Environment Variables - thekaveh/atlas GitHub Wiki

10.3. Environment Variables

1. Generated Environment Matrix

Variable Service Default Description
AIRFLOW_SOURCE airflow disabled Deployment source for Airflow: container or disabled (default).
AIRFLOW_PORT airflow 63070 Host port for the Airflow Web UI + REST API (in-container 8080).
AIRFLOW_DB_USER airflow airflow Postgres role that owns the airflow metadata database on supabase-db. Supabase DB init creates it; Airflow connects with it and AIRFLOW_DB_PASSWORD.
AIRFLOW_DB_PASSWORD airflow atlas-db-password Auto-generated by bootstrapper. Postgres role for the Airflow metadata DB.
AIRFLOW_DB_USER_URI airflow airflow Bootstrapper-synchronized percent-encoded AIRFLOW_DB_USER for DSN userinfo.
AIRFLOW_DB_PASSWORD_URI airflow atlas-db-password Bootstrapper-synchronized percent-encoded AIRFLOW_DB_PASSWORD for DSN userinfo.
AIRFLOW_ATLAS_DB_USER airflow atlas_airflow_reader Read-only login seeded into the postgres_supabase Airflow Connection.
AIRFLOW_ATLAS_DB_PASSWORD airflow atlas-db-password Auto-generated password for Airflow DAGs' read-only Atlas database connection.
AIRFLOW_FERNET_KEY airflow Auto-generated. Fernet key for encrypting Connection passwords.
AIRFLOW_SECRET_KEY airflow Auto-generated. Mapped to AIRFLOW__API__SECRET_KEY ([api] secret_key) in every Airflow container. Execution API JWTs use AIRFLOW_JWT_SECRET instead.
AIRFLOW_JWT_SECRET airflow Auto-generated. Mapped to AIRFLOW__API_AUTH__JWT_SECRET; signs Execution API and /api/v2/ auth-token JWTs. Every Airflow process must share it, or cross-process verification fails with 403 InvalidSignatureError. Kept on warm restart.
AIRFLOW_ADMIN_PASSWORD airflow Auto-generated. Admin login. Username is hardcoded 'admin'.
AIRFLOW_WEBSERVER_SCALE airflow Set by ./start.sh from AIRFLOW_SOURCE; do not edit. 1 runs airflow-webserver (UI and REST API), 0 does not.
AIRFLOW_SCHEDULER_SCALE airflow Set by ./start.sh from AIRFLOW_SOURCE; do not edit. 1 runs airflow-scheduler, 0 does not.
AIRFLOW_DAG_PROCESSOR_SCALE airflow Set by ./start.sh from AIRFLOW_SOURCE; do not edit. 1 runs airflow-dag-processor. Airflow 3 needs it: it parses DAG files into the metadata DB, which the scheduler does not do.
AIRFLOW_INIT_SCALE airflow Set by ./start.sh from AIRFLOW_SOURCE; do not edit. 1 runs the one-shot airflow-init container at stack start, 0 does not.
AIRFLOW_WEBSERVER_MEMORY_LIMIT airflow 2g Container memory limit for airflow-webserver (deploy.resources.limits.memory). The api-server process is Python + Flask/FAB; 2 g is comfortable on a 32 GB host and prevents runaway memory from large DAG list pages.
AIRFLOW_WEBSERVER_CPU_LIMIT airflow 1.0 Container CPU limit for airflow-webserver (deploy.resources.limits.cpus). 1.0 core is ample for the API/UI server under typical load.
AIRFLOW_SCHEDULER_MEMORY_LIMIT airflow 2g Container memory limit for airflow-scheduler (deploy.resources.limits.memory). The LocalExecutor scheduler forks task processes in-process; 2 g caps runaway task forking.
AIRFLOW_SCHEDULER_CPU_LIMIT airflow 1.0 Container CPU limit for airflow-scheduler (deploy.resources.limits.cpus). 1.0 core is sufficient for LocalExecutor task scheduling on a dev/staging host.
AIRFLOW_DAG_PROCESSOR_MEMORY_LIMIT airflow 2g Container memory limit for airflow-dag-processor (deploy.resources.limits.memory). DAG parsing is Python-heavy but short-lived per cycle; 2 g prevents unbounded growth from parsing pathological DAG files.
AIRFLOW_DAG_PROCESSOR_CPU_LIMIT airflow 1.0 Container CPU limit for airflow-dag-processor (deploy.resources.limits.cpus). 1.0 core covers the periodic DAG file parsing cycle.
AIRFLOW_IMAGE airflow apache/airflow:3.3.2 Container image for airflow-webserver.
ASSET_BAKER_SOURCE asset-baker disabled Deployment mode for the Blender HP→LP bake worker. container-cpu runs deterministic Cycles-CPU bakes (GPU-optional, deferred).
ASSET_BAKER_PORT asset-baker 63052 Host port for the asset-baker API (in-container listen port is 8096).
ASSET_BAKER_SCALE asset-baker Set by ./start.sh from ASSET_BAKER_SOURCE; do not edit. 1 runs asset-baker (container-cpu), 0 does not.
ASSET_BAKER_PLATFORM asset-baker linux/amd64 Platform the asset-baker image is built and run for. The Blender build is x86_64-only, so arm64 hosts (Apple Silicon) run it under emulation; keep linux/amd64.
ASSET_BAKER_ENDPOINT asset-baker In-network URL for the asset-baker API.
ASSET_BAKER_API_TOKEN asset-baker Auto-generated bearer token required by all Asset Baker data and processing routes; /health remains unauthenticated.
ASSET_BAKER_ALLOWED_INPUT_BUCKETS asset-baker Optional comma- or space-separated reference-route bucket allowlist; blank follows MINIO_BUCKET_ASSET_INPUTS.
ASSET_BAKER_BLENDER_VERSION asset-baker 4.3.2 Pinned headless Blender version (>= 4.3) downloaded into the asset-baker image. Blender bundles its own Python + numpy for the bake script.
ASSET_BAKER_BLENDER_SHA256 asset-baker 4da1c956673c0485e63054e563ee69198cc8f80d8157dd7592dffc8a6a5592e6 SHA-256 checksum verified before extracting the pinned Blender archive. Update it with ASSET_BAKER_BLENDER_VERSION from Blender's published checksum file.
ASSET_BAKER_ARTIFACT_DIR asset-baker /data/artifacts Local artifact cache used when MinIO upload is disabled or for direct downloads.
ASSET_BAKER_MINIO_ENABLED asset-baker true When true, baked LP GLBs + textures are written to MinIO using content-addressed keys.
ASSET_BAKER_MINIO_BUCKET asset-baker asset-baker MinIO bucket for baked LP GLB + texture outputs.
ASSET_BAKER_MINIO_ENDPOINT asset-baker In-network MinIO S3 API endpoint used by the worker.
ASSET_BAKER_MINIO_ACCESS_KEY asset-baker Optional MinIO access key override. Empty uses the generated asset-baker scoped MinIO account.
ASSET_BAKER_MINIO_SECRET_KEY asset-baker Optional MinIO secret key override. Empty uses the generated asset-baker scoped MinIO account.
ASSET_BAKER_TARGET_TRIS asset-baker 39000 Default low-poly triangle budget the decimate stage targets (overridable per request).
ASSET_BAKER_TEX_SIZE asset-baker 2048 Default baked BaseColor/Normal texture resolution (square). Higher resolutions take longer on CPU; overridable per request.
ASSET_BAKER_CANONICAL_SIZE asset-baker 4.0 Canonical max-dimension (units) each mesh is scaled to before remesh so the relative voxel/ray heuristics are stable regardless of the raw GLB import scale.
ASSET_BAKER_BRIGHTNESS_MIN asset-baker 0.05 Mean-brightness QA gate: a baked BaseColor whose mean < this is a silently-failed (black) bake and is refused with a non-zero result.
ASSET_BAKER_TIMEOUT_SECONDS asset-baker 600 Hard wall-clock ceiling for a single bake subprocess; exceeded bakes are killed and reported as timeout.
ASSET_BAKER_MAX_UPLOAD_MB asset-baker 200 Maximum accepted GLB input size (MiB). Larger uploads/refs are rejected before a Blender process is spawned.
ASSET_BAKER_CONCURRENCY asset-baker 1 Maximum concurrent bake subprocesses. Default 1 — a single Cycles bake saturates CPU and concurrent bakes are net-negative.
ASSET_BAKER_IMAGE asset-baker python:3.12.9-slim Base image; the Dockerfile downloads a pinned headless Blender (ASSET_BAKER_BLENDER_VERSION) on top.
ASSET_WORKER_SOURCE asset-worker disabled Deployment mode for the glTF post-processing worker.
ASSET_WORKER_PORT asset-worker 63053 Host port for the asset-worker API (in-container listen port is 8095).
ASSET_WORKER_SCALE asset-worker Set by ./start.sh from ASSET_WORKER_SOURCE; do not edit. 1 runs asset-worker (container), 0 does not.
ASSET_WORKER_ENDPOINT asset-worker In-network URL for the asset-worker API.
ASSET_WORKER_API_TOKEN asset-worker Auto-generated bearer token required by all Asset Worker data and processing routes; /health remains unauthenticated.
ASSET_WORKER_ALLOWED_INPUT_BUCKETS asset-worker Optional comma- or space-separated reference-route bucket allowlist; blank follows MINIO_BUCKET_ASSET_INPUTS.
ASSET_WORKER_GLTF_TRANSFORM_VERSION asset-worker 4.5.1 Expected pinned @gltf-transform/cli lock version; overrides must match package.json and package-lock.json.
ASSET_WORKER_MAX_UPLOAD_MB asset-worker 200 Maximum GLB upload or MinIO reference size in MiB. Input is streamed and rejected before transformation when this limit is exceeded.
ASSET_WORKER_TIMEOUT_SECONDS asset-worker 300 Per-command timeout for gltf-transform inspect, validate, and optimize subprocesses.
ASSET_WORKER_CONCURRENCY asset-worker 1 Maximum concurrent glTF mutation requests; saturated workers reject new work with HTTP 429 before request-body parsing or object-store fetch.
ASSET_WORKER_ARTIFACT_DIR asset-worker /data/artifacts Local artifact cache used when MinIO upload is disabled or for direct downloads.
ASSET_WORKER_MINIO_ENABLED asset-worker true When true, optimized GLBs are written to MinIO using content-addressed keys.
ASSET_WORKER_MINIO_BUCKET asset-worker asset-worker MinIO bucket for optimized GLB outputs.
ASSET_WORKER_MINIO_ENDPOINT asset-worker In-network MinIO S3 API endpoint used by the worker.
ASSET_WORKER_MINIO_ACCESS_KEY asset-worker Optional MinIO access key override. Empty uses the generated asset-worker scoped MinIO account.
ASSET_WORKER_MINIO_SECRET_KEY asset-worker Optional MinIO secret key override. Empty uses the generated asset-worker scoped MinIO account.
ASSET_WORKER_IMAGE asset-worker python:3.12.9-slim Container image for asset-worker.
BACKEND_DB_USER backend atlas_backend Scoped PostgreSQL login for Backend and its Celery worker.
BACKEND_DB_PASSWORD backend atlas-db-password Auto-generated password for the scoped Backend database role.
BACKEND_DB_USER_URI backend atlas_backend Bootstrapper-synchronized percent-encoded BACKEND_DB_USER for DSN userinfo.
BACKEND_DB_PASSWORD_URI backend atlas-db-password Bootstrapper-synchronized percent-encoded BACKEND_DB_PASSWORD for DSN userinfo.
BACKEND_SOURCE backend container Adaptive core service; always container. Single-option.
BACKEND_PORT backend 63093 Host port that publishes the Backend API (in-container port 8000).
BACKEND_SCALE backend Always 1 (BACKEND_SOURCE is single-valued).
MAX_UPLOAD_BYTES backend 104857600 Maximum accepted /storage/upload body size in bytes before the backend returns 413.
COMFYUI_MAX_IMAGE_BYTES backend 20971520 Maximum input or generated-image bytes accepted by the Backend's ComfyUI bridge before it aborts the transfer.
COMFYUI_INIT_IMAGE_TRUSTED_ORIGINS backend Comma-separated exact HTTPS origins allowed for remote ComfyUI init-image URLs. Blank rejects all remote URLs; data URIs remain available.
COMFYUI_COMPLETION_TIMEOUT_SECONDS backend 300 End-to-end deadline in seconds for synchronous ComfyUI generation and workflow requests. The Backend poller and bundled Open WebUI tool share this default.
RAG_INGESTION_MAX_FILE_BYTES backend 104857600 Maximum bytes loaded from any single mounted or MinIO RAG corpus file. Oversize files fail ingestion before unbounded allocation.
RAG_INGESTION_MAX_CORPUS_BYTES backend 1073741824 Maximum aggregate bytes loaded by one RAG corpus discovery pass across mounted or MinIO files.
RAG_INGESTION_MAX_FILES backend 10000 Maximum number of files accepted in one mounted or MinIO RAG corpus discovery pass.
RAG_INGESTION_CORPUS_ROOT backend /app/corpus Container path under which operator-provided read-only RAG corpus mounts are resolved. Mount the same path into Backend and Celery worker when asynchronous ingestion is enabled.
CHONKIE_SEMANTIC_EMBEDDING_MODEL backend minishlab/potion-base-32M Non-empty Chonkie embedding model reference used by semantic chunking. Blank values use the bundled default. Shared by Backend and Celery ingestion workers.
LIGHTRAG_PIPELINE_STATUS_TIMEOUT_SECONDS backend 30 Finite per-request timeout in seconds for LightRAG pipeline-status polling. Values must be greater than 0 and no greater than 3600; invalid values use 30 seconds. Shared by Backend and Celery ingestion workers.
RAG_INGESTION_TTL_SECONDS backend 604800 Redis retention in seconds for RAG ingestion records and idempotency keys. Values must be from 60 through 31536000 (one year); invalid values use the seven-day default. Shared by Backend and Celery ingestion workers.
RAG_INGESTION_EXECUTION_LEASE_SECONDS backend 30 Renewable execution-ownership lease for RAG ingestion workers. Must be an integer from 10 through 300; duplicate deliveries retry until the active owner completes, an exact-owner recovery claim succeeds, or the lease expires.
BACKEND_STATE_STORE_MODE backend redis Shared operation-state mode: 'redis' (durable, multi-process default) or 'memory' (explicit single-process testing/ephemeral mode). Redis outages fail stateful routes with HTTP 503; they never trigger an in-memory fallback.
RESEARCH_SESSION_LEASE_SECONDS backend 300 Maximum age in seconds for pending research work or a running session heartbeat before the Backend atomically marks the abandoned session failed.
RESEARCH_MAX_CONCURRENT backend 4 Maximum research sessions admitted concurrently per Backend process. Excess start requests fail before database work with HTTP 429.
BACKEND_HEAVY_WORK_CONCURRENCY backend 4 Maximum /api/chunk and /api/rag/evaluate jobs the Backend runs at once, on a pool of its own so they cannot starve other routes. Further calls get HTTP 503 with Retry-After until a slot frees.
BACKEND_HEAVY_WORK_TIMEOUT_SECONDS backend 600 Seconds a /api/chunk or /api/rag/evaluate call waits for its result before answering HTTP 504. The job keeps its concurrency slot until its thread actually finishes.
BACKEND_PG_POOL_MIN backend 1 Minimum connections kept warm in the Backend's shared asyncpg pool. Short-lived DB operations draw from it instead of opening a new connection; long-hold paths (memory vector reconcile) keep dedicated connections.
BACKEND_PG_POOL_MAX backend 10 Maximum connections the Backend's shared asyncpg pool opens per database URL. Concurrent short-lived DB operations beyond this queue for a free slot rather than over-subscribing Postgres.
BACKEND_STORAGE_ALLOWED_BUCKETS backend default Comma-separated Supabase Storage bucket allowlist accepted by /storage/upload.
BACKEND_MEDIA_INPUT_BUCKET backend default Atlas storage bucket the media gateway hosts image_to_3d inputs in when a provider (e.g. Tripo) rejects data-URI inputs. Objects are written under the media-inputs/ prefix.
BACKEND_MEDIA_INPUT_PUBLIC_BASE_URL backend Optional public base URL for hosted media inputs. When set, hosted image_to_3d input URLs are <base>/<bucket>/<key>, so the provider's cloud can fetch them through a reachable ingress. Empty uses the storage client's public URL.
MEDIA_REQUEST_MAX_BYTES backend 41943040 Maximum POST /media/generate request body size in bytes. Oversized declared and streamed bodies are rejected with HTTP 413 before route parsing.
MEDIA_INPUT_MAX_BYTES backend 26214400 Maximum decoded image data-URI size in bytes, including conditioned output. Oversized base64 payloads are rejected before decoding.
MEDIA_INPUT_MAX_PIXELS backend 40000000 Maximum decoded or conditioned image pixel count. Dimensions are checked before full Pillow conversion to bound decompression and canvas memory.
MEDIA_BUDGET_ENABLED backend false Enables media spend accounting and budget enforcement. When off, ordinary operations record no spend rows and enforce no caps; ambiguous FAL submissions still create a recovery row.
MEDIA_BUDGET_STORE backend postgres Ledger/recovery store: 'postgres' (durable, media_spend_ledger table) or 'memory' (process-local, non-durable — testing/ephemeral). Ambiguous FAL submissions use it for recovery even when budget enforcement is disabled.
MEDIA_BUDGET_CURRENCY backend USD Currency label recorded on media spend ledger rows.
MEDIA_BUDGET_DEFAULT_USD backend Default per-consumer/project spend cap in USD. Empty = no default cap (ledger records without hard-stop). Per-consumer overrides go in MEDIA_BUDGET_CONSUMER_CAPS.
MEDIA_BUDGET_CONSUMER_CAPS backend Optional JSON map of per-scope caps, keyed by 'consumer' or 'consumer:project', e.g. {"rag-showcase":25,"rag-showcase:demo":5}. Overrides MEDIA_BUDGET_DEFAULT_USD for matching scopes. A 'consumer' key still caps each project separately, and user callers choose the project name, so it is not a per-user total.
MEDIA_DISABLED_PROVIDERS backend Comma-separated media providers to kill-switch off (e.g. 'fal', 'comfyui'). A disabled provider hard-stops its own submissions (/media/generate, /comfyui/generate and /comfyui/workflow, whether or not MEDIA_BUDGET_ENABLED is set) without downing the gateway or other providers.
