Environment variables¶

This page lists the configuration values used by each component. Values required for a particular installation are given on that component's installation page; this page is a complete reference.

Host addresses are not given here. Substitute the current addresses from Hosts and ports.

Metadata component¶

Application¶

Variable	Purpose	Default
`SECRET_KEY`	Cryptographic signing key, unique per installation	Insecure development value
`DJANGO_DEBUG`	Detailed error pages; must be false in production	`true`
`OFFLINE_MODE`	Use local accounts instead of Keycloak	`false`
`ALLOWED_HOSTS`	Host names the application answers for, comma separated	`localhost,127.0.0.1`
`CSRF_TRUSTED_ORIGINS`	Origins permitted to submit forms, comma separated	Local addresses
`CORS_ALLOWED_ORIGINS`	Origins permitted to call the APIs	Local addresses
`TIME_ZONE`	Display time zone	`Europe/Bucharest`
`DATA_DIR`	Data directory inside the container	`/home/simavi/data`
`GUNICORN_WORKERS`	Worker processes	`3`
`GUNICORN_TIMEOUT`	Request timeout in seconds	`120`

Database¶

Variable	Purpose	Default
`DB_HOST`	Database host	See installation page
`DB_PORT`	Database port	`5432`
`DB_NAME`	Database name	`cvdlink`
`DB_USER`	Database user	`postgres`
`DB_PASSWORD`	Database password	Empty, must be set
`DB_CONN_MAX_AGE`	Connection lifetime in seconds	`60`

Sessions and cookies¶

Variable	Purpose	Default
`SESSION_COOKIE_SECURE`	Send session cookies over HTTPS only	`false`
`CSRF_COOKIE_SECURE`	Send CSRF cookies over HTTPS only	`false`

Both must be set to true where the application is served over HTTPS. The session lifetime is 30 minutes of inactivity, matching the authentication provider.

Authentication, central deployments¶

Variable	Purpose
`OIDC_OP_DISCOVERY_ENDPOINT`	Realm discovery document
`OIDC_OP_USER_ENDPOINT`	User information endpoint
`OIDC_OP_LOGOUT_ENDPOINT`	Sign-out endpoint
`OIDC_RP_CLIENT_ID`	Client identifier registered in the realm
`OIDC_RP_CLIENT_SECRET`	Left empty; the client is public and uses PKCE
`OIDC_RP_SCOPES`	Requested scopes
`OIDC_USE_PKCE`	Use PKCE; required for a public client
`OIDC_VERIFY_SSL`	Verify the provider certificate

Federation¶

Variable	Purpose	Default
`MESH_ENABLED`	Enable federation features	`true`
`MESH_MQTT_ENABLED`	Connect to the message broker	`false`
`MESH_MQTT_BROKER_URL`	Broker address	`localhost`
`MESH_MQTT_BROKER_PORT`	Broker port	`1883`
`MESH_MQTT_USERNAME`	Broker user	Set per environment
`MESH_MQTT_PASSWORD`	Broker password	Set per environment
`MESH_NODE_SEED`	Unique identifier for this site	Derived from hostname
`MESH_NODE_NAME`	Readable name for this site	Derived from hostname
`MESH_NODE_ROLE`	Role within the federation	`LEAF`
`MESH_NODE_PORT`	Port other sites use to reach this one	`8000`
`MESH_HEARTBEAT_INTERVAL`	Seconds between status messages	`60`
`MESH_NODE_TIMEOUT`	Seconds before a silent peer is considered offline	`180`
`MESH_AUTO_START`	Start the federation listener with the application	Set per environment

MESH_NODE_SEED must be set explicitly. The default is derived from the machine hostname and changes if the machine is renamed or replaced, which causes the site to appear in the federation as a new and unrecognised node.

Data directories¶

Each supported format has a directory, defaulting to a subdirectory of DATA_DIR. Override only where files are held elsewhere.

FHIR_DATA_DIR, GENOMIC_DATA_DIR, HDF5_DATA_DIR, IMAGES_DATA_DIR, SIGNAL_DATA_DIR, VCF_DATA_DIR, PERSON_DATA_DIR, PNG_DATA_DIR, PTBXL_DATA_DIR, WFDB_DATA_DIR

Assistant features¶

These require the pgvector database extension and a local model runtime, and are available only where both are present.

Variable	Purpose	Default
`OLLAMA_ENABLED`	Enable the assistant	`true`
`OLLAMA_BASE_URL`	Model runtime address	`http://localhost:11434`
`OLLAMA_CHAT_MODEL`	Model used for responses	Set per environment
`OLLAMA_CHAT_TIMEOUT`	Response timeout in seconds	`600`
`OLLAMA_EMBEDDING_MODEL`	Model used for indexing	`nomic-embed-text`
`OLLAMA_EMBEDDING_DIMENSIONS`	Embedding width	`768`
`RAG_CHUNK_SIZE`	Document segment size	`1200`
`RAG_CHUNK_OVERLAP`	Overlap between segments	`200`

Audit¶

Variable	Purpose	Default
`AUDIT_ENABLED`	Record user actions	`true`
`AUDIT_API_URL`	Audit service endpoint	Set per environment

ETL component¶

Variable	Purpose	Default
`DB_HOST`	Database host	`host.docker.internal`
`DB_PORT`	Database port	`5492`, must be overridden
`DB_NAME`	Database name	`cvdlink`
`DB_USER`	Database user	`postgres`
`DB_PASSWORD`	Database password	Set per environment
`UVICORN_HOST`	Listen address	`0.0.0.0`
`UVICORN_PORT`	Listen port	`8002`
`RUN_CLI`	Run the bulk loader at container start	`1`
`OFFLINE_MODE`	Disable token validation	`false`
`KEYCLOAK_BASE_URL`	Authentication provider base URL	Project realm
`KEYCLOAK_REALM`	Realm name	`cvdlink`
`KEYCLOAK_AUDIENCE`	Expected token audience; unset to skip the check	Unset
`REQUIRED_ROLE`	Role required to call the API	`api-call`
`ROLE_CLIENT_ID`	Client whose roles are checked	Unset
`CVDLINKBK_CORS`	Permitted origins, comma separated	`*`

The default DB_PORT of 5492 is not used by any current deployment and must be set explicitly. Set RUN_CLI=0 for a service installation.

Database component¶

Variable	Purpose	Default
`POSTGRES_USER`	Administrative user created at initialisation	`postgres`
`POSTGRES_PASSWORD`	Administrative password	Set per environment
`POSTGRES_DB`	Database created at initialisation	`cvdlink`

The listening port is set in the container command rather than by a variable. Changing it requires editing the compose file, as described on the Database installation page.

P2P component¶

The P2P component is configured by a Python settings file rather than environment variables. Its settings are documented on the P2P installation page.

Values that must be unique per installation¶

The following must differ between installations. Copying a configuration file from one installation to another without changing them causes failures that are difficult to diagnose.

Value	Consequence of reuse
`SECRET_KEY`	Sessions and signed values become portable between installations
`MESH_NODE_SEED`	Two sites appear as one in the federation
`MESH_NODE_NAME`	Sites cannot be told apart in status views
`NODE_ID` in the P2P settings	Acknowledgements are attributed to the wrong site

Values that must never be committed to version control¶

SECRET_KEY, DB_PASSWORD, POSTGRES_PASSWORD, MESH_MQTT_PASSWORD, and OIDC_RP_CLIENT_SECRET where used.

Environment files holding these values should be restricted to the account that owns the installation:

chmod 600 .env.docker