• English

      • Environment Variable Reference

      The API and Worker both read runtime configuration from environment variables. With Docker Compose, Helm, or another container platform, inject these values into the matching container.

      For a first deployment, configure the Basic values only. Once the platform is running, adjust Advanced values when a real requirement appears instead of setting every option up front.

      API Settings

      TypeKeyDefaultPurpose and when to change
      BasicAPP_ENVproductionRuntime mode; set development explicitly only for local development.
      BasicSECRET_ENCRYPTION_KEYEmptySecret encryption key; required and stable in production.
      BasicDATABASE_URLpostgres://devops:devops@postgres:5432/devops?sslmode=disablePostgreSQL URL; change when using another database or credential.
      BasicREDIS_ADDRredis://localhost:6379/0Complete Redis URI in the form redis://username:password@host:port/database; use rediss:// for TLS. Username, password, and DB are no longer configured separately.
      BasicPUBLIC_BASE_URLhttp://localhost:8088Public platform URL; change for public domain, HTTPS, or reverse proxy. OIDC Redirect URI is generated as {PUBLIC_BASE_URL}/api/v1/auth/oidc/callback.
      AdvancedAPI_ADDR:8080API listen address; change for custom container ports.
      AdvancedAPP_CORS_ORIGINShttp://localhost:8088Allowed frontend origins; change when frontend and API use different origins.
      AdvancedTRUSTED_PROXY_CIDRSEmptyReverse-proxy CIDRs allowed to provide the real client address, comma-separated. No proxy is trusted by default. Configure only controlled proxies so a forged X-Forwarded-For cannot bypass per-IP rate limits.
      AdvancedLOG_LEVELinfoLog level; temporarily use debug for local troubleshooting.
      AdvancedDB_MAX_OPEN_CONNS20Maximum PostgreSQL connections opened by this API process; size it across all API and worker replicas to avoid exhausting the database.
      AdvancedDB_MAX_IDLE_CONNS5Idle PostgreSQL connections kept by this API process; lower it when database connections are tight.
      AdvancedDB_CONN_MAX_LIFETIME30mMaximum lifetime of a reused database connection; shorten it for load balancers, connection proxies, or database rolling maintenance.
      AdvancedDB_CONN_MAX_IDLE_TIME5mMaximum idle time for database connections; shorten it when connection slots are tight.
      AdvancedDB_CONNECT_RETRY_ATTEMPTS12Startup PostgreSQL connection retry attempts; increase when the database starts slowly or temporarily runs out of slots.
      AdvancedDB_CONNECT_RETRY_INTERVAL5sStartup connection retry interval. Values like 5s, 1m, or plain seconds are accepted.
      AdvancedMETRICS_ENABLEDfalseEnables the dedicated Prometheus metrics listener; disabled by default. When set to true, the API uses :9090 by default.
      AdvancedMETRICS_ADDR:9090Metrics listen address; change only when overriding the API metrics port or bind address.
      AdvancedMETRICS_PATH/metricsPrometheus scrape path; registered only on the dedicated metrics listener.

      When metrics are enabled, the API exports HTTP request, latency, error response, PostgreSQL connection pool, and PostgreSQL/Redis health metrics. Grafana dashboard JSON lives under grafana/dashboards/ and can be imported into Grafana when needed.

      OIDC identity provider Redirect URI is generated from PUBLIC_BASE_URL, and the admin identity provider form shows a copyable value. Admission policy requires OIDC to return a non-empty email and email_verified=true by default. For trusted internal identity providers that cannot return the standard email_verified claim, disable “Require verified OIDC email” in the admission policy; the platform still requires a non-empty email.

      Before login, the frontend picks the first supported language from the browser language preference list. The supported languages are currently zh-CN and en-US. After login, the account language preference wins and is cached locally so the next page load uses the same language immediately.

      Available access-route domain suffixes, external access schemes, external access ports, and Gateway API defaults are managed on runtime clusters. Different clusters can use different gateway domain suffixes, GatewayClasses, and shared Gateways; the same cluster can also define multiple suffixes. A deployment target's cluster decides which suffixes are selectable, and each access route chooses exactly one suffix for default-domain generation, short-host expansion, and console access links. Set a cluster's external access scheme to https when an outer CDN or reverse proxy already terminates HTTPS; this only changes console display and link targets, does not change internal Gateway listeners, and does not request certificates.