MEDIA_BUDGET_ALLOW_UNKNOWN_COST backend false When false (default), a budgeted submission for a model with no known cost is rejected rather than billed an unknown amount (never silently $0). Set true to allow unknown-cost submissions under a cap.
MEDIA_BUDGET_RETENTION_DAYS backend Optional retention window in days for media spend ledger rows; empty keeps rows indefinitely (no pruning). When set, an hourly background sweep prunes rows older than the window.
MEDIA_OPERATION_TTL_SECONDS backend 604800 Redis retention in seconds for hosted media operation state. The default keeps terminal results available for seven days across Backend replicas and restarts.
MEDIA_LEDGER_RECOVERY_BATCH_SIZE backend 100 Maximum media ledger intents loaded in one bounded Redis recovery page. Must be an integer from 1 through 500.
MEDIA_LEDGER_RECOVERY_MAX_CYCLES backend 4 Maximum bounded media ledger pages processed per 30-second recovery poll. Must be an integer from 1 through 50; the cursor resumes on the next poll.
BACKEND_CORS_ORIGINS backend * Comma-separated browser origins accepted by the backend CORS middleware. Default preserves local-development permissiveness. Requests through Kong are also limited to local origins plus KONG_CORS_EXTRA_ORIGINS.
BACKEND_CORS_ALLOW_ORIGIN_REGEX backend Optional regex accepted by the backend CORS middleware for wildcard subdomain policies.
BACKEND_DEV_RELOAD backend false Opt-in uvicorn --reload for live development. Off by default: with backend_plugins bind-mounted, host-side git churn in the plugin tree would restart or crash-loop the backend. Plugins install at boot, so recreate the backend to apply plugin changes.
BACKEND_KONG_AUTH backend disabled Default gateway authentication for the api.localhost backend route: disabled (default, local development) or key-auth (requires an apikey header). A backend plugin's plugin.yml auth: setting (open or key-auth) overrides it per route prefix.
BACKEND_KONG_API_KEY backend Auto-generated key accepted by Kong when BACKEND_KONG_AUTH=key-auth. Send as apikey: <value>.
BACKEND_IDENTITY_AUTH backend required Application identity boundary for backend routes: required (default) accepts Supabase user JWTs or the trusted internal-service token; disabled is an explicit emergency rollback mode.
BACKEND_INTERNAL_API_TOKEN backend Auto-generated full-operator bearer token. Reserve for trusted administration; first-party services use narrower caller tokens.
BACKEND_N8N_API_TOKEN backend Auto-generated n8n bearer accepted only by the research, memory-automation, legacy ComfyUI, and storage-upload routes used by bundled workflows.
BACKEND_NOTEBOOK_API_TOKEN backend Auto-generated bearer token exposed to JupyterHub and accepted only by stateless backend document extraction, chunking, and RAG evaluation routes.
BACKEND_OPEN_WEBUI_API_TOKEN backend Auto-generated Open WebUI bearer accepted only by memory and legacy ComfyUI routes used by bundled server-side tools and functions.
BACKEND_PLUGINS_PIP_TIMEOUT_SECONDS backend 300 Timeout in seconds for pip install of backend plugin requirements (plugin_seam) at startup. The install runs at backend import time, so an unbounded hang would block startup; raise for slow networks.
BACKEND_PLUGINS_SITE_DIR backend /tmp/atlas-plugins-site Writable directory for plugin requirements (pip --target), prepended to sys.path before plugins load; site-packages is root-owned. If it cannot be created, pip installs untargeted. Emptied at each start; a custom directory only once it has the .atlas-plugin-site marker.
LANGMEM_ENABLED backend true Enables the Backend memory service in backend and celery-worker. false makes memory operations fail with "LangMem memory service is disabled".
LANGMEM_MEMORY_NAMESPACE backend default Default memory namespace (passed as LANGMEM_NAMESPACE to backend and celery-worker). A request that names its own namespace overrides it.
LANGMEM_AUTO_CONSOLIDATE backend true Reserved — not yet honored. Memory consolidation currently runs only on demand via POST /memory/consolidate; there is no background scheduler, so changing this value has no effect today.
LANGMEM_CONSOLIDATION_INTERVAL backend 86400 Reserved — not yet honored (see LANGMEM_AUTO_CONSOLIDATE). Interval in seconds a future auto-consolidation scheduler would use.
LANGMEM_MAX_FACTS_PER_USER backend 1000 Maximum active memory facts per user in backend and celery-worker. Extraction stops storing new facts at the limit, consolidation deactivates the oldest excess facts, and a restore beyond it fails with 409.
LANGMEM_EXTRACTION_MODEL backend LiteLLM model id (empty = highest-priority active content model resolved by model_resolver from YAML catalogs + env).
LANGMEM_EMBEDDING_MODEL backend Optional LiteLLM embedding model id. Empty falls back to LITELLM_EMBEDDING_MODEL.
LANGMEM_EMBEDDING_DIM backend 768 Validated output dimension shared by the selected LangMem embedding model, Backend pgvector queries, and the Supabase memory schema migration. Curated wizard selections derive this from services/*/models.yaml; custom models must declare it explicitly (1..4000, the pgvector halfvec HNSW limit).
GRAPHITI_ENABLED backend false Disabled-by-default backend-only Graphiti temporal graph memory experiment. Does not expose Graphiti to agents or run a Graphiti service.
GRAPHITI_GROUP_ID_PREFIX backend atlas Prefix for backend Graphiti group_id values. Final shape: atlas:<project>:backend:<namespace>:user:<uuid>.
GRAPHITI_DEFAULT_NAMESPACE backend langmem Default backend Graphiti namespace segment used when projecting selected LangMem facts/events.
GRAPHITI_LLM_MODEL backend Optional LiteLLM model id for Graphiti extraction. Empty falls back to LANGMEM_EXTRACTION_MODEL, then LITELLM_DEFAULT_MODEL.
GRAPHITI_EMBEDDING_MODEL backend Optional LiteLLM embedding model id for Graphiti. Empty falls back to LANGMEM_EMBEDDING_MODEL, then LITELLM_EMBEDDING_MODEL.
GRAPHITI_EXPOSE_TO_AGENTS backend false Must remain false for this backend-only evaluation; Hermes/OpenClaw exposure and Graphiti MCP are deferred.
RAGAS_EVALUATOR_MODEL backend Optional LiteLLM model id for Backend Ragas evaluation. Empty falls back to LITELLM_DEFAULT_MODEL.
RAGAS_EMBEDDINGS_MODEL backend Optional LiteLLM embedding model id for Backend Ragas answer-relevancy evaluation. Empty falls back to LITELLM_EMBEDDING_MODEL.
RAY_JOB_API_TOKEN backend Auto-generated bearer token required by every /api/ray/* route. Send as Authorization: Bearer <value>.
LIGHTRAG_RERANK_ADAPTER_ENABLED backend false Opt-in for the backend rerank adapter route POST /lightrag/rerank. When true and TEI_RERANKER_SOURCE is enabled, LightRAG reranks through the adapter and consumer profiles may set enable_rerank=true. Direct LightRAG-to-TEI rerank is unsupported (payload shapes differ).
LIGHTRAG_RERANK_ADAPTER_TOKEN backend Auto-generated bearer token guarding the /lightrag/rerank adapter route. Handed to LightRAG as RERANK_BINDING_API_KEY so the two share one secret. Send as Authorization: Bearer <value>.
LIGHTRAG_RERANK_ADAPTER_TIMEOUT_SECONDS backend 30 Finite per-request timeout in seconds for /lightrag/rerank calls to TEI. Must be greater than 0 and no greater than 3600; invalid values fail Backend startup.
BACKEND_IMAGE backend python:3.12.14-bookworm@sha256:581429e3df12d76e6af4be5ab7d0e7fc2013eb57dc23d2de691411c8efdbb970 Container image for backend.
BACKUP_SOURCE backup disabled Deployment mode: container (enable the runner) or disabled (default).
BACKUP_BUCKET backup atlas-backups Target bucket for backups.
BACKUP_S3_MODE backup local Credential/dependency mode: local uses on-stack MinIO and permits the documented MINIO_ROOT_* upgrade fallback; external requires dedicated BACKUP_S3_* credentials and has no MinIO runtime dependency.
BACKUP_S3_ENDPOINT backup http://minio:9000 S3 endpoint as a strict HTTP(S) origin: canonical DNS/IPv4 or bracketed IPv6, optional canonical port, and no userinfo/path/query/fragment. The default is on-stack MinIO.
BACKUP_S3_ACCESS_KEY backup Dedicated S3 access key. Required for external endpoints; local MinIO may fall back to MINIO_ROOT_USER for upgrade compatibility.
BACKUP_S3_SECRET_KEY backup Dedicated S3 secret key. Required for external endpoints; local MinIO may fall back to MINIO_ROOT_PASSWORD for upgrade compatibility.
BACKUP_S3_REGION backup us-east-1 S3 signing and bucket-creation region.
BACKUP_S3_SESSION_TOKEN backup Optional S3 security token for temporary credentials.
BACKUP_S3_TLS_VERIFY backup true Verify HTTPS certificates. false is valid only with an https endpoint and explicitly enables the MinIO client's insecure certificate mode.
BACKUP_S3_ALIAS_URL backup Deprecated pre-M11 endpoint variable accepted only as a migration fallback when BACKUP_S3_ENDPOINT remains at its local default.
BACKUP_COMMAND_TIMEOUT_SECONDS backup 900 Positive per-command deadline in seconds for package install, database, archive, and S3 operations.
BACKUP_RESTORE_GLOBAL_TIMEOUT_SECONDS backup 28800 Finite active-restore deadline; must exceed BACKUP_COMMAND_TIMEOUT_SECONDS. Hard-kill grace covers three bounded commands plus 60 seconds for compensation and exact lock cleanup.
BACKUP_MANIFEST_HMAC_KEY backup Required operator-supplied 64-hex HMAC-SHA-256 key for trusted backup manifests; preserve it outside the backup bucket for disaster recovery.
BACKUP_DEPLOYMENT_ID backup Required stable operator-supplied deployment identity bound into every trusted backup manifest.
BACKUP_MAX_POSTGRES_DUMP_BYTES backup 10737418240 Finite maximum PostgreSQL dump size accepted by both backup production and bounded restore download.
BACKUP_RESTORE_MAX_CANDIDATES backup 100 Maximum newest completion markers inspected by latest restore; use an exact BACKUP_TIMESTAMP for older backups.
BACKUP_DATABASES backup true Capture Neo4j and Weaviate using their consistency-safe contracts. Run through services/backup/run-consistent-backup.sh so Neo4j is quiesced first.
BACKUP_DATABASE_QUIESCE_TIMEOUT_SECONDS backup 120 Bounded host-side stop, start, and database snapshot status deadline.
BACKUP_MAX_DATABASE_ARCHIVE_BYTES backup 53687091200 Maximum bytes accepted for each Neo4j or Weaviate snapshot archive during backup and restore.
BACKUP_LOCAL_SNAPSHOT_RETENTION_COUNT backup 3 Completed local Neo4j/Weaviate native snapshot sets retained after authenticated publication (1-100); pruning runs only while the database services are quiesced.
BACKUP_LOCAL_ROLLBACK_RETENTION_COUNT backup 1 Validated offline rollback volumes retained per database after a successful restore cutover (1-20).
BACKUP_SCALE backup 0 (never long-running); the runner is invoked on demand via docker compose run.
BACKUP_IMAGE backup postgres:17.11-alpine@sha256:b0f9560a2de083e2cc7382e75f808c7381a32852a7ec49117deedb300e552b24 Digest-pinned build base for pg_dump/pg_restore; its major version must be >= the supabase-db server (17.x), or pg_dump aborts. The image bakes exact OpenSSL and the pgsty mc RELEASE.2026-09-16T00-00-00Z, copied from the digest-pinned pgsty/mc image. The entrypoint verifies its checksum and version for amd64/arm64.
BLENDER_MCP_SOURCE blender-mcp disabled Host-installed Blender MCP bridge source. Disabled by default because Blender MCP can execute generated Python code inside Blender.
BLENDER_MCP_HOST blender-mcp localhost Hostname written into the BLENDER_MCP_ENDPOINT hint for MCP clients. It does not change where the socket binds; BLENDER_MCP_BIND and BLENDER_MCP_ALLOW_REMOTE set the managed bind.
BLENDER_MCP_LOCALHOST_PORT blender-mcp 9876 Host port for the Blender MCP add-on socket. This is a host-tool port hint, not a Kong or container port.
BLENDER_MCP_ENDPOINT blender-mcp Resolved endpoint hint for MCP clients when BLENDER_MCP_SOURCE is a host source (localhost / managed-localhost).
BLENDER_MCP_STATE_DIR blender-mcp ~/.atlas/blender-mcp State directory for the managed-localhost source: pinned add-on, generated headless launcher, pid and log files. ./start.sh blender-mcp remove deletes it.
BLENDER_MCP_INSTANCES blender-mcp 1 Size of the managed-localhost pool, 1 to 16 (consumer manifest blender_mcp.instances). Instance 0 uses BLENDER_MCP_STATE_DIR and BLENDER_MCP_LOCALHOST_PORT; instance i uses <state dir>/instances/i and port BLENDER_MCP_LOCALHOST_PORT+i. Excess instances stop at the next start.
BLENDER_MCP_BIND blender-mcp 127.0.0.1 Bind address for the managed headless bridge. Loopback-only by default — execute_code runs arbitrary Python inside Blender; any other value is refused unless BLENDER_MCP_ALLOW_REMOTE=true.
BLENDER_MCP_ALLOW_REMOTE blender-mcp false Explicit second opt-in required to bind the managed bridge beyond loopback. Leave false unless you own the network boundary.
BLENDER_MCP_BLENDER_PATH blender-mcp Explicit Blender binary for the managed source. Empty = auto-detect (/Applications/Blender.app on macOS, blender on PATH elsewhere). Atlas manages the MCP bridge, not the Blender application — install Blender yourself.
BLENDER_MCP_ADDON_REF blender-mcp 6641189231caf3752302ae20591bc87fda85fc4e Pinned ahujasid/blender-mcp ref whose addon.py the managed source provisions. Move together with BLENDER_MCP_ADDON_SHA256.
BLENDER_MCP_ADDON_SHA256 blender-mcp bba60831f5f89a74deda0294b131668a086cf46eb35a6a01abbd0d21d9e92630 sha256 of the pinned addon.py; the manager refuses to install a mismatching download (it will later execute arbitrary Python).
BLENDER_MCP_ADDON_FILE blender-mcp Escape hatch: use a local add-on file instead of the pinned download (no sha verification; preflight warns).
CELERY_SOURCE celery disabled Deployment mode: container (backend worker + Flower) or disabled.
CELERY_WORKER_SCALE celery Set by ./start.sh from CELERY_SOURCE; do not edit. 1 runs celery-worker, 0 does not.
FLOWER_SCALE celery Set by ./start.sh from CELERY_SOURCE; do not edit. 1 runs the Flower monitoring UI, 0 does not.
FLOWER_PORT celery 63071 Host port for Flower (in-container 5555).
CELERY_BROKER_URL celery Redis broker URL; Atlas uses Redis database 4 for Celery.
CELERY_RESULT_BACKEND celery Redis result backend URL; Atlas uses Redis database 4 for Celery task state.
CELERY_QUEUE celery atlas Default Celery queue consumed by the Atlas backend worker.
CELERY_WORKER_CONCURRENCY celery 2 Positive worker process concurrency for backend async jobs. Invalid values fail Backend and worker startup.
CELERY_WORKER_PREFETCH_MULTIPLIER celery 1 Positive prefetch multiplier. The default reduces head-of-line blocking for long tasks; invalid values fail startup.
CELERY_TASK_TIME_LIMIT_SECONDS celery 900 Positive hard per-task limit. Must exceed the soft limit and remain below the broker visibility timeout.
CELERY_TASK_SOFT_TIME_LIMIT_SECONDS celery 840 Positive soft per-task limit. Must be strictly less than the hard limit.
CELERY_BROKER_VISIBILITY_TIMEOUT_SECONDS celery 3600 Positive Redis broker visibility timeout, strictly greater than the task hard limit. The worker raises it to 300 s past max(rag_ingestion hard limit, global hard limit + 60) when larger, so running or delayed tasks are not re-delivered.
RAG_INGESTION_TASK_SOFT_TIME_LIMIT_SECONDS celery Positive soft limit for the rag_ingestion task alone; other tasks keep CELERY_TASK_SOFT_TIME_LIMIT_SECONDS. Empty means the larger of 3840 and that value. An ingestion whose graph targets' timeout_seconds sum to at least this is refused at submission.
RAG_INGESTION_TASK_TIME_LIMIT_SECONDS celery Positive hard limit for the rag_ingestion task alone; must exceed the soft limit. Empty (default) means the larger of 3900 and CELERY_TASK_TIME_LIMIT_SECONDS.
FLOWER_IMAGE celery mher/flower:2.0.1 Container image for flower.
CHATTERBOX_PORT chatterbox 63059 Host port for the Chatterbox container (in-container listen port is 4123).
CHATTERBOX_LOCALHOST_PORT chatterbox 63044 Host port for the chatterbox-localhost source variant. URL is derived at compose-render time as http://host.docker.internal:63044.
CHATTERBOX_SCALE chatterbox Computed by bootstrapper/services/service_config.py::_generate_tts_provider_config — set to 1 when TTS_PROVIDER_SOURCE=chatterbox-container-gpu.
CHATTERBOX_IMAGE chatterbox travisvn/chatterbox-tts-api:gpu@sha256:8c0b379172d48b49d59d8f29a35fa23c0dc27955dba4d3ab41a77b2d71b4711f Rolling :gpu tag, pinned by digest. To refresh, run docker pull travisvn/chatterbox-tts-api:gpu and replace the digest.
CLOUD_OPENAI_SOURCE cloud-providers disabled Options: enabled, disabled.
OPENAI_API_KEY cloud-providers OpenAI API key used by LiteLLM when CLOUD_OPENAI_SOURCE=enabled.
OPENAI_USER_MODELS cloud-providers Comma-separated OpenAI model names the wizard activated.
