> ## Documentation Index
> Fetch the complete documentation index at: https://docs.eigenpal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment variables

> Deployment settings by capability and process.

Supply settings through the chart or your process environment. Restart affected processes after changes. Defaults below come from runtime declarations; feature-specific fallbacks are explained in the guides. Addresses, credentials and installation identifiers are supplied by you. Internal hosting, billing, build and authentication-bypass settings are outside this reference.

Start with [Configuration](https://docs.eigenpal.com/self-hosting/configuration.md) or expand a group below.

## Database and storage

Database timeouts use seconds. S3 timeouts use milliseconds. Supply connection addresses and credentials for your installation. S3\_\* credentials and region override the corresponding AWS\_\* fallbacks.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `DATABASE_URL` | string | installation-specific | App, Worker, Git server |
> | `DATABASE_READ_REPLICA_URLS` | string | unset | App, Worker |
> | `DATABASE_POOL_SIZE` | integer | 10 | App, Worker |
> | `DATABASE_IDLE_TIMEOUT` | integer \| null | 20 | App, Worker |
> | `DATABASE_MAX_LIFETIME` | integer \| null | 1800 | App, Worker |
> | `DATABASE_CONNECT_TIMEOUT` | integer | 10 | App, Worker |
> | `DATABASE_QUERY_TIMEOUT` | integer | 30 | App, Worker |
> | `STORAGE_TYPE` | local \| s3 | "local" | App, Worker, Authentication |
> | `STORAGE_PATH` | string | installation-specific | App, Worker |
> | `S3_BUCKET` | string | unset | App, Worker |
> | `S3_REGION` | string | "us-east-1" | App, Worker |
> | `S3_ENDPOINT` | string | unset | App, Worker |
> | `S3_ACCESS_KEY` | string | unset | App, Worker |
> | `S3_SECRET_KEY` | string | unset | App, Worker |
> | `S3_CONNECTION_TIMEOUT_MS` | integer | unset | App, Worker |
> | `S3_SOCKET_TIMEOUT_MS` | integer | unset | App, Worker |
> | `S3_REQUEST_TIMEOUT_MS` | integer | unset | App, Worker |
> | `S3_MULTIPART_COMPLETE_TIMEOUT_MS` | integer | unset | App, Worker |
> | `S3_MAX_ATTEMPTS` | integer | unset | App, Worker |
> | `EIGENPAL_SECRETS_WRAPPING_KEY` | string | unset; feature-dependent | App, Authentication |
> | `EIGENPAL_SECRETS_WRAPPING_KEY_FILE` | string | unset; feature-dependent | App, Authentication |

## Authentication

Use single-tenant mode. Keep installation identity, session secret and SSO provider ID stable. OIDC admits unmatched users as members unless SSO\_DEFAULT\_ROLE is deny. See the authentication guide before enabling SSO-only login.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `EIGENPAL_TENANT_MODE` | single-tenant \| multi-tenant | "multi-tenant" | App, Worker, Git server, Authentication, Tracing |
> | `EIGENPAL_TENANT_ID` | string | unset; feature-dependent | App, Authentication |
> | `EIGENPAL_TENANT_NAME` | string | unset; feature-dependent | Authentication |
> | `EIGENPAL_ADMIN_EMAIL` | string | unset; feature-dependent | App, Authentication |
> | `EIGENPAL_ADMIN_PASSWORD` | string | unset; feature-dependent | App, Authentication |
> | `EIGENPAL_ADMIN_NAME` | string | unset; feature-dependent | App, Authentication |
> | `EIGENPAL_AUTH_METHODS` | string | "password" | App, Authentication |
> | `EIGENPAL_ALLOW_OPEN_SIGNUP` | true \| false | "false" | App |
> | `EIGENPAL_SIGN_OUT_URL` | string | unset; feature-dependent | App |
> | `BETTER_AUTH_SECRET` | string | unset; feature-dependent | App |
> | `BETTER_AUTH_URL` | string | unset; feature-dependent | App |
> | `SSO_ENABLED` | true \| false | "false" | App |
> | `SSO_PROTOCOL` | string | unset; feature-dependent | App |
> | `SSO_PROVIDER_ID` | string | unset; feature-dependent | App |
> | `SSO_PROVIDER_LABEL` | string | unset; feature-dependent | App |
> | `SSO_CLIENT_ID` | string | unset; feature-dependent | App |
> | `SSO_CLIENT_SECRET` | string | unset; feature-dependent | App |
> | `SSO_DISCOVERY_URL` | string | unset; feature-dependent | App |
> | `SSO_SCOPES` | string | "openid,profile,email" | App |
> | `SSO_ALLOWED_EMAIL_DOMAINS` | string | unset; feature-dependent | App |
> | `SSO_DEFAULT_ROLE` | string | unset; feature-dependent | App |
> | `SSO_LOGIN_URL` | string | unset; feature-dependent | App |
> | `SSO_SERVICE_URL` | string | unset; feature-dependent | App |
> | `SSO_APP_ID` | string | unset; feature-dependent | App |
> | `SSO_APP_SECRET` | string | unset; feature-dependent | App |
> | `SSO_USERINFO_PATH` | string | unset; feature-dependent | App |
> | `SSO_CLIENT_CERT_FILE` | string | unset; feature-dependent | App |
> | `SSO_CLIENT_KEY_FILE` | string | unset; feature-dependent | App |
> | `SSO_CA_BUNDLE_FILE` | string | unset; feature-dependent | App |
> | `SSO_ROLE_MAP` | string | unset; feature-dependent | App |
> | `SSO_GROUPS_CLAIM` | string | unset; feature-dependent | App |
> | `SSO_GROUP_FILTER` | string | unset; feature-dependent | App |
> | `SSO_DIRECTORY_RESYNC_SECONDS` | string | unset; feature-dependent | App |
> | `SSO_DIRECTORY_MAX_STALENESS_SECONDS` | string | unset; feature-dependent | App |
> | `SSO_SESSION_MAX_AGE_SECONDS` | string | unset; feature-dependent | App |
> | `SSO_USER_LOOKUP_PATH` | string | unset; feature-dependent | App |