      Frontend Build Settings

      TypeKeyDefaultPurpose and when to change
      AdvancedVITE_DOCS_BASE_URLhttps://luna-devops.liteyuki.orgDocumentation site base URL. Help links on pages such as Billing are generated from it. Set it before building the frontend when the docs site uses another domain or path.

      Worker Settings

      TypeKeyDefaultPurpose and when to change
      BasicAPP_ENVproductionRuntime mode; keep it aligned with API.
      BasicSECRET_ENCRYPTION_KEYEmptyDecrypts saved secrets; must match API.
      BasicDATABASE_URLpostgres://devops:devops@postgres:5432/devops?sslmode=disablePostgreSQL URL; point to the same database as API.
      BasicREDIS_ADDRredis://localhost:6379/0Complete Redis URI; use the same URI as API. Use rediss:// for TLS.
      BasicBUILD_EXECUTOR_IMAGEmoby/buildkit:v0.24.0-rootlessBuildKit image; change when the build cluster cannot pull the default image.
      AdvancedLOG_LEVELinfoLog level; temporarily use debug for local troubleshooting.
      AdvancedDB_MAX_OPEN_CONNS20Maximum PostgreSQL connections opened by this worker process; size it across all API and worker replicas to avoid exhausting the database.
      AdvancedDB_MAX_IDLE_CONNS5Idle PostgreSQL connections kept by this worker process; lower it when database connections are tight.
      AdvancedDB_CONN_MAX_LIFETIME30mMaximum lifetime of a reused database connection; shorten it for load balancers, connection proxies, or database rolling maintenance.
      AdvancedDB_CONN_MAX_IDLE_TIME5mMaximum idle time for database connections; shorten it when connection slots are tight.
      AdvancedDB_CONNECT_RETRY_ATTEMPTS12Startup PostgreSQL connection retry attempts; increase when the database starts slowly or temporarily runs out of slots.
      AdvancedDB_CONNECT_RETRY_INTERVAL5sStartup connection retry interval. Values like 5s, 1m, or plain seconds are accepted.
      AdvancedMETRICS_ENABLEDfalseEnables the dedicated Prometheus metrics listener; disabled by default. When set to true, the worker uses :9091 by default.
      AdvancedMETRICS_ADDR:9091Metrics listen address; change only when overriding the worker metrics port or bind address.
      AdvancedMETRICS_PATH/metricsPrometheus scrape path; registered only on the dedicated metrics listener.
      AdvancedDEPLOY_ROLLOUT_TIMEOUT_SECONDS600Release wait timeout; increase for slow-starting apps.
      AdvancedCERT_MANAGER_CLUSTER_ISSUERletsencrypt-http01Certificate Issuer name; change when your cluster uses another name.
      AdvancedBUILD_EGRESS_MODEpermissiveBuild egress mode; set to restricted when strong isolation is required.
      AdvancedBUILD_JOB_TIMEOUT_SECONDS1800Build timeout fallback used when a deployment target does not set one; increase for large projects.
      AdvancedBUILD_JOB_TTL_SECONDS3600Completed build Pod retention; increase for a longer log window.
      AdvancedBUILD_CACHE_ENABLEDfalseBuild cache switch; enable for faster repeated builds.
      AdvancedBUILD_CACHE_TAGbuildcacheBuild cache tag; change to isolate cache.
      AdvancedBUILD_NPM_REGISTRYEmptynpm registry; set when using an internal mirror.
      AdvancedBUILD_PRIVATE_EGRESS_CIDRSEmptyExtra private CIDRs in restricted mode.
      AdvancedBUILD_PRIVATE_EGRESS_PORTS443Private allowlist ports in restricted mode; use ports like 5000 or 8081 for non-standard registries.
      AdvancedBUILD_BLOCKED_EGRESS_CIDRSEmptyExtra blocked CIDRs in restricted mode.

      When metrics are enabled, the worker exports task, retry, queue depth, queue latency, build/release result and duration, runtime replica, gateway sync, and dependency health metrics. Grafana dashboard JSON lives under grafana/dashboards/ and can be imported into Grafana when needed.