CLOUD_ANTHROPIC_SOURCE cloud-providers disabled Options: enabled, disabled.
ANTHROPIC_API_KEY cloud-providers Anthropic API key used by LiteLLM when CLOUD_ANTHROPIC_SOURCE=enabled.
ANTHROPIC_USER_MODELS cloud-providers Comma-separated Anthropic model names the wizard activated.
CLOUD_OPENROUTER_SOURCE cloud-providers disabled Options: enabled, disabled.
OPENROUTER_API_KEY cloud-providers OpenRouter API key used by LiteLLM when CLOUD_OPENROUTER_SOURCE=enabled.
OPENROUTER_USER_MODELS cloud-providers Comma-separated OpenRouter model names the wizard activated.
LITELLM_OPENAI_ENABLED cloud-providers Derived from CLOUD_OPENAI_SOURCE.
LITELLM_ANTHROPIC_ENABLED cloud-providers Derived from CLOUD_ANTHROPIC_SOURCE.
LITELLM_OPENROUTER_ENABLED cloud-providers Derived from CLOUD_OPENROUTER_SOURCE.
LITELLM_ENABLED_PROVIDERS cloud-providers Comma-separated lowercase list of enabled cloud providers.
CLOUDFLARED_SOURCE cloudflared disabled Deployment mode: container (run the tunnel) or disabled (default).
CLOUDFLARE_TUNNEL_TOKEN cloudflared Cloudflare named-tunnel token (Zero Trust > Networks > Tunnels). When CLOUDFLARED_SOURCE=container this must be set or the daemon exits. The tunnel's public hostname is configured in the Cloudflare dashboard to point at http://kong-api-gateway:8000.
CLOUDFLARED_SCALE cloudflared Set to 1 when CLOUDFLARED_SOURCE=container, 0 when disabled.
CLOUDFLARED_IMAGE cloudflared cloudflare/cloudflared:2026.6.1 Cloudflare Tunnel daemon. Pin a dated tag; bump deliberately.
COMFYUI_SOURCE comfyui container-cpu Deployment source for ComfyUI: container-cpu (default), container-gpu, localhost, managed-localhost-mps or disabled. A consumer manifest may set auto to pick by host capability.
COMFYUI_INIT_SOURCE comfyui container Init-container selector listed in the SOURCE matrix (container or disabled). No code reads it: COMFYUI_INIT_SCALE follows COMFYUI_SOURCE.
COMFYUI_PORT comfyui 63054 Host port that publishes the comfyui container (in-container port 18188).
COMFYUI_LOCALHOST_PORT comfyui 8000 Host port for the localhost source variant. URL is derived at compose-render time as http://host.docker.internal:8000.
COMFYUI_MPS_LOCALHOST_PORT comfyui 8188 Fixed host port the Atlas-managed Apple-Silicon/MPS ComfyUI listens on (source=managed-localhost-mps). Containers reach it as http://host.docker.internal:8188. Named with the _LOCALHOST_ host-port convention so the topology slot allocator leaves the fixed default intact.
COMFYUI_MPS_REF comfyui v0.27.0 Pinned upstream ComfyUI git ref the managed MPS host process checks out (mirrors COMFYUI_REF for the container path). A release tag or full commit SHA.
COMFYUI_MPS_STATE_DIR comfyui ~/.atlas/comfyui-mps Atlas-owned host state directory for the managed MPS ComfyUI: the pinned checkout, its venv, and the pid/log/status files. Never a container volume.
COMFYUI_MPS_MODELS_PATH comfyui ~/Documents/ComfyUI/models Host models directory the managed MPS process reuses via extra_model_paths, so weights are not duplicated. Shared with COMFYUI_LOCAL_MODELS_PATH by default. Under managed-localhost-mps, the host provisioner also downloads COMFYUI_USER_MODELS here at start.
COMFYUI_MPS_MIN_MEMORY_GB comfyui 16 Minimum unified-memory headroom (GiB) the managed MPS preflight requires before launching ComfyUI; below this the preflight warns.
COMFYUI_MPS_TORCH_PIN comfyui torch==2.11.0 torchvision==0.26.0 torchaudio==2.11.0 Space-separated pip specifiers for Torch, torchvision and torchaudio that the managed MPS install applies. The pin keeps fresh installs reproducible against COMFYUI_MPS_REF; bump both together. macOS/arm64 Torch wheels include Metal/MPS.
COMFYUI_MPS_LISTEN comfyui 127.0.0.1 Bind address of the managed MPS ComfyUI process. Keep 127.0.0.1 on Docker Desktop/macOS. On Linux engines, host.docker.internal resolves to a bridge address that cannot reach loopback, so set 0.0.0.0. Health probes use 127.0.0.1 for 0.0.0.0 or ::.
COMFYUI_BASE_URL comfyui http://comfyui:18188 In-container default. Runtime value is COMFYUI_ENDPOINT computed by hook.
COMFYUI_KONG_URL comfyui http://kong-api-gateway:8000/comfyui Passed to the comfyui container as SUPABASE_URL for the inert Supabase output upload. Default http://kong-api-gateway:8000/comfyui.
COMFYUI_ARGS comfyui --listen ComfyUI launch arguments passed to the AI-Dock image verbatim. The manifest default is --listen; compose falls back to --listen --cpu when the value is unset.
COMFYUI_AUTO_UPDATE comfyui true AI-Dock startup update flag. Atlas keeps this true so COMFYUI_REF pins the upstream ComfyUI core even when the base image tag lags.
COMFYUI_REF comfyui v0.27.0 Pinned upstream ComfyUI git ref passed to AI-Dock. Use a release tag or full commit SHA when deliberately changing the ComfyUI core.
COMFYUI_PLATFORM comfyui linux/amd64 Compose platform for the comfyui image (default linux/amd64).
COMFYUI_UPLOAD_TO_SUPABASE comfyui true Inert placeholder. Nothing in the ai-dock image, Atlas provisioning or the backend reads it, so ComfyUI does not upload outputs to Supabase. Kept for a future output-upload custom node.
COMFYUI_STORAGE_BUCKET comfyui comfyui-images Reserved bucket name for the (currently inert) COMFYUI_UPLOAD_TO_SUPABASE placeholder; unused until an output-upload node is wired.
COMFYUI_MODELS_PATH comfyui /opt/ComfyUI/models Not interpolated by any compose file: comfyui-init sets its own COMFYUI_MODELS_PATH=/models, and the comfyui container mounts models at /opt/ComfyUI/models.
COMFYUI_LOCAL_MODELS_PATH comfyui ~/Documents/ComfyUI/models Host models directory of an existing ComfyUI install. With COMFYUI_SOURCE=localhost, ./start.sh warns when it is missing. The comfyui container mounts it read-only at /host_models, which nothing reads.
COMFYUI_USER_MODELS comfyui Comma-separated catalog model names picked in the wizard or with --comfyui-models. Read by services/comfyui/init/scripts/download_models.sh, and by the managed-MPS host provisioner, which downloads the same set into COMFYUI_MPS_MODELS_PATH.
COMFYUI_CUSTOM_MODELS_FILE comfyui /custom-models.yaml Path to the ComfyUI custom-models sidecar YAML (user-authored models not in the curated catalog). Read by comfyui_resolver when generating the download manifest, and by the wizard's model picker.
COMFYUI_CUSTOM_NODES_FILE comfyui /custom-nodes.yaml Path list (os.pathsep-joined) of pinned custom-node allowlist files. The shipped services/comfyui/custom-nodes.yaml is always included; consumer manifests append custom_nodes.comfyui entries, which are always active. The bootstrapper maps selected models' requires_custom_node values through it into active-custom-nodes.tsv.
COMFYUI_INIT_SCALE comfyui Set by ./start.sh; do not edit. 1 runs the comfyui-init model download for container-* sources, 0 for localhost, managed-localhost-mps and disabled.
COMFYUI_SCALE comfyui Set by ./start.sh from COMFYUI_SOURCE; do not edit. 1 runs the comfyui container for container-cpu and container-gpu, 0 otherwise.
COMFYUI_ENDPOINT comfyui Resolved per COMFYUI_SOURCE. Read by backend, celery, open-webui, jupyterhub and downstream overlays; hermes receives it as COMFYUI_INTERNAL_URL. Consumer pattern: MY_URL: ${MY_URL:-${COMFYUI_ENDPOINT:-http://comfyui:18188}}
COMFYUI_DEPLOY_RESOURCES comfyui ~ Derived by ./start.sh from the source's runtime deploy block ('~' when empty); do not set. No compose file reads it.
COMFYUI_MEMORY_LIMIT comfyui 40g Hard container-memory ceiling for ComfyUI (deploy.resources.limits.memory). The limit does not reserve memory; 40 g permits large multi-file bundles such as Krea 2 while smaller workloads consume only what they need.
COMFYUI_CPU_LIMIT comfyui 2.0 CPU limit for the comfyui container (deploy.resources.limits.cpus). The 2.0 default stops CPU-mode inference from monopolising the host. GPU mode is GPU-bound, so the cap rarely matters.
COMFYUI_IMAGE comfyui ghcr.io/ai-dock/comfyui:v2-cpu-22.04-v0.2.7 AI-Dock base image; COMFYUI_AUTO_UPDATE + COMFYUI_REF pin the upstream ComfyUI core at startup.
COMFYUI_INIT_IMAGE comfyui alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 Container image for comfyui-init.
CRAWL4AI_SOURCE crawl4ai disabled Deployment source for Crawl4AI: container or disabled (default).
CRAWL4AI_PORT crawl4ai 63050 Host port that publishes the crawl4ai container API (in-container port 11235).
CRAWL4AI_API_TOKEN crawl4ai Bearer token required by Crawl4AI's Docker API; auto-generated by the bootstrapper.
CRAWL4AI_TIMEOUT_SECONDS crawl4ai 30 Local Deep Researcher timeout for Crawl4AI extraction calls.
CRAWL4AI_MAX_CHARS crawl4ai 60000 Maximum markdown characters Local Deep Researcher keeps from each Crawl4AI result.
CRAWL4AI_ALLOW_INTERNAL_URLS crawl4ai false Keep false unless deliberately crawling private/internal URLs from inside the Atlas network.
CRAWL4AI_SCALE crawl4ai Set by ./start.sh from CRAWL4AI_SOURCE; do not edit. 1 runs crawl4ai, 0 does not.
CRAWL4AI_ENDPOINT crawl4ai Set by ./start.sh; do not edit. http://crawl4ai:11235 when CRAWL4AI_SOURCE=container, else empty. Read by Local Deep Researcher and n8n.
CRAWL4AI_IMAGE crawl4ai unclecode/crawl4ai:0.9.0 Container image for crawl4ai.
DOC_PROCESSOR_SOURCE docling disabled Deployment source for the document processor: disabled (default), docling-localhost (existing host Docling) or docling-container-gpu (NVIDIA).
DOC_PROCESSOR_PORT docling 63051 Host port that publishes the docling-gpu container API (in-container port 8000).
DOCLING_GPU_DEVICE docling cuda Torch device for the docling-gpu container, passed as DOCLING_DEVICE (default cuda).
DOCLING_OUTPUT_FORMAT docling markdown Default conversion output format when a request sets none: markdown (default), html, json or doctags.
DOCLING_USE_OCR docling auto Default OCR mode when a request sets none: auto (default), always or never.
DOCLING_TABLE_MODE docling accurate Default table-structure mode when a request sets none: accurate (default) or fast.
DOCLING_MAX_FILE_SIZE docling 52428800 Positive maximum upload bytes for Docling GPU, localhost, and adapter APIs. Request bodies are capped before multipart parsing with 1 MiB framing overhead; invalid values fail startup and oversized requests return 413.
DOCLING_UPLOAD_TIMEOUT_SECONDS docling 120 Total seconds (1-3600) allowed to receive one Docling or adapter upload body before a 408 response releases admission capacity.
DOCLING_CONCURRENCY docling 1 Maximum concurrent Docling conversions per provider process. Default 1 prevents duplicate model loads and GPU memory contention.
DOCLING_API_TOKEN docling Auto-generated bearer credential required by Docling routes except /health.
DOCLING_AUTH_MODE docling required Provider authentication mode: required (default) or disabled for an explicit emergency/local rollback.
DOCLING_CORS_ORIGINS docling Optional comma-separated browser origin allowlist. Empty disables CORS; wildcard is invalid while authentication is required.
DOCLING_INFERENCE_TIMEOUT_SECONDS docling 900 Finite conversion and lazy-load deadline in seconds (1-3600). A timeout returns 504 and then exits the provider process for restart.
DOCLING_LOCALHOST_BIND_HOST docling 127.0.0.1 Native Docling listen address. Set another interface explicitly only when remote access is intended.
DOCLING_ADAPTER_MAX_JOBS docling 2 Maximum outstanding LightRAG adapter jobs, reserved before multipart parsing.
DOCLING_ADAPTER_RESULT_TTL_SECONDS docling 900 Seconds a completed LightRAG adapter result may remain before verified artifact cleanup begins; the job slot stays occupied and cleanup is retried if deletion fails.
DOCLING_ADAPTER_MAX_RESULT_BYTES docling 104857600 Maximum ZIP result bytes streamed from Docling to adapter storage before the job fails safely.
DOCLING_ADAPTER_UPSTREAM_MAX_ATTEMPTS docling 3 Total bounded Docling request attempts when the provider returns HTTP 429.
DOCLING_ADAPTER_DOWNLOAD_TIMEOUT_SECONDS docling 300 Positive maximum seconds for one result transmission; expiry starts verified artifact cleanup, and the adapter slot is released only after deletion succeeds.
DOCLING_ADAPTER_TMPFS_SIZE docling 512m Size of the adapter's bounded temporary-storage mount. It must cover MAX_JOBS times the larger of upload + 1 MiB multipart overhead or upload + result limit, plus at least 64 MiB staging headroom. Startup fails if capacity is smaller.
DOCLING_ADAPTER_SCALE docling Derived adapter replica count; one only when both LightRAG and Docling are enabled.
DOCLING_ADAPTER_UPSTREAM_ENDPOINT docling Authenticated internal bundle route selected for the adapter; never exposed to LightRAG.
DOCLING_ENABLE_FORMULAS docling true Enables formula enrichment in the Docling pipeline: true (default) or false; other values fail.
DOCLING_ENABLE_CODE_BLOCKS docling true Enables code-block enrichment in the Docling pipeline: true (default) or false; other values fail.
DOCLING_CHUNK_SIZE docling 512 Default chunk size for chunked conversions. Must be a positive integer.
DOCLING_CHUNK_OVERLAP docling 50 Default chunk overlap. Must be non-negative and at most half of DOCLING_CHUNK_SIZE; invalid values fail startup.
DOCLING_GPU_SCALE docling Set by ./start.sh from DOC_PROCESSOR_SOURCE; do not edit. 1 runs docling-gpu for docling-container-gpu, 0 otherwise.
DOCLING_ENDPOINT docling Set by ./start.sh from DOC_PROCESSOR_SOURCE; do not edit. Docling URL (empty when disabled) read by backend, celery, jupyterhub and n8n.
DOCLING_LOCALHOST_PORT docling 18159 Host port for the localhost source variant. URL is derived at compose-render time as http://host.docker.internal:18159.
DOCLING_GPU_IMAGE docling pytorch/pytorch:2.13.0-cuda12.6-cudnn9-runtime@sha256:6acf597eeb8e376a96580dde4952f37cc017fef732bb40bfc73f28f25e3f64b4 Used as BASE_IMAGE in doc-processor/gpu/Dockerfile.
DOCLING_ADAPTER_IMAGE docling python:3.12.14-slim Minimal base image for the isolated LightRAG compatibility adapter.
FAL_SOURCE fal disabled Enables fal.ai as the backend provider for simple media generation routes.
FAL_API_KEY fal fal.ai API key. Required only when FAL_SOURCE=enabled. The backend also exposes it to fal-client as FAL_KEY.
FAL_MODEL fal fal-ai/flux/dev Default fal.ai model endpoint used by the media gateway for text-to-image generation.
FAL_IMAGE_TO_3D_MODEL fal fal-ai/trellis Default fal.ai endpoint id for the media gateway's image_to_3d modality. Must resolve to a verified registry entry (Hunyuan3D / TRELLIS / Tripo / Rodin); TRELLIS is the MIT-licensed default.
FAL_MODEL_LICENSE fal fal/provider-terms License or terms marker returned in normalized media operation responses when provider-specific model licensing is not more specific.
FAL_TIMEOUT_SECONDS fal 120 Finite Backend timeout budget for FAL media submit/poll operations and the compatibility route. Must be greater than zero and at most 3600 seconds.
FAL_OUTPUT_FORMAT fal jpeg Requested output format for compatible fal.ai image models: jpeg or png.
FAL_ENABLE_SAFETY_CHECKER fal true Whether to request the provider-side safety checker for compatible fal.ai image models.
PROJECT_NAME globals atlas Docker Compose project name: the prefix for containers, volumes and networks, and the docker compose -p namespace. start.sh and stop.sh both read it. ./start.sh --project <name> (or -p) writes it here. Use a unique name for a submodule consumer.
BASE_PORT globals 63000 Base port. Every service's *_PORT derives from this + a fixed offset.
HOST_BIND_IP globals 127.0.0.1: Published-port interface prefix (trailing colon). Default 127.0.0.1: is host-only; 0.0.0.0: is for deliberate remote access. Existing .env files with HOST_BIND_IP= are upgraded by backfill. Empty binds all interfaces except Ray, Zeppelin, mcp-servers, Supabase DB, Docling, Parakeet. LAN Supabase routes: KONG_SUPABASE_EXTRA_HOSTS.
HOST_GATEWAY_IP globals Set by ./start.sh for the container runtime: host-gateway on Docker, the literal gateway IP on Podman. If you write .env without ./start.sh, use host-gateway on Docker, or the real bridge IP on rootless setups.
BRAND_NAME globals Atlas Wizard branding: the brand name shown by the wizard and --no-tui banner. Empty uses the Atlas default.
BRAND_TAGLINE globals A self-hosted, source-configurable, multi-disciplinary engineering platform — gen-AI, ML, and data. Wizard branding: the tagline shown by the wizard and --no-tui banner. Empty uses the Atlas default.
BRAND_VERSION globals 0.1.0 Wizard branding: the version shown by the wizard and --no-tui banner. Empty uses the Atlas default.
