Reference/Environment variables

Environment variables

Every environment variable the backend reads, with its default.

Configuration is environment-only. There is no config file.

Server

Variable	Default	Purpose
`SERVER_HOST`	`0.0.0.0`	Bind address
`SERVER_PORT`	`8080`	Bind port
`LOG_LEVEL`	`info`	`debug`, `info`, `warn`, `error`
`DASHBOARD_URL`	—	Public URL, used in links inside notifications
`API_BASE_URL`	—	Public API URL, used by the SDK and agent installers
`ALLOWED_ORIGINS`	—	Comma-separated CORS origins
`TRUSTED_PROXY_CIDRS`	—	Proxies whose forwarded client address is trusted

Warning

Without TRUSTED_PROXY_CIDRS, every request behind a proxy appears to come from the proxy. Rate limits then apply to the whole deployment as one client, and audit logs record the proxy's address rather than the user's.

Database

Variable	Default
`DB_HOST`	`localhost`
`DB_PORT`	`5432`
`DB_NAME`	—
`DB_USER`	—
`DB_PASSWORD`	—
`DB_SSL_MODE`	`disable`
`DB_MAX_CONNS`	`25`

Authentication

Variable	Default	Purpose
`JWT_SECRET`	—	Required. Signing key
`JWT_TTL_HOURS`	`24`	Session lifetime
`COOKIE_DOMAIN`	—	Session cookie domain
`COOKIE_SECURE`	—	`true` in production

Caution

Changing JWT_SECRET invalidates every session immediately. That is the correct response to a suspected compromise and a bad surprise otherwise.

Rate limits

Variable	Default	Applies to
`RATE_LIMIT_API`	`600`	Authenticated API, per minute
`RATE_LIMIT_PUBLIC`	`30`	Login, signup, reset
`RATE_LIMIT_OAUTH`	`120`	OAuth redirects and callbacks

Email

Variable	Purpose
`SMTP_HOST`, `SMTP_PORT`	Server
`SMTP_USER`, `SMTP_PASS`	Credentials
`SMTP_FROM`	Envelope sender

Used for invitations, password resets, scheduled reports and per-user paging.

Slack OAuth

Variable
`SLACK_CLIENT_ID`
`SLACK_CLIENT_SECRET`
`SLACK_REDIRECT_URL`

Only needed for Slack sign-in. A Slack notification channel needs only an incoming-webhook URL.

Monitoring worker

Variable	Default	Purpose
`MONITOR_SYNC_INTERVAL`	`30` (seconds)	How often the service checker sweeps
`MONITOR_WORKER_POOL_SIZE`	—	Concurrent checks
`MONITOR_LOCATION`	—	Label recorded on each check, for multi-region checking

Browser ingest

Variable	Default
`WEB_INGEST_KEY` / `WEB_INGEST_KEYS`	—
`WEB_INGEST_ORG_ID`	—
`WEB_INGEST_MAX_EVENTS`	`100`
`WEB_INGEST_MAX_BODY_BYTES`	`262144`
`WEB_INGEST_RATE_PER_MIN`	`240`
`WEB_INGEST_SCRUB_PII`	—
`WEB_INGEST_SCRUB_IP`	—

See Ingest endpoints.

Web error alerting

Variable
`WEB_ERROR_ALERTS_ENABLED`
`WEB_ERROR_ALERT_CHANNELS`
`WEB_ERROR_SPIKE_THRESHOLD`
`WEB_ERROR_SPIKE_WINDOW_SECONDS`
`WEB_ERROR_ALERT_COOLDOWN_SECONDS`

Copilot workspace

Variable	Purpose
`COPILOT_WORKSPACE_DIR`	Sandbox directory. Unset means the feature is off
`COPILOT_WORKSPACE_EXTENSIONS`	Which file extensions may be read
`COPILOT_WORKSPACE_MAX_FILE_KB`	Per-file cap

See Guarded actions.

Retention

Variable	Default	Covers
`RETENTION_METRICS_DAYS`	`90`	Metric tables
`RETENTION_TELEMETRY_DAYS`	`90`	Error tracking, APM, analytics, anomaly

See Data retention.

Other

Variable	Purpose
`REDIS_URL`	Optional cache
`SEMEION_URL`, `SEMEION_TOKEN`	Log shipping integration

Where this behaviour lives: backend/internal/config/config.go. If the code and this page disagree, the code is right — please fix the page.

Part of Reference — The exact numbers, names and limits, generated from the code.