## Networking and transfers

Allowed origins are comma-separated. Byte limits apply independently: multipart routing, archives and the reusable-file quota. Set the public HTTPS origin through SERVER\_BASE\_URL and BETTER\_AUTH\_URL where required by your proxy topology.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `SERVER_BASE_URL` | string | unset | App, Worker |
> | `SERVER_PORT` | integer | 3000 | App, Worker |
> | `EIGENPAL_CONFIG_PATH` | string | unset; feature-dependent | App, Worker |
> | `EIGENPAL_TRUSTED_ORIGINS` | string | unset; feature-dependent | App |
> | `EIGENPAL_BROWSER_STORAGE_ORIGINS` | string | unset; feature-dependent | App |
> | `EIGENPAL_DIRECT_FILE_UPLOADS` | true \| false | "false" | App |
> | `EIGENPAL_MULTIPART_MAX_BYTES` | number | unset; feature-dependent | App |
> | `EIGENPAL_ARCHIVE_MAX_BYTES` | number | unset; feature-dependent | App |
> | `EIGENPAL_REUSABLE_FILES_MAX_BYTES` | number | 0 | App |

## Worker execution

Worker pool polling, leases and webhook timings use milliseconds. SCRIPT\_\* and TEMPLATE\_RENDER\_LIMIT\_MS timeouts use milliseconds; script memory uses bytes. Health heartbeat timings use milliseconds. Synchronous script limits are clamped against the liveness budget.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `WORKER_POOL_CONCURRENCY` | integer | 4 | App, Worker |
> | `WORKER_POOL_POLL_INTERVAL` | integer | 1000 | App, Worker |
> | `WORKER_POOL_MAX_POLL_INTERVAL` | integer | 30000 | App, Worker |
> | `WORKER_POOL_BACKOFF_MULTIPLIER` | number | 2 | App, Worker |
> | `WORKER_POOL_LEASE_DURATION` | integer | 60000 | App, Worker |
> | `WORKER_POOL_LEASE_RENEWAL_INTERVAL` | integer | 10000 | App, Worker |
> | `WORKER_POOL_ENABLE_NOTIFY` | boolean | true | App, Worker |
> | `WORKER_POOL_DIRECT_DATABASE_URL` | string | unset | App, Worker |
> | `WORKER_MAX_TENANT_CONCURRENCY` | integer | 3 | App, Worker |
> | `WORKER_MAX_TENANT_AGENT_CONCURRENCY` | integer | 2 | App, Worker |
> | `WORKER_MAX_TENANT_WORKFLOW_CONCURRENCY` | integer | 2 | App, Worker |
> | `WORKER_MAX_BATCH_CONCURRENCY` | integer | 2 | App, Worker |
> | `HEALTH_ENABLED` | true \| false | "true" | Worker |
> | `HEALTH_PORT` | number | 8080 | Worker |
> | `HEALTH_HOST` | string | "0.0.0.0" | Worker |
> | `HEALTH_LIVENESS_STALE_MS` | number | 30000 | Worker |
> | `HEALTH_HEARTBEAT_INTERVAL_MS` | number | 1000 | Worker |
> | `SCRIPT_ENABLED` | true \| false | "true" | Worker |
> | `SCRIPT_TIMEOUT_MS` | number | 5000 | Worker |