BRAND_AUTHOR globals Kaveh Razavi Wizard branding: the author shown by the wizard and --no-tui banner. Empty uses the Atlas default.
BRAND_AUTHOR_EMAIL globals [email protected] Wizard branding: the author email shown by the wizard and --no-tui banner. Empty uses the Atlas default.
BRAND_LICENSE globals Apache License 2.0 Wizard branding: the license shown by the wizard and --no-tui banner. Empty uses the Atlas default.
BRAND_REPO_URL globals https://github.com/thekaveh/atlas Wizard branding: the repository URL shown by the wizard and --no-tui banner. Empty uses the Atlas default.
BRAND_LOGO_FILE globals Optional path to a block-art logo that replaces the built-in ATLAS lockup in the wizard and --no-tui banner. Empty keeps ATLAS. Keep it 6 rows tall. File format: docs/quick-start/interactive-setup-wizard.md (Brand Customization).
COMPOSE_PROFILES globals Docker Compose profile activation list. Rebuilt from scratch on every ./start.sh run from the active STT/TTS/doc-processor sources (speaches-cpu/-gpu, parakeet-gpu, chatterbox-gpu, docling-gpu/doc-gpu). Do not edit by hand — the bootstrapper owns this value.
NVIDIA_VISIBLE_DEVICES globals all Host-side GPU visibility. Forwarded into every NVIDIA-runtime container.
PROD_ENV_CPUS globals 2 Reserved default container CPU cap (cores). No compose fragment reads it yet.
PROD_ENV_MEM_LIMIT globals 8g Reserved default container memory cap. No compose fragment reads it yet.
PROD_ENV_BACKEND_CPUS globals 1 Reserved backend CPU cap (cores). No compose fragment reads it yet; the backend runs unbounded.
PROD_ENV_BACKEND_MEM_LIMIT globals 2g Reserved backend memory cap. No compose fragment reads it yet; the backend runs unbounded.
PROD_ENV_N8N_CPUS globals 1 Reserved n8n CPU cap (cores). No compose fragment reads it yet; n8n runs unbounded.
PROD_ENV_N8N_MEM_LIMIT globals 2g Reserved n8n memory cap. No compose fragment reads it yet; n8n runs unbounded.
PROD_ENV_COMFYUI_CPUS globals 2 CPU limit (cores) for ComfyUI with COMFYUI_SOURCE=container-gpu. The CPU variant uses COMFYUI_CPU_LIMIT instead.
PROD_ENV_COMFYUI_MEM_LIMIT globals 4g Memory limit for ComfyUI with COMFYUI_SOURCE=container-gpu. The CPU variant uses COMFYUI_MEMORY_LIMIT instead.
LOG_MAX_SIZE globals 10m Per-container json-file log max size (Docker logging option).
LOG_MAX_FILE globals 3 Per-container json-file log file count (Docker logging option).
BOOTSTRAPPER_PORT_LAYOUT_VERSION globals 5 Env-migration sentinel. A missing value or one below 5 runs the chained migrations up to v5. They cover port layout, URL to PORT, ComfyUI model set, stale Ollama model cleanup and Weaviate backup-filesystem. Fresh .env files are v5.
GRAFANA_SOURCE grafana disabled Deployment source for Grafana: container or disabled.
GRAFANA_PORT grafana 63009 Host port for Grafana's HTTP server (in-container 3000).
GRAFANA_ADMIN_USERNAME grafana admin Grafana admin login. Override in .env if needed.
GRAFANA_ADMIN_PASSWORD grafana Auto-generated on first bootstrap and saved to .env. Grafana applies it only when it creates its database on an empty grafana-data volume. To rotate, run grafana cli admin reset-admin-password in the container, then update .env.
GRAFANA_ENDPOINT grafana Set by ./start.sh from GRAFANA_SOURCE; do not edit. http://grafana:3000 for the container source, empty when disabled.
GRAFANA_SCALE grafana Set by ./start.sh from GRAFANA_SOURCE; do not edit. 1 runs grafana, 0 does not.
GRAFANA_IMAGE grafana grafana/grafana:11.4.3 Container image for grafana.
HERMES_SOURCE hermes container Deployment source for Hermes: container, localhost (an existing host Hermes) or disabled.
HERMES_API_PORT hermes 63072 Host port for the Hermes Agent OpenAI-compatible API (in-container listen port is 8642).
HERMES_DASHBOARD_PORT hermes 63073 Reserved compatibility allocation; no container dashboard host publish. Kong reaches container port 9119.
HERMES_MEMORY_LIMIT hermes 4g Memory limit of the hermes container.
HERMES_CPU_LIMIT hermes 2.0 CPU limit (cores) of the hermes container.
HERMES_API_KEY hermes Auto-generated by bootstrapper. Hermes's API server bearer key, passed to Hermes as API_SERVER_KEY; LiteLLM's hermes-agent row reads the same value as HERMES_API_KEY.
HERMES_DEFAULT_MODEL hermes Empty = hermes-init picks from LiteLLM /v1/models priority list.
HERMES_CONTEXT_LENGTH hermes 65536 Context length hermes-init writes into config.yaml for the default model. Hermes requires a model context window of at least 64K.
HERMES_DASHBOARD_ENABLED hermes true Requested dashboard setting. Atlas forwards it only for container Hermes with configured container Kong. Empty retains the true default. Set false to remove the Chat tab.
HERMES_DASHBOARD_EFFECTIVE hermes Auto-managed dashboard flag from requested setting and launch sources. Container-facing HERMES_DASHBOARD defaults false before Atlas computes it. This does not check gateway health.
HERMES_DASHBOARD_TUI hermes 1 Inert: Hermes v2026.6.19 always embeds the dashboard Chat tab (PTY terminal) and ignores this value; disable the dashboard (HERMES_DASHBOARD_ENABLED=false) to remove it.
HERMES_DASHBOARD_INSECURE hermes true True permits unauthenticated backend-network access behind Kong. False requires an OAuth provider with a provisioned client ID (HERMES_DASHBOARD_OAUTH_CLIENT_ID or dashboard.oauth.client_id). Atlas passes through HERMES_DASHBOARD_OAUTH_CLIENT_ID but does not provision clients. False without a provider: dashboard refuses startup and restarts.
HERMES_DASHBOARD_OAUTH_CLIENT_ID hermes Provisioned upstream OAuth client ID, passed through unchanged. A nonempty value takes precedence over dashboard.oauth.client_id. Atlas does not provision clients.
HERMES_UID hermes 10000 Container user — match a host UID to read hermes-data from outside.
HERMES_GID hermes 10000 Container group ID; hermes-init chowns hermes-data to HERMES_UID:HERMES_GID.
HERMES_LOCALHOST_PORT hermes 8642 Host port for the Hermes API in the localhost source variant. Consumed by HERMES_ENDPOINT (in-container clients call this). Defaults to Hermes' native API port.
HERMES_LOCALHOST_DASHBOARD_PORT hermes 9119 Host port of the Hermes dashboard for HERMES_SOURCE=localhost; the hermes.localhost Kong route targets it. Default: the native dashboard port. The wizard edits only HERMES_LOCALHOST_PORT, so set this one in .env.
HERMES_INIT_SOURCE hermes container Auto-managed by hermes. Container/disabled.
HERMES_INIT_SCALE hermes Set by ./start.sh from HERMES_SOURCE; do not edit. 1 runs hermes-init only for the container source, else 0.
HERMES_SCALE hermes Set by ./start.sh from HERMES_SOURCE; do not edit. 1 runs the hermes container only for the container source, else 0.
HERMES_ENDPOINT hermes Resolved per HERMES_SOURCE. Consumed by n8n, jupyterhub, LiteLLM model_list; also env-pre-wired for backend + openclaw (not yet exercised).
TTS_INTERNAL_URL hermes Set by ./start.sh from TTS_PROVIDER_SOURCE; do not edit. hermes-init renders the TTS block of config.yaml from it; empty omits the block.
STT_INTERNAL_URL hermes Set by ./start.sh from STT_PROVIDER_SOURCE; do not edit. hermes-init renders the STT block of config.yaml from it; empty omits the block.
STT_INTERNAL_API_KEY hermes Parakeet bearer token for the rendered server-side STT block; non-secret compatibility placeholder for other enabled STT engines.
COMFYUI_INTERNAL_URL hermes Set by ./start.sh from COMFYUI_ENDPOINT; do not edit. hermes-init renders the ComfyUI host skill from it; empty skips the skill.
SEARXNG_INTERNAL_URL hermes Set by ./start.sh from SEARXNG_SOURCE; do not edit. hermes-init renders the web-search block of config.yaml from it; empty omits the block.
LIGHTRAG_INTERNAL_URL hermes Set by ./start.sh from LIGHTRAG_ENDPOINT; do not edit. hermes-init receives it, but config.yaml has no LightRAG block; Hermes reaches LightRAG through LiteLLM.
HERMES_IMAGE hermes nousresearch/hermes-agent:v2026.6.19 Container image for hermes.
HERMES_INIT_IMAGE hermes alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 Container image for hermes-init.
ICEBERG_REST_SOURCE iceberg-rest disabled Deployment source for the Iceberg REST catalog: container or disabled. The container source requires MINIO_SOURCE to be enabled.
ICEBERG_REST_PORT iceberg-rest 63022 Host port for the Iceberg REST Catalog API (in-container 8181).
ICEBERG_DB_USER iceberg-rest iceberg Scoped Postgres login for the catalog JDBC store (database iceberg). Supabase db-init (05-scoped-roles.sh) creates it.
ICEBERG_DB_PASSWORD iceberg-rest atlas-db-password Auto-generated by bootstrapper. Postgres role for the Iceberg JDBC catalog DB.
ICEBERG_REST_POSTGRES_JDBC_VERSION iceberg-rest 42.7.12 PostgreSQL JDBC driver version layered into the local Iceberg REST image build.
ICEBERG_REST_POSTGRES_JDBC_SHA512 iceberg-rest 3759e7160591863e5100361298943df94488a6e4ee03936d20723638142fe8038c9a6a47fa8ee7e424f4ef09bb351edc89dfe2ae4acdfc0f92699a8b00196c5c SHA-512 digest required for the PostgreSQL JDBC driver selected above. Update both values together.
ICEBERG_REST_SCALE iceberg-rest Set by ./start.sh from ICEBERG_REST_SOURCE; do not edit. 1 runs iceberg-rest, 0 does not.
ICEBERG_REST_INIT_SCALE iceberg-rest Set by ./start.sh from ICEBERG_REST_SOURCE; do not edit. 1 runs iceberg-rest-init, 0 does not.
ICEBERG_REST_IMAGE iceberg-rest apache/iceberg-rest-fixture:1.10.1 Base image for the local Atlas build. Atlas layers the PostgreSQL JDBC driver onto the Apache fixture image.
ICEBERG_REST_INIT_IMAGE iceberg-rest postgres:15.19-alpine Container image for iceberg-rest-init.
JENKINS_SOURCE jenkins disabled Deployment source for Jenkins: container or disabled. The container source requires MINIO_SOURCE to be enabled.
JENKINS_PORT jenkins 63090 Host port for the Jenkins Web UI (in-container 8080).
JENKINS_SCALE jenkins Set by ./start.sh from JENKINS_SOURCE; do not edit. 1 runs the Jenkins controller, 0 does not.
JENKINS_ADMIN_USER jenkins admin Jenkins admin login created by JCasC.
JENKINS_ADMIN_PASSWORD jenkins Auto-generated on first bootstrap by KeyGenerator.generate_jenkins_admin_password().
JENKINS_MEMORY_LIMIT jenkins 3g Container memory limit for Jenkins controller and local Maven builds.
JENKINS_CPU_LIMIT jenkins 2.0 Container CPU limit for Jenkins controller and local Maven builds.
JENKINS_IMAGE jenkins jenkins/jenkins:lts-jdk21@sha256:c1e4c349365f6d16d88595b2c5f7e8ff39b8ae1d061f62420bac193b4b9616d0 Jenkins LTS with JDK 21; Atlas builds a local derived image with Maven, MinIO mc, and plugins. The default pins lts-jdk21 to a reviewed digest, because the bare tag moves on each new LTS line. To refresh, run docker pull jenkins/jenkins:lts-jdk21 and set the new digest.
JUPYTER_DB_USER jupyterhub atlas_jupyter Read-only PostgreSQL login exposed to curated notebooks.
JUPYTER_DB_PASSWORD jupyterhub atlas-db-password Auto-generated password for JupyterHub's read-only database role.
JUPYTER_DB_USER_URI jupyterhub atlas_jupyter Bootstrapper-synchronized percent-encoded JUPYTER_DB_USER for DSN userinfo.
JUPYTER_DB_PASSWORD_URI jupyterhub atlas-db-password Bootstrapper-synchronized percent-encoded JUPYTER_DB_PASSWORD for DSN userinfo.
JUPYTERHUB_SOURCE jupyterhub container Deployment source for the JupyterLab notebook server: container or disabled.
JUPYTERHUB_PORT jupyterhub 63094 Host port for the JupyterLab server (in-container 8888).
JUPYTERHUB_TOKEN jupyterhub Optional. Empty = generate on start.
JUPYTER_ALLOW_ORIGIN jupyterhub Allowed browser origin for Jupyter Server websocket upgrades. Empty keeps Jupyter's same-origin check; token clients such as VS Code do not need '*'. Set one exact origin only for a browser page on another origin.
SPARK_REMOTE jupyterhub sc://spark-connect:15002 Spark Connect endpoint used by bundled notebooks; override for a remote or managed Spark Connect server.
MCP_SERVERS_URL jupyterhub Streamable HTTP URL for the Curated MCP Servers endpoint. The bootstrapper sets http://mcp-servers:8000/mcp only for MCP_SERVERS_SOURCE=container and clears it when disabled.
JUPYTERHUB_SCALE jupyterhub Set by ./start.sh from JUPYTERHUB_SOURCE; do not edit. 0 when disabled, else 1.
JUPYTERHUB_IMAGE jupyterhub quay.io/jupyter/datascience-notebook:2026-08-24@sha256:e5029672ab8a861345f117dc466a4dab91ad7c299f3c7c853b9b193860b16aaf Container image for jupyterhub.
KONG_API_GATEWAY_SOURCE kong container Single-option (container only).
KONG_HTTP_PORT kong 63000 Host port for the Kong HTTP proxy (in-container 8000). Every *.localhost route uses it.
KONG_HTTPS_PORT kong 63001 Host port for the Kong HTTPS proxy (in-container 8443).
KONG_CORS_EXTRA_ORIGINS kong Comma-separated exact browser origins (scheme://host[:port]) Kong allows cross-origin, beyond *.localhost, localhost and 127.0.0.1. Values are normalised; wildcards and paths are ignored with a warning. Read at Kong config generation.
KONG_SUPABASE_EXTRA_HOSTS kong Comma-separated extra lowercase Host names (bare hostname or IPv4) the Supabase API routes answer on, beyond the local defaults. Use for a tunnel, LAN address or custom API_EXTERNAL_URL host. Other Hosts get 404. Read at Kong config generation.
DASHBOARD_USERNAME kong kong_admin Username of Kong's Basic-auth dashboard consumer, which gates Supabase Studio, /pg/ and other dashboard routes such as hermes.localhost.
DASHBOARD_PASSWORD kong kong_password Auto-generated on first ./start.sh when left at the placeholder (rotate-when-absent, like MINIO_ROOT_PASSWORD). Gates the Kong-routed Studio dashboard via basic-auth.
KONG_API_GATEWAY_IMAGE kong kong:3.9.3 Container image for kong-api-gateway.
LABEL_STUDIO_SOURCE label-studio disabled Deployment source for Label Studio: container or disabled. The container source requires MINIO_SOURCE to be enabled.
LABEL_STUDIO_PORT label-studio 63091 Host port for the Label Studio UI/API (in-container 8080).
LABEL_STUDIO_ENDPOINT label-studio In-network URL for Atlas services and notebooks.
LABEL_STUDIO_API_URL label-studio Notebook/backend API URL; empty when Label Studio is disabled.
LABEL_STUDIO_SCALE label-studio Set by ./start.sh from LABEL_STUDIO_SOURCE; do not edit. 1 runs label-studio, 0 does not.
LABEL_STUDIO_INIT_SCALE label-studio Set by ./start.sh from LABEL_STUDIO_SOURCE; do not edit. 1 runs label-studio-init, 0 does not.
LABEL_STUDIO_DB_NAME label-studio label_studio Postgres database for Label Studio. Supabase db-init (05-scoped-roles.sh) creates it.
LABEL_STUDIO_DB_NAME_URI label-studio label_studio Bootstrapper-synchronized percent-encoded LABEL_STUDIO_DB_NAME for DSN path components.
LABEL_STUDIO_DB_USER label-studio label_studio Scoped Postgres login that owns LABEL_STUDIO_DB_NAME. Supabase db-init (05-scoped-roles.sh) creates it.
LABEL_STUDIO_DB_PASSWORD label-studio atlas-db-password Auto-generated Postgres password for the dedicated Label Studio database role.
LABEL_STUDIO_USERNAME label-studio [email protected] Initial Label Studio admin email passed to upstream USERNAME.
LABEL_STUDIO_PASSWORD label-studio Auto-generated initial Label Studio admin password.
LABEL_STUDIO_USER_TOKEN label-studio Auto-generated legacy API token for notebook/API smoke paths.
LABEL_STUDIO_SECRET_KEY label-studio Django SECRET_KEY used by the Label Studio container.
LABEL_STUDIO_IMAGE label-studio heartexlabs/label-studio:1.23.0 Container image for label-studio.
LABEL_STUDIO_INIT_IMAGE label-studio alpine:3.24.2 Container image for label-studio-init.
LANGFUSE_SOURCE langfuse disabled Deployment source for Langfuse (web, worker and ClickHouse): container or disabled. The container source requires MINIO_SOURCE to be enabled.
LANGFUSE_PORT langfuse 63005 Host port for the Langfuse web UI/API (in-container 3000).
LANGFUSE_ENDPOINT langfuse In-network URL used by LiteLLM when Langfuse tracing is enabled.
LANGFUSE_WEB_SCALE langfuse Set by ./start.sh from LANGFUSE_SOURCE; do not edit. 1 runs langfuse-web, 0 does not.
