Environment variables

This document was generated using AI assistance

Content may include inaccuracies, outdated information, or technical errors. Users are advised to cross-check critical information before implementation.

The compose file reads its configuration from the .env file next to it. The same variables are passed to the containers when you run them by hand, and the .env.example files shipped in the application archive list them per container.

The values shipped in the repository let docker compose up work on a laptop. A production deployment must supply its own value for every secret: OAUTH2_CLIENT_SECRET, DATABASE_PASSWORD, REDIS_PASSWORD, KEYCLOAK_ADMIN_PASSWORD, KEYCLOAK_DATABASE_PASSWORD, SMTP_PASSWORD and OPENAI_API_KEY. Generate them yourself, keep the .env file out of version control, and change them before the instance is reachable from a network.

URLs

These addresses end up in links the browser follows, so they must be the public addresses of your installation, not container names.

Variable	Controls	Default
APPLICATION_URL	Public URL of the application, as users type it	http://localhost:8080
API_GATEWAY_URL	Public URL of the API gateway, used by the interface and by API clients	http://localhost:8080
METAMODEL_URL	Base URL for metamodels. Each metamodel is addressed as METAMODEL_URL/scope/project/version/model, and models reference their metamodel by that URL, so it should stay constant	http://localhost:8080
FRONTEND_PORT	Host port the interface is published on	8080
ABOUT_URL	Product information page, linked from the top-right corner. Leave empty to hide the link	empty
DOCUMENTATION_URL	Documentation site, linked from the top-right corner. Leave empty to hide the link	empty
APPLICATIONS_URL	Applications portal, linked from the top-right corner. Leave empty to hide the link	empty
LANGUAGES	Languages the interface is offered in, as a comma-separated list of codes, in the order they are shown in the user menu	en,fr,ru

Session and CORS

Variable	Controls	Default
SESSION_TIMEOUT	Lifetime of a session stored in Redis. Keep it aligned with SSO Session Idle in the Keycloak realm	30d
ALLOWED_ORIGINS	Extra origins allowed to call the API gateway, in addition to APPLICATION_URL, ABOUT_URL and APPLICATIONS_URL	empty
ALLOWED_ORIGIN_PATTERNS	Extra origin patterns allowed to call the API gateway	empty

OAuth 2.0

The first three addresses are opened by the browser and must be public. The last three are called by the API gateway itself and may use an internal container address.

Variable	Controls	Default
OAUTH2_ISSUER_URL	Realm issuer URL	http://localhost:8181/realms/architeezy
OAUTH2_AUTHORIZATION_URL	Authorization endpoint the browser is redirected to on sign-in	<issuer>/protocol/openid-connect/auth
OAUTH2_ACCOUNT_URL	Account page, opened from the user menu	<issuer>/account/
OAUTH2_CLIENT_ID	Confidential client the application signs in with	architeezy
OAUTH2_CLIENT_SECRET	Secret of that client. Must match the secret in Keycloak	supply your own
OAUTH2_API_CLIENT_ID	Public client used by external API clients	architeezy-api
OAUTH2_TOKEN_URL	Token endpoint, called server to server	http://keycloak:8080/realms/architeezy/protocol/openid-connect/token
OAUTH2_JWK_SET_URL	Key set used by the gateway and the backend to verify tokens	http://keycloak:8080/realms/architeezy/protocol/openid-connect/certs
OAUTH2_USER_INFO_URL	User info endpoint, called server to server	http://keycloak:8080/realms/architeezy/protocol/openid-connect/userinfo

Database

The application database is created on the first start of the db container from DATABASE_USERNAME and DATABASE_PASSWORD. The same pair is handed to the backend as its datasource credentials.

Variable	Controls	Default
DATABASE_USERNAME	Owner of the architeezy database	architeezy
DATABASE_PASSWORD	Password of that user	supply your own
DATABASE_PORT	Host port PostgreSQL is published on	5441

Redis

Variable	Controls	Default
REDIS_PASSWORD	Password Redis requires and the API gateway presents	supply your own
REDIS_PORT	Host port Redis is published on	6382

SMTP

Mail is optional. Leave the whole group empty and the application runs without sending mail.

Variable	Controls	Default
SMTP_HOST	Mail server host	empty
SMTP_PORT	Mail server port	empty
SMTP_PROTOCOL	Mail protocol, for example smtp	empty
SMTP_USERNAME	Account used to authenticate	empty
SMTP_PASSWORD	Password of that account	supply your own
SMTP_SSL_ENABLED	Whether to connect over SSL	empty
SMTP_STARTTLS_ENABLED	Whether to upgrade the connection with STARTTLS	empty
SMTP_MAIL_FROM	Sender address of outgoing mail	empty
SMTP_MAIL_TO	Address the application writes to	empty

LLM

The AI assistant talks to any service that speaks the OpenAI protocol. The default points at a model served on the host machine.

Variable	Controls	Default
OPENAI_URL	Base URL of the OpenAI-compatible API	http://host.docker.internal:11434/v1
OPENAI_API_KEY	API key sent with each request	supply your own
OPENAI_MODEL	Model name	qwen3:4b
OPENAI_TEMPERATURE	Sampling temperature	0

Keycloak

Variable	Controls	Default
KEYCLOAK_URL	Public URL of Keycloak, used as its hostname	http://localhost:8181
KEYCLOAK_PORT	Host port Keycloak is published on	8181
KEYCLOAK_ADMIN_USERNAME	Bootstrap administrator of the master realm	admin
KEYCLOAK_ADMIN_PASSWORD	Password of that administrator	supply your own
KEYCLOAK_DATABASE_USERNAME	Owner of the keycloak database	keycloak
KEYCLOAK_DATABASE_PASSWORD	Password of that user	supply your own
KEYCLOAK_DATABASE_PORT	Host port the Keycloak database is published on	5444

Two more values are derived from the variables above and passed to Keycloak when the realm is imported: the redirect URI API_GATEWAY_URL/login/oauth2/code/keycloak and the web origin APPLICATION_URL. Change either URL and the corresponding client setting has to be updated in Keycloak.