Skip to main content
Supply settings through the chart or your process environment. Restart affected processes after changes. Defaults below come from runtime declarations; feature-specific fallbacks are explained in the guides. Addresses, credentials and installation identifiers are supplied by you. Internal hosting, billing, build and authentication-bypass settings are outside this reference. Start with Configuration or expand a group below.

​
Database and storage

Database timeouts use seconds. S3 timeouts use milliseconds. Supply connection addresses and credentials for your installation. S3_* credentials and region override the corresponding AWS_* fallbacks.

​
Authentication

Use single-tenant mode. Keep installation identity, session secret and SSO provider ID stable. OIDC admits unmatched users as members unless SSO_DEFAULT_ROLE is deny. See the authentication guide before enabling SSO-only login.

​
Networking and transfers

Allowed origins are comma-separated. Byte limits apply independently: multipart routing, archives and the reusable-file quota. Set the public HTTPS origin through SERVER_BASE_URL and BETTER_AUTH_URL where required by your proxy topology.

​
Worker execution

Worker pool polling, leases and webhook timings use milliseconds. SCRIPT_* and TEMPLATE_RENDER_LIMIT_MS timeouts use milliseconds; script memory uses bytes. Health heartbeat timings use milliseconds. Synchronous script limits are clamped against the liveness budget.

​
Outbound webhooks

Delivery timeouts, polling, leases and retry schedules use milliseconds; retention uses days. Configure endpoint URLs and signing secrets in Studio. Private destinations require single-tenant mode and remain subject to blocked-address checks.

​
Agent sandboxes

SANDBOX_PROVIDER accepts e2b, docker or remote; unset selects E2B. Configure sandbox settings on app and worker. Builder sessions require E2B. Builder mounts require a scoped credential issuer. Credential TTL defaults to 3600 seconds; longer explicit values require issuer support.

​
Agent Git server

Agents need a Git server; EIGENPAL_AGENTS_ENABLED=false hides them and refuses agent runs on installations without one. Run the Git server separately with persistent repository storage. AGENT_GIT_BASE_URL belongs to its callers; port, host, storage root and command limits belong to the Git server. Keep operator credentials private and identical where used.

​
Logs and tracing

Collect audit logs from stdout. Product telemetry and OpenTelemetry tracing have separate switches. Provide collector endpoints and authentication for your installation.

​
Single-node storage

Fresh evaluation installations use embedded storage. Select external explicitly for AWS S3 or another S3-compatible service. The persisted selection prevents accidental backend changes on restart.

​
Maintenance and integrations

CRON_SECRET authenticates scheduled maintenance. Configure promotion callbacks through Helm notifications. FILE_SOURCE_INTEGRATIONS is an explicit connector opt-in; GPFS requires gpfs. Provider credentials referenced by YAML can use your own variable names through configEnv.