LANGFUSE_WORKER_SCALE langfuse Set by ./start.sh from LANGFUSE_SOURCE; do not edit. 1 runs langfuse-worker, 0 does not.
LANGFUSE_CLICKHOUSE_SCALE langfuse Set by ./start.sh from LANGFUSE_SOURCE; do not edit. 1 runs langfuse-clickhouse, 0 does not.
LANGFUSE_INIT_SCALE langfuse Set by ./start.sh from LANGFUSE_SOURCE; do not edit. 1 runs langfuse-init, 0 does not.
LANGFUSE_DB_NAME langfuse langfuse Postgres database for Langfuse. Supabase db-init (05-scoped-roles.sh) creates it.
LANGFUSE_DB_NAME_URI langfuse langfuse Bootstrapper-synchronized percent-encoded LANGFUSE_DB_NAME for DSN path components.
LANGFUSE_DB_USER langfuse langfuse Scoped Postgres login that owns LANGFUSE_DB_NAME. Supabase db-init (05-scoped-roles.sh) creates it.
LANGFUSE_DB_PASSWORD langfuse atlas-db-password Auto-generated password for the owner of Langfuse's dedicated database.
LANGFUSE_DB_USER_URI langfuse langfuse Bootstrapper-synchronized percent-encoded LANGFUSE_DB_USER for DSN userinfo.
LANGFUSE_DB_PASSWORD_URI langfuse atlas-db-password Bootstrapper-synchronized percent-encoded LANGFUSE_DB_PASSWORD for DSN userinfo.
LANGFUSE_SALT langfuse Auto-generated by the bootstrapper on first run.
LANGFUSE_ENCRYPTION_KEY langfuse 64 hex chars. Auto-generated by the bootstrapper on first run.
LANGFUSE_NEXTAUTH_SECRET langfuse Auto-generated by the bootstrapper on first run.
LANGFUSE_PUBLIC_KEY langfuse Initial Langfuse project public key used by LiteLLM tracing.
LANGFUSE_SECRET_KEY langfuse Initial Langfuse project secret key used by LiteLLM tracing.
LANGFUSE_INIT_ORG_ID langfuse atlas Organisation ID that langfuse-web headless init creates on first start.
LANGFUSE_INIT_ORG_NAME langfuse Atlas Organisation name that langfuse-web headless init creates on first start.
LANGFUSE_INIT_PROJECT_ID langfuse atlas-default Project ID that langfuse-web headless init creates on first start, with LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY as its API keys.
LANGFUSE_INIT_PROJECT_NAME langfuse Atlas Default Project name that langfuse-web headless init creates on first start.
LANGFUSE_INIT_USER_EMAIL langfuse [email protected] Login email of the initial Langfuse user that headless init creates on first start.
LANGFUSE_INIT_USER_NAME langfuse Atlas Admin Display name of the initial Langfuse user that headless init creates on first start.
LANGFUSE_INIT_USER_PASSWORD langfuse Auto-generated by the bootstrapper on first run.
LANGFUSE_CLICKHOUSE_USER langfuse clickhouse ClickHouse user for langfuse-clickhouse, also used by langfuse-web and langfuse-worker.
LANGFUSE_CLICKHOUSE_PASSWORD langfuse Auto-generated by the bootstrapper on first run.
LANGFUSE_IMAGE langfuse langfuse/langfuse:3.115.0 Container image for langfuse-web.
LANGFUSE_WORKER_IMAGE langfuse langfuse/langfuse-worker:3.115.0 Container image for langfuse-worker.
LANGFUSE_CLICKHOUSE_IMAGE langfuse clickhouse/clickhouse-server:25.8.33.6 Container image for langfuse-clickhouse.
LANGFUSE_INIT_IMAGE langfuse alpine:3.24.2 Container image for langfuse-init.
LIGHTRAG_DB_USER lightrag atlas_lightrag Scoped PostgreSQL owner for LightRAG PGVectorStorage relations.
LIGHTRAG_DB_PASSWORD lightrag atlas-db-password Auto-generated password for the scoped LightRAG database role.
LIGHTRAG_DB_USER_URI lightrag atlas_lightrag Bootstrapper-synchronized percent-encoded LIGHTRAG_DB_USER for DSN userinfo.
LIGHTRAG_DB_PASSWORD_URI lightrag atlas-db-password Bootstrapper-synchronized percent-encoded LIGHTRAG_DB_PASSWORD for DSN userinfo.
LIGHTRAG_SOURCE lightrag disabled Deployment source for LightRAG: container, localhost (an existing host LightRAG) or disabled.
LIGHTRAG_API_PORT lightrag 63074 Host port for LightRAG (in-container 9621).
LIGHTRAG_LOCALHOST_PORT lightrag 63068 Host port for the localhost source variant.
LIGHTRAG_API_KEY lightrag Auto-generated bearer key. Forwarded to LiteLLM as the model api_key.
LIGHTRAG_TOKEN_SECRET lightrag Auto-generated JWT signing key for LightRAG's /login endpoint. Without this, LightRAG falls back to a hardcoded default key (security risk).
LIGHTRAG_WORKERS lightrag 2 Passed as WORKERS but inert: the image starts lightrag.api.lightrag_server under a single uvicorn process (WORKERS is read only by lightrag-gunicorn).
LIGHTRAG_MEMORY_LIMIT lightrag 6g Memory limit of the lightrag container.
LIGHTRAG_CPU_LIMIT lightrag 2.0 CPU limit (cores) of the lightrag container.
LIGHTRAG_LLM_BINDING lightrag openai Base LightRAG LLM binding, through LiteLLM at LIGHTRAG_LLM_BINDING_HOST by default. A role without its own binding, host or key inherits it. Exception: with a direct-provider base, a role whose model declares catalog request_defaults stays on LiteLLM.
LIGHTRAG_LLM_BINDING_HOST lightrag http://litellm:4000/v1 Base LightRAG LLM endpoint (LLM_BINDING_HOST). Default: the in-network LiteLLM.
LIGHTRAG_LLM_MODEL lightrag Empty = lightrag-init resolves from LITELLM_DEFAULT_MODEL.
LIGHTRAG_EXTRACT_LLM_MODEL lightrag Optional LightRAG EXTRACT role model. Empty = inherit LLM_MODEL.
LIGHTRAG_KEYWORD_LLM_MODEL lightrag Optional LightRAG KEYWORD role model. Empty = inherit LLM_MODEL.
LIGHTRAG_QUERY_LLM_MODEL lightrag Optional LightRAG QUERY role model. Empty = inherit LLM_MODEL.
LIGHTRAG_EXTRACT_LLM_BINDING lightrag Optional EXTRACT role provider binding. Empty = inherit LLM_BINDING.
LIGHTRAG_KEYWORD_LLM_BINDING lightrag Optional KEYWORD role provider binding. Empty = inherit LLM_BINDING.
LIGHTRAG_QUERY_LLM_BINDING lightrag Optional QUERY role provider binding. Empty = inherit LLM_BINDING.
LIGHTRAG_EXTRACT_LLM_BINDING_HOST lightrag Optional EXTRACT role provider endpoint. Empty = inherit LLM_BINDING_HOST.
LIGHTRAG_KEYWORD_LLM_BINDING_HOST lightrag Optional KEYWORD role provider endpoint. Empty = inherit LLM_BINDING_HOST.
LIGHTRAG_QUERY_LLM_BINDING_HOST lightrag Optional QUERY role provider endpoint. Empty = inherit LLM_BINDING_HOST.
LIGHTRAG_EXTRACT_LLM_BINDING_API_KEY lightrag Optional EXTRACT role API key. Unset means the LiteLLM master key, but only if the role's effective host is the in-network LiteLLM. A role with its own binding or host elsewhere must set it, or the container exits.
LIGHTRAG_KEYWORD_LLM_BINDING_API_KEY lightrag Optional KEYWORD role API key. Unset means the LiteLLM master key, but only if the role's effective host is the in-network LiteLLM. A role with its own binding or host elsewhere must set it, or the container exits.
LIGHTRAG_QUERY_LLM_BINDING_API_KEY lightrag Optional QUERY role API key. Unset means the LiteLLM master key, but only if the role's effective host is the in-network LiteLLM. A role with its own binding or host elsewhere must set it, or the container exits.
LIGHTRAG_EXTRACT_OLLAMA_LLM_NUM_PREDICT lightrag 4096 EXTRACT output cap in tokens when EXTRACT is bound to native Ollama; other bindings ignore it. Without it Ollama output is unbounded. Must be an integer. Cached extractions keep any truncation, so clear the LightRAG LLM cache after raising it.
LIGHTRAG_EXTRACT_OLLAMA_LLM_NUM_CTX lightrag 16384 EXTRACT context window in tokens when EXTRACT is bound to native Ollama; other bindings ignore it. The default fits the extraction prompt, gleaning pass, merge summaries and output cap. Overrides Ollama's VRAM-based default and OLLAMA_CONTEXT_LENGTH. Must be an integer.
LIGHTRAG_EXTRACT_MAX_ASYNC_LLM lightrag Optional EXTRACT role LLM concurrency. Empty = inherit MAX_ASYNC_LLM.
LIGHTRAG_KEYWORD_MAX_ASYNC_LLM lightrag Optional KEYWORD role LLM concurrency. Empty = inherit MAX_ASYNC_LLM.
LIGHTRAG_QUERY_MAX_ASYNC_LLM lightrag Optional QUERY role LLM concurrency. Empty = inherit MAX_ASYNC_LLM.
LIGHTRAG_EXTRACT_LLM_TIMEOUT lightrag Optional EXTRACT role LLM timeout in seconds. Empty = inherit LLM_TIMEOUT.
LIGHTRAG_KEYWORD_LLM_TIMEOUT lightrag Optional KEYWORD role LLM timeout in seconds. Empty = inherit LLM_TIMEOUT.
LIGHTRAG_QUERY_LLM_TIMEOUT lightrag Optional QUERY role LLM timeout in seconds. Empty = inherit LLM_TIMEOUT.
LIGHTRAG_QUERY_ENABLE_RERANK lightrag false LightRAG query default for reranking. Atlas keeps this false by default because direct LightRAG→TEI rerank payloads are incompatible without an adapter.
LIGHTRAG_QUERY_TOP_K lightrag 10 LightRAG query TOP_K. Atlas defaults this to a concrete integer because LightRAG v1.5.4 crashes when this env var is present but empty.
LIGHTRAG_QUERY_CHUNK_TOP_K lightrag 5 LightRAG query CHUNK_TOP_K. Atlas defaults this to a concrete integer because LightRAG v1.5.4 crashes when this env var is present but empty.
LIGHTRAG_QUERY_MAX_TOTAL_TOKENS lightrag 12000 LightRAG query MAX_TOTAL_TOKENS. Atlas defaults this to a concrete integer because LightRAG v1.5.4 crashes when this env var is present but empty.
LIGHTRAG_EMBEDDING_BINDING lightrag openai LightRAG embedding binding (EMBEDDING_BINDING). Default openai, through LiteLLM.
LIGHTRAG_EMBEDDING_BINDING_HOST lightrag http://litellm:4000/v1 LightRAG embedding endpoint (EMBEDDING_BINDING_HOST). Default: the in-network LiteLLM.
LIGHTRAG_EMBEDDING_MODEL lightrag Empty = lightrag-init resolves from LITELLM_EMBEDDING_MODEL.
LIGHTRAG_EMBEDDING_DIM lightrag Empty = auto (lightrag-init probes the embedding model's true dimension). Set ONLY to force a value — a wrong dim writes a mismatched PGVector index and every insert fails.
LIGHTRAG_VLM_PROCESS_ENABLE lightrag true Passed as VLM_PROCESS_ENABLE: process images and figures with a vision LLM during document parsing.
LIGHTRAG_KV_STORAGE lightrag RedisKVStorage LightRAG KV storage class. Default RedisKVStorage needs Redis; set a local class such as JsonKVStorage to run without it.
LIGHTRAG_VECTOR_STORAGE lightrag PGVectorStorage LightRAG vector storage class. Default PGVectorStorage needs Supabase; set a local class such as NanoVectorDBStorage to run without it.
LIGHTRAG_GRAPH_STORAGE lightrag Neo4JStorage LightRAG graph storage class. Default Neo4JStorage needs Neo4j; set a local class such as NetworkXStorage to run without it.
LIGHTRAG_DOC_STATUS_STORAGE lightrag RedisDocStatusStorage LightRAG document-status storage class. Default RedisDocStatusStorage needs Redis; set a local class such as JsonDocStatusStorage to run without it.
LIGHTRAG_SCALE lightrag Set by ./start.sh from LIGHTRAG_SOURCE; do not edit. 1 runs the lightrag container only for the container source, else 0.
LIGHTRAG_INIT_SCALE lightrag Set by ./start.sh from LIGHTRAG_SOURCE; do not edit. 1 runs lightrag-init only for the container source, else 0.
LIGHTRAG_ENDPOINT lightrag Consumed by hermes/n8n/backend runtime_adaptive and LiteLLM model_list.
LIGHTRAG_RERANK_BINDING_HOST lightrag Set by ./start.sh; do not edit. The backend rerank adapter URL when LIGHTRAG_RERANK_ADAPTER_ENABLED=true and TEI is enabled; empty otherwise.
LIGHTRAG_RERANK_BINDING lightrag Always null by default. Direct LightRAG→TEI rerank payloads are incompatible without an adapter, and LightRAG crashes on an empty value.
LIGHTRAG_DOCLING_ENDPOINT lightrag Set by ./start.sh; do not edit. The docling-lightrag-adapter URL when LightRAG runs as a container and the adapter runs; empty otherwise.
LIGHTRAG_PG_URI lightrag Set by ./start.sh; do not edit. PostgreSQL DSN for LightRAG's scoped role on supabase-db; empty when Supabase is disabled.
LIGHTRAG_NEO4J_URI lightrag Set by ./start.sh; do not edit. Source-aware Neo4j Bolt URI; empty when Neo4j is disabled.
LIGHTRAG_NEO4J_USERNAME lightrag Set by ./start.sh; do not edit. Neo4j user for LightRAG graph storage; empty when Neo4j is disabled.
LIGHTRAG_NEO4J_PASSWORD lightrag Set by ./start.sh from GRAPH_DB_PASSWORD; do not edit. Empty when Neo4j is disabled.
LIGHTRAG_REDIS_URI lightrag Set by ./start.sh; do not edit. Redis URI (db 2) for LightRAG KV and document-status storage; empty when Redis is disabled.
LIGHTRAG_IMAGE lightrag ghcr.io/hkuds/lightrag:v1.5.4 Container image for lightrag.
LIGHTRAG_INIT_IMAGE lightrag alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 Container image for lightrag-init.
LITELLM_SOURCE litellm container Locked. LiteLLM is mandatory; only one source value supported.
LITELLM_PORT litellm 63040 Host port for the LiteLLM gateway API and UI (in-container 4000).
LITELLM_INIT_SCALE litellm 1 Init container always runs (single value).
LITELLM_MASTER_KEY litellm Auto-generated by bootstrapper on first run. Doubles as the admin-dashboard password.
LITELLM_UI_USERNAME litellm admin Admin-dashboard login username at http://litellm.localhost:${KONG_HTTP_PORT}/ui/. Password is LITELLM_MASTER_KEY.
LITELLM_CACHE_TTL litellm 3600 Lifetime in seconds of a cached LiteLLM response in Redis. Embeddings, reranks and transcriptions are cached, and chat with LITELLM_CACHE_CHAT=true. LiteLLM's own default is 60s. A non-numeric or non-positive value falls back to 3600.
LITELLM_CACHE_NAMESPACE litellm litellm.cache Key prefix for LiteLLM's Redis response cache. Redis db 0 also holds the n8n and Langfuse queues and the backend media store. The prefix keeps gateway cache keys separately scannable and droppable.
LITELLM_CACHE_CHAT litellm false Also cache chat, text completion and Responses API calls. Off by default, because a cached reply silently replaces a fresh hermes-agent or lightrag passthrough run, such as a query over newly ingested documents.
LITELLM_DB_NAME litellm litellm Postgres database for LiteLLM. Supabase db-init (05-scoped-roles.sh) creates it.
LITELLM_DB_NAME_URI litellm litellm Bootstrapper-synchronized percent-encoded LITELLM_DB_NAME for DSN path components.
LITELLM_DB_USER litellm litellm Scoped Postgres login that owns LITELLM_DB_NAME. Supabase db-init (05-scoped-roles.sh) creates it.
LITELLM_DB_PASSWORD litellm atlas-db-password Auto-generated password for the owner of LiteLLM's dedicated database.
LITELLM_DB_USER_URI litellm litellm Bootstrapper-synchronized percent-encoded LITELLM_DB_USER for DSN userinfo.
LITELLM_DB_PASSWORD_URI litellm atlas-db-password Bootstrapper-synchronized percent-encoded LITELLM_DB_PASSWORD for DSN userinfo.
LITELLM_EMBEDDING_MODEL litellm ollama/nomic-embed-text Default embedding model used by weaviate-init when computing collection vectorizers.
LITELLM_DEFAULT_MODEL litellm ollama/qwen3.8:latest Optional default chat model passed to LangMem (backend).
LITELLM_VISION_MODEL litellm ollama/qwen3.8:latest Default vision-capable model (resolved from the model catalog; forward-looking — no consumer routes on it yet).
LITELLM_BASE_URL litellm In-network URL consumers point at (backend, n8n, jupyterhub, open-webui).
LITELLM_IMAGE litellm ghcr.io/berriai/litellm:v1.83.14-stable.patch.2 Container image for litellm.
LLM_GRAPH_BUILDER_SOURCE llm-graph-builder disabled Deployment source for Neo4j LLM Graph Builder: container (pinned source build) or disabled. The container source requires NEO4J_GRAPH_DB_SOURCE=container.
LLM_GRAPH_BUILDER_REF llm-graph-builder 4a412f4688cf4096976045c019edc0a7f6ddcb6b Pinned upstream neo4j-labs/llm-graph-builder git ref used by the source-build containers.
LLM_GRAPH_BUILDER_PORT llm-graph-builder 63095 Host port for the Graph Builder frontend (in-container 8080).
LLM_GRAPH_BUILDER_MODEL_ID llm-graph-builder atlas_litellm Model id shown in the Graph Builder UI. Keep atlas_litellm: compose only exports LLM_MODEL_CONFIG_ATLAS_LITELLM, and Graph Builder reads LLM_MODEL_CONFIG_<ID>, so another id breaks extraction and chat.