> | `SCRIPT_MAX_TIMEOUT_MS` | number | 30000 | Worker |
> | `SCRIPT_MEMORY_LIMIT_BYTES` | number | 10485760 | Worker |
> | `SCRIPT_MAX_MEMORY_BYTES` | number | 52428800 | Worker |
> | `TEMPLATE_RENDER_LIMIT_MS` | number | 5000 | Worker |
> | `SOFFICE_POOL_SIZE` | number | 4 | Worker |
> | `SOFFICE_CONVERSION_TIMEOUT_MS` | number | 60000 | Worker |
> | `SOFFICE_ACQUIRE_TIMEOUT_MS` | number | 600000 | Worker |
> | `PDFTOTEXT_TIMEOUT_MS` | number | 60000 | Worker |
> | `PDFTOTEXT_MAX_OUTPUT_BYTES` | number | 33554432 | Worker |
> | `ZIP_PROCESS_INFLATION_BUDGET_BYTES` | number | 536870912 | Worker |
> | `RENDER_SUBPROCESS_CONCURRENCY` | number | 1 | Worker |
> | `RENDER_SUBPROCESS_TIMEOUT_MS` | number | 180000 | Worker |
> | `RENDER_SUBPROCESS_ACQUIRE_TIMEOUT_MS` | number | 600000 | Worker |
> | `RENDER_SUBPROCESS_MAX_RESULT_BYTES` | number | 419430400 | Worker |
> | `EXTRACT_GROUNDING_MAX_LX_CHARS` | number | unset; feature-dependent | Worker |
> | `SPLIT_WINDOW_TOKEN_BUDGET` | number | 20000 | Worker |
> | `OCR_ANALYSIS_CONCURRENCY` | number | 8 | Worker |
> | `OCR_ANALYSIS_IDLE_TIMEOUT_MS` | number | 180000 | Worker |
> | `OCR_ANALYSIS_REQUEST_TIMEOUT_MS` | number | 30000 | Worker |
> | `OCR_ANALYSIS_POLL_INTERVAL_MS` | number | 2000 | Worker |

## Outbound webhooks

Delivery timeouts, polling, leases and retry schedules use milliseconds; retention uses days. Configure endpoint URLs and signing secrets in Studio. Private destinations require single-tenant mode and remain subject to blocked-address checks.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `WORKER_WEBHOOKS_CONCURRENCY` | integer | 4 | App, Worker |
> | `WORKER_WEBHOOKS_MAX_TENANT_CONCURRENCY` | integer | 2 | App, Worker |
> | `WORKER_WEBHOOKS_POLL_INTERVAL` | integer | 1000 | App, Worker |
> | `WORKER_WEBHOOKS_MAX_POLL_INTERVAL` | integer | 30000 | App, Worker |
> | `WORKER_WEBHOOKS_LEASE_DURATION` | integer | 60000 | App, Worker |
> | `WORKER_WEBHOOKS_LEASE_RENEWAL_INTERVAL` | integer | 10000 | App, Worker |
> | `WORKER_WEBHOOKS_REQUEST_TIMEOUT` | integer | unset | App, Worker |
> | `WORKER_WEBHOOKS_RETRY_SCHEDULE` | integer\[] | unset | App, Worker |
> | `WORKER_WEBHOOKS_MAX_RETRY_AFTER` | integer | 86400000 | App, Worker |
> | `WORKER_WEBHOOKS_RESPONSE_CAPTURE_BYTES` | integer | 16384 | App, Worker |
> | `WORKER_WEBHOOKS_RETENTION_DAYS` | integer | 30 | App, Worker |
> | `WORKER_WEBHOOKS_ALLOW_PRIVATE_DESTINATIONS` | boolean | unset | App, Worker |
> | `WORKER_WEBHOOKS_ENABLE_NOTIFY` | boolean | true | App, Worker |

