INTEGRATIONS=gpfs` on app and worker.

> [accordion] File transfers and limits
>
> `EIGENPAL_DIRECT_FILE_UPLOADS=true` enables storage-direct transfers. Configure bucket CORS and `EIGENPAL_BROWSER_STORAGE_ORIGINS` for browser access. The origin setting does not configure CORS on the bucket.
>
> The chart sets `deployment.multipartMaxBytes: null`. Without a chart or environment override, the app falls back to 4.5 MiB. The archive fallback is 5 GiB. `EIGENPAL_REUSABLE_FILES_MAX_BYTES=0` disables the reusable-file quota; upload and archive limits still apply.
>
> Limits ending in `BYTES` use bytes; timeouts ending in `MS` use milliseconds. Database timeouts use seconds. Kubernetes resources use units such as `Mi`, `Gi` and millicores.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.