LLM_GRAPH_BUILDER_LLM_MODEL llm-graph-builder LiteLLM model alias used behind atlas_litellm. Empty = use LITELLM_DEFAULT_MODEL, then gpt-4o-mini (needs an OpenAI key).
LLM_GRAPH_BUILDER_NEO4J_DATABASE llm-graph-builder neo4j Neo4j database name for Graph Builder data. Use a dedicated database on editions that support it.
LLM_GRAPH_BUILDER_DIFFBOT_API_KEY llm-graph-builder Optional Diffbot API key for upstream Diffbot extraction/model features. Atlas' default LiteLLM path does not require it.
LLM_GRAPH_BUILDER_GCP_LOG_METRICS_ENABLED llm-graph-builder false Enable the upstream Google Cloud logging integration. Requires project id and an ADC credential file.
LLM_GRAPH_BUILDER_GCS_FILE_CACHE llm-graph-builder false Store uploaded and failed files in GCS instead of local container storage. Requires the full GCP and bucket configuration.
LLM_GRAPH_BUILDER_GCP_PROJECT_ID llm-graph-builder Google Cloud project id used by optional GCS caching and Cloud logging.
LLM_GRAPH_BUILDER_GCS_UPLOAD_BUCKET llm-graph-builder GCS bucket for uploaded files when LLM_GRAPH_BUILDER_GCS_FILE_CACHE=true.
LLM_GRAPH_BUILDER_GCS_FAILED_BUCKET llm-graph-builder GCS bucket for failed files when LLM_GRAPH_BUILDER_GCS_FILE_CACHE=true.
LLM_GRAPH_BUILDER_GCP_CREDENTIALS_FILE llm-graph-builder Absolute host path to a Google ADC JSON file. Mounted read-only only for the Graph Builder backend.
LLM_GRAPH_BUILDER_REACT_APP_SOURCES llm-graph-builder local,wiki,web Comma-separated upstream source picker values compiled into the frontend.
LLM_GRAPH_BUILDER_CHAT_MODES llm-graph-builder vector,graph_vector,graph,fulltext,graph_vector_fulltext,entity_vector,global_vector Comma-separated chat modes compiled into the frontend.
LLM_GRAPH_BUILDER_TIME_PER_PAGE llm-graph-builder 50 Frontend build argument VITE_TIME_PER_PAGE (upstream setting). Changing it requires an image rebuild.
LLM_GRAPH_BUILDER_CHUNK_SIZE llm-graph-builder 5242880 Frontend build argument VITE_CHUNK_SIZE (upstream setting). Changing it requires an image rebuild.
LLM_GRAPH_BUILDER_LARGE_FILE_SIZE llm-graph-builder 5242880 Frontend build argument VITE_LARGE_FILE_SIZE (upstream setting). Changing it requires an image rebuild.
LLM_GRAPH_BUILDER_BATCH_SIZE llm-graph-builder 2 Frontend build argument VITE_BATCH_SIZE (upstream setting). Changing it requires an image rebuild.
LLM_GRAPH_BUILDER_CHUNK_OVERLAP llm-graph-builder 20 Frontend build argument VITE_CHUNK_OVERLAP (upstream setting). Changing it requires an image rebuild.
LLM_GRAPH_BUILDER_TOKENS_PER_CHUNK llm-graph-builder 200 Frontend build argument VITE_TOKENS_PER_CHUNK (upstream setting). Changing it requires an image rebuild.
LLM_GRAPH_BUILDER_CHUNK_TO_COMBINE llm-graph-builder 1 Frontend build argument VITE_CHUNK_TO_COMBINE (upstream setting). Changing it requires an image rebuild.
LLM_GRAPH_BUILDER_MAX_TOKEN_CHUNK_SIZE llm-graph-builder 10000 Passed to the Graph Builder backend as MAX_TOKEN_CHUNK_SIZE (upstream setting).
LLM_GRAPH_BUILDER_KNN_MIN_SCORE llm-graph-builder 0.94 Passed to the Graph Builder backend as KNN_MIN_SCORE (upstream setting).
LLM_GRAPH_BUILDER_UPDATE_GRAPH_CHUNKS_PROCESSED llm-graph-builder 20 Passed to the Graph Builder backend as UPDATE_GRAPH_CHUNKS_PROCESSED (upstream setting).
LLM_GRAPH_BUILDER_ENTITY_EMBEDDING llm-graph-builder false Passed to the Graph Builder backend as ENTITY_EMBEDDING (upstream setting).
LLM_GRAPH_BUILDER_ENABLE_USER_AGENT llm-graph-builder true Passed to the Graph Builder backend as ENABLE_USER_AGENT (upstream setting).
LLM_GRAPH_BUILDER_USER_AGENT llm-graph-builder Atlas-LLM-Graph-Builder Passed to the Graph Builder backend as USER_AGENT (upstream setting).
LLM_GRAPH_BUILDER_TRACK_USER_USAGE llm-graph-builder false Passed to the Graph Builder backend as TRACK_USER_USAGE (upstream setting).
LLM_GRAPH_BUILDER_AUTHENTICATION_REQUIRED llm-graph-builder false Passed to the Graph Builder backend as AUTHENTICATION_REQUIRED (upstream setting): upstream backend authentication; Atlas keeps it false and relies on Kong Basic Auth.
LLM_GRAPH_BUILDER_BACKEND_SCALE llm-graph-builder Set by ./start.sh from LLM_GRAPH_BUILDER_SOURCE; do not edit. 1 runs llm-graph-builder-backend, 0 does not.
LLM_GRAPH_BUILDER_FRONTEND_SCALE llm-graph-builder Set by ./start.sh from LLM_GRAPH_BUILDER_SOURCE; do not edit. 1 runs llm-graph-builder-frontend, 0 does not.
LLM_GRAPH_BUILDER_ENDPOINT llm-graph-builder Internal frontend URL.
LLM_GRAPH_BUILDER_BACKEND_ENDPOINT llm-graph-builder Internal backend API URL.
LLM_GRAPH_BUILDER_LITELLM_MODEL_CONFIG llm-graph-builder Model config consumed as LLM_MODEL_CONFIG_ATLAS_LITELLM by the upstream backend.
LOCAL_DEEP_RESEARCHER_SOURCE local-deep-researcher container Deployment source for Local Deep Researcher: container or disabled.
LOCAL_DEEP_RESEARCHER_PORT local-deep-researcher 63097 Host port for the Local Deep Researcher LangGraph API (in-container 2024).
LOCAL_DEEP_RESEARCHER_REF local-deep-researcher 38f769f84380f2065de76021ac7c5215f88aa39e Full upstream local-deep-researcher commit SHA materialized into the managed repo volume. Update deliberately after compatibility validation; runtime startup never follows a branch.
LOCAL_DEEP_RESEARCHER_LANGGRAPH_CLI_VERSION local-deep-researcher 0.4.31 Exact langgraph-cli[inmem] version used to serve the pinned source tree.
LOCAL_DEEP_RESEARCHER_UPSTREAM_LOCK_SHA256 local-deep-researcher 26fc35ac377836de6628e5f7b180944c4d4bd50a5e9f0200bd6e663f20e35c1a SHA-256 digest of uv.lock at LOCAL_DEEP_RESEARCHER_REF; startup rejects a source tree whose lock does not match.
LOCAL_DEEP_RESEARCHER_LOOPS local-deep-researcher 3 Maximum web research loops per run, passed as MAX_WEB_RESEARCH_LOOPS.
LOCAL_DEEP_RESEARCHER_SEARCH_API local-deep-researcher searxng Web search backend, passed as SEARCH_API. Default searxng.
LOCAL_DEEP_RESEARCHER_WORKERS local-deep-researcher 3 Reserved: passed to the container, but the entrypoint does not pass it to langgraph dev. One server process owns the in-memory research state.
LOCAL_DEEP_RESEARCHER_FULL_PAGE_MODE local-deep-researcher disabled Full-page extraction mode: disabled, builtin, or crawl4ai. The crawl4ai mode requires CRAWL4AI_SOURCE=container.
FETCH_FULL_PAGE local-deep-researcher Set by ./start.sh from LOCAL_DEEP_RESEARCHER_FULL_PAGE_MODE; do not edit. true for builtin or crawl4ai, false for disabled.
LOCAL_DEEP_RESEARCHER_SCALE local-deep-researcher Set by ./start.sh from LOCAL_DEEP_RESEARCHER_SOURCE; do not edit. 0 when disabled, else 1.
LOCAL_DEEP_RESEARCHER_IMAGE local-deep-researcher python:3.11.15-slim Container image for local-deep-researcher.
LOKI_SOURCE loki disabled Deployment source for Loki, the local log store: container or disabled.
LOKI_SCALE loki Set by ./start.sh from LOKI_SOURCE; do not edit. 1 runs loki, 0 does not.
LOKI_ENDPOINT loki Internal Loki API endpoint consumed by Grafana.
LOKI_RETENTION_PERIOD loki 24h Short local retention period for Loki compactor-managed log deletion.
LOKI_IMAGE loki grafana/loki:3.7.0 Container image for loki.
MCP_POSTGRES_DB_USER mcp-servers atlas_mcp Read-only PostgreSQL login for the curated MCP query tool.
MCP_POSTGRES_DB_PASSWORD mcp-servers atlas-db-password Auto-generated password for the MCP read-only database role.
MCP_SERVERS_SOURCE mcp-servers disabled Curated MCP package source. Disabled by default because MCP tools can reach stack internals.
MCP_SERVERS_PORT mcp-servers 63078 Host port for the curated MCP Streamable HTTP endpoint (container port 8000).
MCP_SERVERS_SCALE mcp-servers Replicas: 1 when MCP_SERVERS_SOURCE=container, else 0.
MCP_POSTGRES_MAX_ROWS mcp-servers 50 Maximum rows returned by the Postgres MCP query tool.
MCP_NEO4J_MAX_ROWS mcp-servers Maximum rows returned by the Neo4j MCP query tool. Empty falls back to MCP_POSTGRES_MAX_ROWS (default 50).
MCP_SEARXNG_MAX_RESULTS mcp-servers 5 Maximum SearXNG results returned by the web-search MCP tool.
MCP_TOOL_TIMEOUT_SECONDS mcp-servers 15 Timeout for upstream database/search calls made by MCP tools.
MCP_SERVERS_IMAGE mcp-servers python:3.12.14-slim Used as build-arg BASE_IMAGE in build/Dockerfile.
MINIO_SOURCE minio container MinIO deployment source: container or disabled.
MINIO_PORT minio 63020 Host port for the MinIO S3 API (in-container listen port is 9000).
MINIO_CONSOLE_PORT minio 63021 Host port for the MinIO admin console (in-container listen port is 9001).
MINIO_ROOT_USER minio minioadmin MinIO root username. minio-init, airflow and backup also receive it; consumer services use their own scoped access keys.
MINIO_ROOT_PASSWORD minio Auto-generated by bootstrapper KeyGenerator.generate_minio_root_password().
MINIO_REGION minio us-east-1 S3 region MinIO reports. Clients such as iceberg-rest, jupyterhub, langfuse, label-studio and the asset services use it as their S3 region.
MINIO_INIT_SOURCE minio container Auto-managed by minio. Container/disabled.
MINIO_SCALE minio Set by ./start.sh from MINIO_SOURCE; do not edit. 1 runs the minio container, 0 does not.
MINIO_INIT_SCALE minio Set by ./start.sh from MINIO_SOURCE; do not edit. 1 runs the minio-init container, 0 does not.
MINIO_ENDPOINT minio In-network URL (S3 API).
MINIO_PUBLIC_ENDPOINT minio Host-side URL (for browser redirects).
MINIO_PUBLIC_CONSOLE_ENDPOINT minio Derived by ./start.sh; do not set. Host URL of the MinIO console (http://localhost:${MINIO_CONSOLE_PORT}), empty when disabled. Passed to MinIO as MINIO_BROWSER_REDIRECT_URL.
MINIO_EXTRA_CONSUMERS minio Optional space-separated parent-owned MinIO entries using CONSUMER:BUCKET_VAR:ACCESS_VAR:SECRET_VAR[:RW_BUCKET_VAR,...[:RO_BUCKET_VAR,...]] grammar for services/_user overlays.
MINIO_BUCKET_ASSET_INPUTS minio raw-assets Shared input bucket for the Asset Worker and Asset Baker scoped service accounts.
MINIO_ASSET_INGEST_ACCESS_KEY minio Auto-generated scoped MinIO access key for writing shared raw asset inputs.
MINIO_ASSET_INGEST_SECRET_KEY minio Auto-generated scoped MinIO secret key for writing shared raw asset inputs.
MINIO_ASSET_WORKER_ACCESS_KEY minio Auto-generated scoped MinIO access key for Asset Worker input and output buckets.
MINIO_ASSET_WORKER_SECRET_KEY minio Auto-generated scoped MinIO secret key for Asset Worker input and output buckets.
MINIO_ASSET_BAKER_ACCESS_KEY minio Auto-generated scoped MinIO access key for Asset Baker input and output buckets.
MINIO_ASSET_BAKER_SECRET_KEY minio Auto-generated scoped MinIO secret key for Asset Baker input and output buckets.
MINIO_BUCKET_COMFYUI minio comfyui Bucket minio-init creates for the comfyui service account.
MINIO_COMFYUI_ACCESS_KEY minio Auto-generated scoped MinIO access key for the comfyui bucket.
MINIO_COMFYUI_SECRET_KEY minio Auto-generated scoped MinIO secret key for the comfyui bucket.
MINIO_BUCKET_BACKEND minio backend Bucket minio-init creates for the backend service account.
MINIO_BACKEND_ACCESS_KEY minio Auto-generated scoped MinIO access key for the backend bucket.
MINIO_BACKEND_SECRET_KEY minio Auto-generated scoped MinIO secret key for the backend bucket.
MINIO_BUCKET_N8N minio n8n Bucket minio-init creates for the n8n service account.
MINIO_N8N_ACCESS_KEY minio Auto-generated scoped MinIO access key for the n8n bucket.
MINIO_N8N_SECRET_KEY minio Auto-generated scoped MinIO secret key for the n8n bucket.
MINIO_BUCKET_JUPYTER minio jupyter Bucket minio-init creates for the jupyter service account, which can also read the Iceberg lakehouse bucket.
MINIO_JUPYTER_ACCESS_KEY minio Auto-generated scoped MinIO access key for the jupyter bucket.
MINIO_JUPYTER_SECRET_KEY minio Auto-generated scoped MinIO secret key for the jupyter bucket.
MINIO_BUCKET_SPARK_HISTORY minio spark-history Spark event-log bucket used by Zeppelin and the Spark History Server.
MINIO_SPARK_ACCESS_KEY minio Auto-generated scoped MinIO access key for Spark event logs and lakehouse workflow buckets.
MINIO_SPARK_SECRET_KEY minio Auto-generated scoped MinIO secret key for Spark event logs and lakehouse workflow buckets.
MINIO_BUCKET_DOCLING minio docling Bucket minio-init creates for the docling service account.
MINIO_DOCLING_ACCESS_KEY minio Auto-generated scoped MinIO access key for the docling bucket.
MINIO_DOCLING_SECRET_KEY minio Auto-generated scoped MinIO secret key for the docling bucket.
MINIO_BUCKET_LANGFUSE minio langfuse Bucket minio-init creates for the langfuse service account. Langfuse uses it for event, media and batch-export uploads.
MINIO_LANGFUSE_ACCESS_KEY minio Auto-generated scoped MinIO access key for the langfuse bucket.
MINIO_LANGFUSE_SECRET_KEY minio Auto-generated scoped MinIO secret key for the langfuse bucket.
MINIO_BUCKET_MLFLOW minio mlflow Bucket minio-init creates for the mlflow service account. MLflow stores run artifacts in it.
MINIO_MLFLOW_ACCESS_KEY minio Auto-generated scoped MinIO access key for the mlflow bucket.
MINIO_MLFLOW_SECRET_KEY minio Auto-generated scoped MinIO secret key for the mlflow bucket.
MINIO_BUCKET_LABEL_STUDIO minio label-studio Bucket minio-init creates for the label-studio service account. Label Studio uses it as its storage bucket.
MINIO_LABEL_STUDIO_ACCESS_KEY minio Auto-generated scoped MinIO access key for the label-studio bucket.
MINIO_LABEL_STUDIO_SECRET_KEY minio Auto-generated scoped MinIO secret key for the label-studio bucket.
MINIO_BUCKET_ICEBERG_LAKEHOUSE minio lakehouse Iceberg warehouse bucket. The iceberg and spark service accounts can write it; the jupyter account can read it.
MINIO_BUCKET_ICEBERG_JARS minio jars Jar bucket for Spark jobs. The spark and iceberg service accounts can write it; Airflow and Jenkins receive its name.
MINIO_BUCKET_ICEBERG_CHECKPOINTS minio checkpoints Checkpoint bucket. The spark and iceberg service accounts can write it; Zeppelin and JupyterHub receive its name.
MINIO_BUCKET_ICEBERG_LANDING minio landing Landing bucket. The spark and iceberg service accounts can write it; Airflow, Zeppelin and JupyterHub receive its name.
MINIO_ICEBERG_ACCESS_KEY minio Auto-generated scoped MinIO access key for the Iceberg lakehouse buckets.
MINIO_ICEBERG_SECRET_KEY minio Auto-generated scoped MinIO secret key for the Iceberg lakehouse buckets.
MINIO_IMAGE minio pgsty/silo:RELEASE.2026-09-16T00-00-00Z@sha256:635197cb9f36d01bee221d34d1c7d7960f6a95c48b0b6c01d99cd13bdae51a46 Silo, the Pigsty-maintained AGPL fork of the archived MinIO community server, pinned by tag and multi-arch digest. It keeps the MINIO_* environment, /minio/* routes, mc admin API and on-disk format. Its entrypoint maps server to silo server, so the compose command is unchanged. It carries the bounded S3 Select CSV reader fix for CVE-2026-39414. Review upstream security advisories before bumping.
MINIO_INIT_IMAGE minio pgsty/mc:RELEASE.2026-09-16T00-00-00Z@sha256:cfc83108c3abb371f8fb84d99c1fdc88f8c237e022409b0081fb7c0a3be634dd Container image for minio-init.