## Agent sandboxes

SANDBOX\_PROVIDER accepts e2b, docker or remote; unset selects E2B. Configure sandbox settings on app and worker. Builder sessions require E2B. Builder mounts require a scoped credential issuer. Credential TTL defaults to 3600 seconds; longer explicit values require issuer support.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `EIGENPAL_SANDBOX_ENABLED` | true \| false | "true" | App, Worker, Agent runtime |
> | `E2B_API_KEY` | string | unset; feature-dependent | App, Agent runtime |
> | `E2B_SANDBOX_TEMPLATE` | string | unset; feature-dependent | App, Agent runtime |
> | `SANDBOX_PROVIDER` | string | unset; feature-dependent | Agent runtime |
> | `DOCKER_SANDBOX_IMAGE` | string | unset; feature-dependent | Agent runtime |
> | `DOCKER_SANDBOX_PLATFORM` | string | unset; feature-dependent | Agent runtime |
> | `SANDBOX_REMOTE_URL` | string | unset; feature-dependent | Agent runtime |
> | `SANDBOX_REMOTE_AUTH_TOKEN` | string | unset; feature-dependent | Agent runtime |
> | `EIGENPAL_API_BASE_URL` | string | unset; feature-dependent | Agent runtime |
> | `EIGENPAL_API_TOKEN` | string | unset; feature-dependent | Agent runtime |
> | `SANDBOX_STORAGE_STS_ROLE_ARN` | string | unset | App, Worker |
> | `SANDBOX_STORAGE_R2_ACCOUNT_ID` | string | unset | App, Worker |
> | `SANDBOX_STORAGE_R2_API_TOKEN` | string | unset | App, Worker |
> | `SANDBOX_STORAGE_CREDENTIAL_TTL_SECONDS` | integer | 3600 | App, Worker |

## Agent Git server

Agents need a Git server; EIGENPAL\_AGENTS\_ENABLED=false hides them and refuses agent runs on installations without one. Run the Git server separately with persistent repository storage. AGENT\_GIT\_BASE\_URL belongs to its callers; port, host, storage root and command limits belong to the Git server. Keep operator credentials private and identical where used.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `EIGENPAL_AGENTS_ENABLED` | true \| false | "true" | App, Agent runtime |
> | `AGENT_GIT_BASE_URL` | string | unset; feature-dependent | App, Worker |
> | `AGENT_GIT_ADMIN_TOKEN` | string | unset; feature-dependent | App, Git server |
> | `AGENT_GIT_REQUEST_TIMEOUT_MS` | number | 30000 | App |
> | `GIT_SERVER_PORT` | number | unset; feature-dependent | Git server |
> | `GIT_SERVER_HOST` | string | "0.0.0.0" | Git server |
> | `AGENT_GIT_STORAGE_ROOT` | string | installation-specific | Git server |
> | `AGENT_GIT_MAX_REQUEST_BODY_BYTES` | number | 104857600 | Git server |
> | `AGENT_GIT_COMMAND_TIMEOUT_MS` | number | 60000 | Git server |

## Logs and tracing

Collect audit logs from stdout. Product telemetry and OpenTelemetry tracing have separate switches. Provide collector endpoints and authentication for your installation.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `LOG_LEVEL` | trace \| debug \| info \| warn \| error \| fatal \| silent | "info" | App, Worker |
> | `LOG_PRETTY` | boolean | false | App, Worker |
> | `EIGENPAL_TELEMETRY_ENABLED` | boolean | true | App, Worker |
> | `OTEL_ENABLED` | true \| false | "false" | Tracing |
> | `OTEL_SERVICE_NAME` | string | unset; feature-dependent | Tracing |
> | `OTEL_SERVICE_VERSION` | string | unset; feature-dependent | Tracing |
> | `OTEL_EXPORTER_OTLP_ENDPOINT` | string | unset; feature-dependent | Tracing |
> | `OTEL_EXPORTER_OTLP_HEADERS` | string | unset; feature-dependent | Tracing |
> | `OTEL_EXPORTER_OTLP_PROTOCOL` | string | unset; feature-dependent | Tracing |

## Single-node storage

Fresh evaluation installations use embedded storage. Select external explicitly for AWS S3 or another S3-compatible service. The persisted selection prevents accidental backend changes on restart.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `EIGENPAL_SINGLE_NODE_STORAGE_BACKEND` | embedded \| external | "embedded" | Single-node supervisor + migration CLI |

## Maintenance and integrations

CRON\_SECRET authenticates scheduled maintenance. Configure promotion callbacks through Helm notifications. FILE\_SOURCE\_INTEGRATIONS is an explicit connector opt-in; GPFS requires gpfs. Provider credentials referenced by YAML can use your own variable names through configEnv.

> [accordion] Show settings
>
> | Setting | Type | Default | Process |
> | - | - | - | - |
> | `CRON_SECRET` | string | unset; feature-dependent | App |
> | `FILE_SOURCE_INTEGRATIONS` | comma-separated names | unset | App + worker |
> | `PROMOTION_WEBHOOK_SECRET` | string (at least 32 characters) | unset | App |
> | `NODE_EXTRA_CA_CERTS` | PEM file path | unset | App + worker |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.