MLFLOW_SOURCE mlflow disabled MLflow deployment source: container or disabled. container requires MINIO_SOURCE=container for artifact storage.
MLFLOW_PORT mlflow 63092 Host port for the MLflow UI/API (in-container 5000).
MLFLOW_ENDPOINT mlflow In-network URL for Atlas services and notebooks.
MLFLOW_TRACKING_URI mlflow Tracking URI injected into JupyterHub when MLflow is enabled.
MLFLOW_SCALE mlflow Set by ./start.sh from MLFLOW_SOURCE; do not edit. 1 runs the mlflow container, 0 does not.
MLFLOW_INIT_SCALE mlflow Set by ./start.sh from MLFLOW_SOURCE; do not edit. 1 runs the mlflow-init container, 0 does not.
MLFLOW_DB_NAME mlflow mlflow Postgres database in supabase-db that holds the MLflow tracking and model-registry stores.
MLFLOW_DB_NAME_URI mlflow mlflow Bootstrapper-synchronized percent-encoded MLFLOW_DB_NAME for DSN path components.
MLFLOW_DB_USER mlflow mlflow Restricted Postgres login that owns the MLflow database; created by 05-scoped-roles.sh.
MLFLOW_DB_PASSWORD mlflow atlas-db-password Auto-generated Postgres password for the dedicated MLflow database role.
MLFLOW_DB_USER_URI mlflow mlflow Bootstrapper-synchronized percent-encoded MLFLOW_DB_USER for DSN userinfo.
MLFLOW_DB_PASSWORD_URI mlflow atlas-db-password Bootstrapper-synchronized percent-encoded MLFLOW_DB_PASSWORD for DSN userinfo.
MLFLOW_IMAGE mlflow ghcr.io/mlflow/mlflow:v3.16.1 Container image for mlflow.
MLFLOW_INIT_IMAGE mlflow alpine:3.24.2 Container image for mlflow-init.
N8N_SOURCE n8n container n8n deployment source: container or disabled. Drives the n8n, n8n-worker and n8n-init scales.
N8N_DB_USER n8n atlas_n8n Owner of the isolated n8n schema in Supabase PostgreSQL.
N8N_DB_PASSWORD n8n atlas-db-password Auto-generated password for the scoped n8n database role.
N8N_PORT n8n 63075 Host port for the n8n editor and webhooks (container port 5678).
N8N_ENCRYPTION_KEY n8n your-random-encryption-key Encryption key for n8n credentials and workflow secrets; auto-generated by the bootstrapper when left as the placeholder.
N8N_API_KEY n8n n8n public-API key (n8n CE issues these only via the UI: Settings → n8n API). Consumed by the backend's /workflows endpoints; while empty those endpoints currently return backend errors from failed upstream n8n calls.
N8N_HOST n8n n8n.localhost Not interpolated: the n8n compose fragment sets N8N_HOST=n8n.localhost directly.
N8N_PROTOCOL n8n http Protocol n8n uses in the URLs it generates (N8N_PROTOCOL in the n8n and n8n-worker containers).
N8N_EXECUTIONS_MODE n8n queue n8n EXECUTIONS_MODE. The default queue runs workflow executions on n8n-worker through Redis.
N8N_INIT_SOURCE n8n container Init-container selector listed in the SOURCE values reference. N8N_INIT_SCALE follows N8N_SOURCE, so n8n-init runs whenever n8n runs.
N8N_INIT_NODES n8n [email protected],@ksc1234/[email protected] Exact community package specs installed before n8n starts. Atlas' default ComfyUI set uses the committed package-lock; n8n 2.28.2 already supplies first-party MCP nodes. Custom values must use [email protected] for every comma-separated package.
N8N_SEED_HTTP_TIMEOUT_MS n8n 10000 Absolute deadline in milliseconds for each consumer workflow seeder HTTP operation; must be positive.
N8N_SEED_COMMAND_TIMEOUT_MS n8n 120000 Deadline in milliseconds for each consumer workflow n8n CLI operation; must be positive.
N8N_SEED_MAX_RESPONSE_BYTES n8n 1048576 Maximum bytes accepted from one consumer workflow seeder HTTP response; must be positive.
N8N_SCALE n8n Set by ./start.sh from N8N_SOURCE; do not edit. 1 runs the n8n container, 0 does not.
N8N_WORKER_SCALE n8n Set by ./start.sh from N8N_SOURCE; do not edit. 1 runs the n8n-worker container, 0 does not.
N8N_INIT_SCALE n8n Set by ./start.sh from N8N_SOURCE; do not edit. 1 runs the n8n-init container, 0 does not.
N8N_IMAGE n8n n8nio/n8n:2.28.2 Container image for n8n.
N8N_INIT_IMAGE n8n n8nio/n8n:2.28.2 Container image for n8n-init.
NEO4J_GRAPH_DB_SOURCE neo4j container Neo4j deployment source. Drives NEO4J_SCALE and NEO4J_URI.
GRAPH_DB_PORT neo4j 63023 Host port for Neo4j bolt (container port 7687).
GRAPH_DB_DASHBOARD_PORT neo4j 63024 Host port for Neo4j browser dashboard (container port 7474).
GRAPH_DB_USER neo4j neo4j Neo4j username. Backend and jupyterhub receive it as NEO4J_USER, and airflow-init seeds it into neo4j_default. Keep it equal to the user in GRAPH_DB_AUTH.
GRAPH_DB_PASSWORD neo4j neo4j_password Neo4j password; auto-generated by the bootstrapper when left as the placeholder.
GRAPH_DB_AUTH neo4j neo4j/neo4j_password Neo4j auth in username/password format.
NEO4J_URI neo4j Computed from NEO4J_GRAPH_DB_SOURCE. Read by backend/jupyterhub.
NEO4J_SCALE neo4j Replicas: 1 for container, 0 otherwise.
NEO4J_LOCALHOST_HTTP_PORT neo4j 7474 Host HTTP port for the neo4j-localhost source variant (browser UI + REST). Kong route target is derived as http://host.docker.internal:7474.
NEO4J_LOCALHOST_BOLT_PORT neo4j 7687 Host Bolt port for the neo4j-localhost source variant (driver protocol). NEO4J_URI is derived as bolt://host.docker.internal:7687. The wizard's inline-textbox edits THIS port (HTTP is overridable via .env hand-edit).
NEO4J_MEMORY_LIMIT neo4j 2g Memory limit for neo4j-graph-db (deploy.resources.limits.memory). 2g is conservative for a 32 GB host. Single-node dev and staging workloads typically stay well under it.
NEO4J_CPU_LIMIT neo4j 1.5 Container CPU limit for neo4j-graph-db (deploy.resources.limits.cpus). 1.5 cores is sufficient for single-node Bolt + HTTP query serving.
NEO4J_GRAPH_DB_IMAGE neo4j neo4j:5.26.31 Used as build-arg BASE_IMAGE in graph-db/Dockerfile.
LLM_PROVIDER_SOURCE ollama ollama-container-cpu Where LiteLLM's Ollama upstream runs: ollama-container-cpu, ollama-container-gpu, ollama-localhost (host daemon) or none (cloud providers only). Also accepts auto in a consumer manifest.
OLLAMA_USER_MODELS ollama qwen3.8:latest,nomic-embed-text,qwen3-embedding:0.6b Comma-separated Ollama model names to activate/pull. Pre-filled by env_assembler from the catalog's default-active Ollama set (see services/ollama/models.yaml); the wizard overwrites it with the user's selection.
OLLAMA_CUSTOM_MODELS ollama Free-text extra Ollama models; a consumer's model_sidecars.ollama lands here. The ollama-pull init container pulls them for container-* sources, and ./start.sh pulls them onto the host daemon for ollama-localhost.
OLLAMA_PULL_STALL_TIMEOUT_SECONDS ollama 120 Seconds an ollama-pull download may stay below 1 KiB/s before it is aborted and retried. A download that keeps progressing has no wall-clock cutoff.
OLLAMA_AUTO_IMPORT_LOCAL_MODELS ollama true When LLM_PROVIDER_SOURCE=ollama-localhost, litellm-init queries the upstream's /api/tags and auto-imports every model found, unioning with OLLAMA_USER_MODELS. Set false to keep strict wizard-only control.
OLLAMA_DEPLOY_RESOURCES ollama ~ Reserved for future GPU deploy block. Currently '~' (null).
OLLAMA_SCALE ollama Set by ./start.sh from LLM_PROVIDER_SOURCE; do not edit. 1 runs the ollama container (container-* sources), 0 does not.
OLLAMA_PULL_SCALE ollama Set by ./start.sh from LLM_PROVIDER_SOURCE; do not edit. 1 runs the ollama-pull init container for container-* sources, else 0.
OLLAMA_NVIDIA_VISIBLE_DEVICES ollama Set by ./start.sh from LLM_PROVIDER_SOURCE; do not edit. all for ollama-container-gpu, else null. Passed to the ollama container as NVIDIA_VISIBLE_DEVICES.
OLLAMA_ENDPOINT ollama Auto-managed; do not set. The per-source Ollama URL (empty for none). ./start.sh writes it into LITELLM_OLLAMA_UPSTREAM; no container reads OLLAMA_ENDPOINT directly.
LITELLM_OLLAMA_UPSTREAM ollama Ollama URL the LiteLLM gateway forwards Ollama-routed requests to. Owned by ollama because the value flips with LLM_PROVIDER_SOURCE; consumed by litellm-init when rendering its config.yaml.
OLLAMA_LOCALHOST_PORT ollama 11434 Host port for the ollama-localhost source variant. URL is derived at compose-render time as http://host.docker.internal:11434.
OLLAMA_NUM_PARALLEL ollama 8 Ollama parallel request slots per model. Multi-agent consumers (8+ concurrent requests) need more than 1; Ollama's default of 1 serializes them. Applies to the container-* sources; for ollama-localhost the host daemon owns it.
OLLAMA_MAX_LOADED_MODELS ollama 2 Maximum models Ollama keeps resident at once. Raise it for workloads that swap between several models; lower it to bound memory. Applies to the container-* sources; for ollama-localhost the host daemon owns it.
OLLAMA_KV_CACHE_TYPE ollama q8_0 KV cache quantization: f16 (full precision, Ollama's default), q8_0 (about half the memory, negligible quality cost) or q4_0 (about a quarter, measurable cost). Needs OLLAMA_FLASH_ATTENTION active. Container-* sources only; ollama-localhost uses the host daemon's setting.
OLLAMA_FLASH_ATTENTION ollama 1 Enables Ollama's flash-attention path. Current Ollama enables it automatically where supported. Atlas pins it because OLLAMA_KV_CACHE_TYPE quantization has no effect without it. Set 0 to force it off.
OLLAMA_KEEP_ALIVE ollama Time Ollama keeps a model loaded after its last use (5m, 1h, or -1 for forever); empty uses Ollama's 5m default. Container-* sources only. -1 keeps every loaded model in RAM until reverted and the daemon restarts.
OLLAMA_MODELS_RESIDENT_MIN ollama Advisory, ollama-localhost only: how many models a workload needs resident at once. ./start.sh doctor reports a failure when the daemon's OLLAMA_MAX_LOADED_MODELS is lower. Empty declares no expectation. A LightRAG run with separate extract, embed and keyword models needs 3.
OLLAMA_PARALLEL_MIN ollama Advisory, ollama-localhost only: the concurrent-request floor a consumer needs. ./start.sh doctor warns when the daemon's OLLAMA_NUM_PARALLEL is lower. Empty declares no expectation. Ollama's default of 1 slot silently serializes a multi-agent consumer.
LLM_PROVIDER_IMAGE ollama ollama/ollama:0.30.11 Container image for ollama.
OLLAMA_PULL_IMAGE ollama alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 Container image for ollama-pull.
OPEN_WEB_UI_SOURCE open-webui container Open WebUI deployment source: container or disabled.
OPEN_WEBUI_DB_USER open-webui atlas_open_webui Scoped PostgreSQL owner for Open WebUI migration objects.
OPEN_WEBUI_DB_PASSWORD open-webui atlas-db-password Auto-generated password for the scoped Open WebUI database role.
OPEN_WEBUI_DB_USER_URI open-webui atlas_open_webui Bootstrapper-synchronized percent-encoded OPEN_WEBUI_DB_USER for DSN userinfo.
OPEN_WEBUI_DB_PASSWORD_URI open-webui atlas-db-password Bootstrapper-synchronized percent-encoded OPEN_WEBUI_DB_PASSWORD for DSN userinfo.
OPEN_WEB_UI_STT_API_KEY open-webui Parakeet bearer token when a Parakeet source is selected; a non-secret compatibility placeholder for other enabled STT engines.
OPEN_WEB_UI_PORT open-webui 63096 Host port for the Open WebUI web interface (container port 8080).
OPEN_WEB_UI_SECRET_KEY open-webui secret Open WebUI session/signing secret; auto-generated by the bootstrapper when left as the placeholder.
OPEN_WEB_UI_ADMIN_EMAIL open-webui admin@localhost Email of the admin account that open-webui-init creates.
OPEN_WEB_UI_ADMIN_PASSWORD open-webui admin Initial Open WebUI admin password; auto-generated by the bootstrapper when left as the placeholder.
OPEN_WEB_UI_ADMIN_NAME open-webui Admin Display name of the admin account that open-webui-init creates.
OPEN_WEB_UI_WEBSOCKET_SUPPORT open-webui true Open WebUI ENABLE_WEBSOCKET_SUPPORT. The websocket manager uses Redis.
OPEN_WEB_UI_REDIS_DB open-webui 2 Redis database index for Open WebUI's websocket manager. LightRAG shares db 2 by default.
OPEN_WEB_UI_MODEL_CACHE_TTL open-webui 300 Seconds Open WebUI caches the model list (MODELS_CACHE_TTL).
OPEN_WEB_UI_ENABLE_IMAGE_GENERATION open-webui true Set by bootstrapper: true unless COMFYUI_SOURCE=disabled, so Open WebUI hides its ComfyUI image toggle when there is no ComfyUI. Open WebUI keeps the value saved in its database once an admin edits the Images settings.
OPEN_WEB_UI_TTS_ENGINE open-webui Set by bootstrapper when speaches/chatterbox are enabled.
OPEN_WEB_UI_STT_ENGINE open-webui Set by ./start.sh: openai when STT_PROVIDER_SOURCE is not disabled, else empty. Passed as AUDIO_STT_ENGINE.
OPEN_WEB_UI_TTS_MODEL open-webui Model name Open WebUI sends to /v1/audio/speech. Empty = engine default.
OPEN_WEB_UI_TTS_VOICE open-webui Voice id. Empty = engine default.
OPEN_WEB_UI_TTS_API_URL open-webui Set by ./start.sh from TTS_ENDPOINT plus /v1, or empty. Passed as AUDIO_TTS_OPENAI_API_BASE_URL.
OPEN_WEB_UI_STT_API_URL open-webui Set by ./start.sh from STT_ENDPOINT plus /v1, or empty. Passed as AUDIO_STT_OPENAI_API_BASE_URL.
OPEN_WEB_UI_SCALE open-webui Set by ./start.sh from OPEN_WEB_UI_SOURCE; do not edit. 1 runs the open-web-ui container, 0 does not.
OPEN_WEB_UI_INIT_SCALE open-webui Set by ./start.sh from OPEN_WEB_UI_SOURCE; do not edit. 1 runs the open-webui-init container, 0 does not.
OPEN_WEB_UI_IMAGE open-webui dyrnq/open-webui:v0.6.32 Container image for open-web-ui.
OPEN_WEB_UI_INIT_IMAGE open-webui python:3.12.14-slim-bookworm@sha256:0f5b26b9518d002b6173fd61daad821fa340635ebfec5bba471013f9ca114579 Container image for open-webui-init.
OPENCLAW_SOURCE openclaw disabled OpenClaw deployment source: container, localhost (host install on OPENCLAW_LOCALHOST_PORT) or disabled.
OPENCLAW_GATEWAY_PORT openclaw 63076 Host port for the OpenClaw gateway API and dashboard (container port 18789).
OPENCLAW_BRIDGE_PORT openclaw 63077 Host port for the OpenClaw bridge (container port 18790).
OPENCLAW_GATEWAY_TOKEN openclaw Auto-generated bearer token for the OpenClaw gateway API and dashboard; kept once set. The gateway binds to the LAN interface and refuses to do so without a token. Left empty, it would mint an unreadable per-start token.
OPENCLAW_LOCALHOST_PORT openclaw 63065 Host port for the localhost source variant (its own slot, separate from OPENCLAW_GATEWAY_PORT). URL is derived at compose-render time as http://host.docker.internal:63065.
OPENCLAW_INIT_SOURCE openclaw container Init-container selector listed in the SOURCE values reference. OPENCLAW_INIT_SCALE follows OPENCLAW_SOURCE, so openclaw-init runs only for container.
OPENCLAW_ANTHROPIC_API_KEY openclaw Optional per-OpenClaw Anthropic override.
OPENCLAW_OPENAI_API_KEY openclaw Optional per-OpenClaw OpenAI override. Leave empty to keep OpenClaw routed through LiteLLM instead of bypassing the stack gateway.
OPENCLAW_SCALE openclaw Set by ./start.sh from OPENCLAW_SOURCE; do not edit. 1 runs the openclaw-gateway container for container, else 0.
OPENCLAW_INIT_SCALE openclaw Set by ./start.sh from OPENCLAW_SOURCE; do not edit. 1 runs the openclaw-init container for container, else 0.
OPENCLAW_ENDPOINT openclaw Resolved per source by ./start.sh: the container DNS name, a host.docker.internal URL, or empty when disabled. No compose fragment injects it into a container; consumers wire it themselves.
OPENCLAW_IMAGE openclaw ghcr.io/openclaw/openclaw:2026.6.10 Container image for openclaw-gateway.
OPENCLAW_INIT_IMAGE openclaw alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 Container image for openclaw-init.
OTEL_COLLECTOR_SOURCE otel-collector disabled OpenTelemetry Collector deployment source: container or disabled.
OTEL_COLLECTOR_SCALE otel-collector Set by ./start.sh from OTEL_COLLECTOR_SOURCE; do not edit. 1 runs the otel-collector container, 0 does not.
OTEL_COLLECTOR_ENDPOINT otel-collector Preferred internal OTLP HTTP endpoint for Atlas services.
OTEL_COLLECTOR_OTLP_HTTP_ENDPOINT otel-collector Internal OTLP HTTP endpoint (http://otel-collector:4318) when enabled.
OTEL_COLLECTOR_OTLP_GRPC_ENDPOINT otel-collector Internal OTLP gRPC endpoint (http://otel-collector:4317) when enabled.
ATLAS_OTEL_ENABLED otel-collector Boolean string consumed by backend and LiteLLM tracing toggles.
OTEL_COLLECTOR_IMAGE otel-collector otel/opentelemetry-collector-contrib:0.154.0 Container image for otel-collector.
STT_PROVIDER_SOURCE parakeet speaches-container-cpu Speech-to-text engine: speaches-container-cpu, speaches-container-gpu, parakeet-container-gpu, parakeet-localhost, whisper-cpp-localhost or disabled. Drives STT_ENDPOINT and the engine scales.
STT_PROVIDER_PORT parakeet 63055 Wizard display slot. Real per-engine ports live on their own manifests (PARAKEET_*, SPEACHES_*, etc.).
STT_PROVIDER_SCALE parakeet Set by ./start.sh; do not edit. 1 when a container engine serves speech-to-text, else 0. The wizard uses it to colour the STT row.
PARAKEET_MODEL parakeet nvidia/parakeet-tdt-0.6b-v3 Model the Parakeet GPU container loads (NeMo model ID), passed as PARAKEET_MODEL.
PARAKEET_GPU_DEVICE parakeet cuda Torch device for the Parakeet GPU container, passed as PARAKEET_DEVICE.
PARAKEET_MAX_UPLOAD_BYTES parakeet 104857600 Maximum audio upload size in bytes for the Parakeet GPU and localhost APIs. The request body is capped before multipart parsing, with 1 MiB added for framing. Larger requests return 413. An invalid value stops startup.
PARAKEET_UPLOAD_TIMEOUT_SECONDS parakeet 120 Total seconds (1-3600) allowed to receive one Parakeet upload body before a 408 response releases admission capacity.
PARAKEET_CONCURRENCY parakeet 1 Maximum concurrent Parakeet inference calls per provider process. Default 1 prevents model thread-safety and GPU memory contention.
PARAKEET_API_TOKEN parakeet Auto-generated bearer credential required by Parakeet routes except /health.
PARAKEET_AUTH_MODE parakeet required Provider authentication mode: required (default) or disabled for an explicit emergency/local rollback.
PARAKEET_CORS_ORIGINS parakeet Optional comma-separated browser origin allowlist. Empty disables CORS; wildcard is invalid while authentication is required.
PARAKEET_INFERENCE_TIMEOUT_SECONDS parakeet 900 Finite model-load and transcription deadline in seconds (1-3600). A timeout returns 504 and then exits the provider process for restart.
PARAKEET_LOCALHOST_BIND_HOST parakeet 127.0.0.1 Native Parakeet listen address. Set another interface explicitly only when remote access is intended.
PARAKEET_LOCALHOST_PORT parakeet 63042 Host port for the parakeet-localhost source variant. URL is derived at compose-render time as http://host.docker.internal:63042.
WHISPER_CPP_LOCALHOST_PORT parakeet 63042 Host port for the whisper-cpp-localhost source variant, same as parakeet because the two modes are mutually exclusive. URL is derived at compose-render time as http://host.docker.internal:63042.
HUGGING_FACE_HUB_TOKEN parakeet Shared by parakeet, speaches, chatterbox, docling for model downloads. Consumed by ${HUGGING_FACE_HUB_TOKEN} interpolation in those services' compose blocks; owned here as its historic home.
PARAKEET_GPU_SCALE parakeet Set by ./start.sh from STT_PROVIDER_SOURCE; do not edit. 1 runs the parakeet-gpu container for parakeet-container-gpu, else 0.
STT_ENDPOINT parakeet Resolved per STT_PROVIDER_SOURCE. Consumed by n8n, backend, jupyterhub, open-webui, hermes-init (the latter as STT_INTERNAL_URL — owned by services/hermes/).
PARAKEET_GPU_IMAGE parakeet nvcr.io/nvidia/pytorch:26.06-py3 Used as BASE_IMAGE in stt-provider/gpu/Dockerfile.
PROMETHEUS_SOURCE prometheus disabled Prometheus deployment source: container or disabled. Also turns the node-exporter, cAdvisor, postgres-exporter and redis-exporter sidecars on or off.
PROMETHEUS_PORT prometheus 63006 Host port for Prometheus's HTTP UI + API (in-container 9090).
NODE_EXPORTER_PORT prometheus 63007 Host port for node-exporter (in-container 9100). Host-level metrics: CPU, memory, disk, network.
CADVISOR_PORT prometheus 63008 Host port for cAdvisor (in-container 8080). Per-container metrics: CPU, memory, IO.
PROMETHEUS_RETENTION_DAYS prometheus 7 TSDB retention in days. User-configurable at wizard time via the inline secondary numeric input. Default 7.
PROMETHEUS_ENDPOINT prometheus Resolved per PROMETHEUS_SOURCE — http://prometheus:9090 for container, empty for disabled. Consumed by Grafana's datasource provisioning.
PROMETHEUS_SCALE prometheus Set by ./start.sh from PROMETHEUS_SOURCE; do not edit. 1 runs the prometheus container, 0 does not.
NODE_EXPORTER_SCALE prometheus Set by ./start.sh from PROMETHEUS_SOURCE; do not edit. 1 runs the node-exporter container, 0 does not.
CADVISOR_SCALE prometheus Set by ./start.sh from PROMETHEUS_SOURCE; do not edit. 1 runs the cadvisor container, 0 does not.
PROMETHEUS_IMAGE prometheus prom/prometheus:v2.55.1 Container image for prometheus.
NODE_EXPORTER_IMAGE prometheus prom/node-exporter:v1.11.1 Container image for node-exporter.
CADVISOR_IMAGE prometheus gcr.io/cadvisor/cadvisor:v0.55.1 Container image for cadvisor.
RAY_SOURCE ray disabled Ray deployment source: ray-container-cpu, ray-container-gpu or disabled. Drives RAY_HEAD_SCALE, RAY_WORKER_SCALE, RAY_IMAGE and RAY_ADDRESS.
RAY_DASHBOARD_PORT ray 63002 Loopback-only host port for the Ray dashboard + native REST job-submission API (in-container 8265). Use the authenticated Kong route for remote access.
RAY_GCS_PORT ray 63003 Loopback-only host port for the Ray GCS (in-container 6379). Distinct from the project's Redis cache container; Ray bundles its own GCS process.
RAY_CLIENT_PORT ray 63004 Loopback-only host port for the unauthenticated Ray client server (in-container 10001). Used only by trusted host Python: ray.init('ray://localhost:<port>').
RAY_WORKER_COUNT ray 2 Number of ray-worker containers; 0 runs the head only. The wizard and --ray-worker-count accept 0-64; the wizard default is 2.
RAY_HEAD_SCALE ray Set by ./start.sh from RAY_SOURCE; do not edit. 1 runs the ray-head container for the container sources, else 0.
RAY_WORKER_SCALE ray Resolved by the bootstrapper from RAY_WORKER_COUNT when source is ray-container-{cpu,gpu}; 0 otherwise.
RAY_ADDRESS ray Resolved per source: ray://ray-head:10001 for container sources, empty for disabled. Injected into the backend + jupyterhub containers via their compose environment blocks.
RAY_DASHBOARD_URL ray Optional override for the Ray dashboard URL the backend's job client uses. Empty = derive from RAY_ADDRESS (http://ray-head:8265).
RAY_HEAD_MEMORY_LIMIT ray 4g Memory limit for ray-head (deploy.resources.limits.memory). The head runs the GCS, dashboard and object directory; 4g is safe on a 32 GB host. The shm_size=8gb /dev/shm allocation is separate from this cap.
RAY_HEAD_CPU_LIMIT ray 2.0 Container CPU limit for ray-head (deploy.resources.limits.cpus). GCS + dashboard coordination rarely needs more than 1 core; 2.0 leaves room for brief spikes.
RAY_WORKER_MEMORY_LIMIT ray 4g Container memory limit per ray-worker (deploy.resources.limits.memory). Workers run tasks and actors; 4 g per replica is a modest OOM fence on a 32 GB host with the default 2 workers. Raise for large in-memory datasets.
RAY_WORKER_CPU_LIMIT ray 2.0 Container CPU limit per ray-worker (deploy.resources.limits.cpus). 2.0 cores per worker. Raise if workers need more parallelism; lower if the host is saturated.
RAY_IMAGE ray rayproject/ray:2.56.0 CPU build. Same image used for both head and CPU workers.
RAY_GPU_IMAGE ray rayproject/ray:2.56.0-gpu GPU build with CUDA runtime. Selected by ray-container-gpu source.
REDIS_SOURCE redis container Single-option source: Redis always runs as a container. It is an env entry, not a sources block, so the wizard shows no one-option dropdown. The source validator expects REDIS_SOURCE=container.
REDIS_MAXMEMORY redis 0 Redis memory cap, e.g. 512mb. 0 means unlimited: Redis grows until the container is OOM-killed and loses in-flight queue state. A cap lets REDIS_MAXMEMORY_POLICY shed recomputable data instead. Size it to about 75% of the container memory budget.
REDIS_MAXMEMORY_POLICY redis volatile-lru volatile-lru evicts TTL keys, including LiteLLM cache and ordinary media records (seven-day default). Budget-tracked in-flight records, unresolved submissions and pending ledger intents persist until settlement. Without TTL keys, writes fail with OOM.
REDIS_PORT redis 63025 Host port. Container port is always 6379.
REDIS_PASSWORD redis redis_password Used by Redis consumers, including n8n queues, litellm cache, open-webui websocket storage, and backend state and queues. The default is for fresh-install convenience only; rotate before any deployment.
REDIS_URL redis redis://:${REDIS_PASSWORD}@redis:6379/0 Default connection string (database 0, also n8n's queue and LiteLLM's cache). Consumers that need another DB index build their own URL: open-webui and lightrag share /2, jupyterhub uses /3. Compose substitutes REDIS_PASSWORD.
REDIS_EXPORTER_PORT redis 63026 Host port for redis-exporter (in-container 9121). Sidecar gated by PROMETHEUS_SOURCE.
REDIS_EXPORTER_SCALE redis Set by _generate_prometheus_config() to 1 when PROMETHEUS_SOURCE=container, 0 otherwise.
REDIS_IMAGE redis redis:7.2.14-alpine Bumping the redis version: change this default and rerun ./start.sh.
REDIS_EXPORTER_IMAGE redis oliver006/redis_exporter:v1.86.0 Prometheus exporter sidecar. Scales 1↔0 with PROMETHEUS_SOURCE (gated by _generate_prometheus_config).
REDPANDA_SOURCE redpanda disabled Redpanda deployment source: container or disabled. Drives the Redpanda, redpanda-init and Console scales plus REDPANDA_BROKERS and SPARK_KAFKA_BOOTSTRAP_SERVERS.
REDPANDA_KAFKA_PORT redpanda 63010 Host port for the Redpanda Kafka API external listener (in-container 19092).
REDPANDA_CONSOLE_PORT redpanda 63011 Host port for Redpanda Console (in-container 8080).
REDPANDA_DEMO_TOPICS redpanda atlas_stream_events Comma-separated Kafka topics created idempotently by redpanda-init.
REDPANDA_SCALE redpanda Set by ./start.sh from REDPANDA_SOURCE; do not edit. 1 runs the redpanda broker, 0 does not.
REDPANDA_INIT_SCALE redpanda Set by ./start.sh from REDPANDA_SOURCE; do not edit. 1 runs the redpanda-init container, 0 does not.
REDPANDA_CONSOLE_SCALE redpanda Set by ./start.sh from REDPANDA_SOURCE; do not edit. 1 runs the redpanda-console container, 0 does not.
REDPANDA_BROKERS redpanda In-network Kafka bootstrap servers for Atlas services.
SPARK_KAFKA_BOOTSTRAP_SERVERS redpanda Spark Structured Streaming Kafka bootstrap servers; blank when Redpanda is disabled.
REDPANDA_IMAGE redpanda docker.redpanda.com/redpandadata/redpanda:v26.1.12 Pinned to the latest Redpanda 26.1.x maintenance release verified for multi-arch Docker images.
REDPANDA_CONSOLE_IMAGE redpanda docker.redpanda.com/redpandadata/console:v3.8.0 Pinned to the latest Redpanda Console 3.8.x release.
SEARXNG_SOURCE searxng container SearXNG deployment source: container or disabled.
SEARXNG_PORT searxng 63056 Host port for the SearXNG web UI and JSON API (container port 8080). Also sets SEARXNG_BASE_URL.
SEARXNG_SECRET searxng Auto-generated by bootstrapper.
SEARXNG_SCALE searxng Set by ./start.sh from SEARXNG_SOURCE; do not edit. 1 runs the searxng container, 0 does not.
SEARXNG_IMAGE searxng searxng/searxng:2026.6.28-357662d86 Container image for searxng.
SPARK_SOURCE spark disabled Deployment source for the Spark standalone cluster (master, workers, history, Spark Connect, spark-init): container or disabled (default).
SPARK_MASTER_UI_PORT spark 63027 Host port for the Spark Master Web UI (in-container 8080).
SPARK_HISTORY_PORT spark 63028 Host port for the Spark History Server (in-container 18080).
SPARK_WORKER_COUNT spark 2 Number of spark-worker replicas alongside the master. 1-8.
SPARK_MASTER_SCALE spark Set by ./start.sh from SPARK_SOURCE; do not edit. 1 runs spark-master, 0 does not.
SPARK_WORKER_SCALE spark Resolved by the bootstrapper from SPARK_WORKER_COUNT when source=container; 0 otherwise.
SPARK_HISTORY_SCALE spark Set by ./start.sh from SPARK_SOURCE; do not edit. 1 runs the Spark History Server, 0 does not.
SPARK_INIT_SCALE spark Set by ./start.sh from SPARK_SOURCE; do not edit. 1 runs spark-init, which creates the spark-history bucket; 0 does not.
SPARK_CONNECT_SCALE spark Resolved by the bootstrapper from SPARK_SOURCE; spark-connect runs as a sidecar to spark-master.
SPARK_CONNECT_CORES_MAX spark 1 Maximum standalone-cluster cores the long-lived Spark Connect server may hold. Keep below total worker cores so Airflow SparkSubmit and Zeppelin standalone workloads can run alongside Connect; raise only when the worker pool has enough headroom.
SPARK_MASTER_MEMORY_LIMIT spark 2g Container memory limit for spark-master (deploy.resources.limits.memory). The standalone master process manages cluster state and requires minimal heap — 2 g is generous on a 32 GB host.
SPARK_MASTER_CPU_LIMIT spark 1.0 Container CPU limit for spark-master (deploy.resources.limits.cpus). Master is lightweight; 1.0 core is ample.
SPARK_WORKER_MEMORY_LIMIT spark 4g Container memory limit per spark-worker (deploy.resources.limits.memory). Workers run executor JVMs; 4 g per replica is a conservative cap on a 32 GB host with the default 2 workers (8 g total). Raise for memory-intensive jobs.
SPARK_WORKER_CPU_LIMIT spark 2.0 Container CPU limit per spark-worker (deploy.resources.limits.cpus). 2.0 cores per worker leaves headroom for other services on the host.
SPARK_IMAGE spark apache/spark:4.1.2 Container image for spark-master.
SPEACHES_GPU_IMAGE speaches ghcr.io/speaches-ai/speaches:0.9.0-rc.3-cuda CUDA build of the same image. When the speaches-gpu profile wins, the bootstrapper writes this value into SPEACHES_IMAGE (the compose interpolation target).
SPEACHES_TTS_MODEL speaches speaches-ai/Kokoro-82M-v1.0-ONNX Model id Open WebUI sends in /v1/audio/speech requests. It must be the Speaches Kokoro ONNX executor id (speaches-ai/Kokoro-82M-v1.0-ONNX). The HuggingFace 'hexgrad/Kokoro-82M' id is invalid for Speaches and returns 404.
SPEACHES_STT_MODEL speaches Systran/faster-distil-whisper-large-v3 Inert: Speaches preloads from a hard-coded PRELOAD_MODELS list, and Open WebUI requests whisper-1. Changing this value has no effect.
SPEACHES_PORT speaches 63060 Host port for the Speaches container (in-container listen port is 8000).
SPEACHES_SCALE speaches Computed by bootstrapper/services/service_config.py::_generate_stt_provider_config (or _generate_tts_provider_config) — set to 1 when STT_PROVIDER_SOURCE OR TTS_PROVIDER_SOURCE picks a speaches-* variant.
SPEACHES_IMAGE speaches ghcr.io/speaches-ai/speaches:0.9.0-rc.3-cpu CPU build (default). When the speaches-gpu profile wins, the bootstrapper rewrites this var from SPEACHES_GPU_IMAGE at generation time.
SUPABASE_DB_SOURCE supabase container Single-option (container only). Kept for forward-compat with legacy source-validator.
SUPABASE_DB_PORT supabase 63012 Host port for supabase-db PostgreSQL (in-container 5432), bound to HOST_BIND_IP (loopback by default).
SUPABASE_DB_USER supabase supabase_admin Postgres superuser name, passed to supabase-db as POSTGRES_USER and used by supabase-db-init.
SUPABASE_DB_PASSWORD supabase password Supabase postgres admin password; auto-generated by the bootstrapper when left as the placeholder.
SUPABASE_DB_NAME supabase postgres Database name, passed to supabase-db as POSTGRES_DB and used by supabase-db-init, pg-meta and Realtime.
SUPABASE_DB_NAME_URI supabase postgres Bootstrapper-synchronized percent-encoded SUPABASE_DB_NAME for DSN path components.
SUPABASE_DB_APP_USER supabase app_user Reserved for a future least-privilege application-tier database user; not created by init scripts today.
SUPABASE_DB_APP_PASSWORD supabase app_password Reserved future app-user password; auto-generated by the bootstrapper when left as the placeholder.
SUPABASE_AUTH_DB_USER supabase supabase_auth_admin Login name of the Supabase Auth (GoTrue) schema owner. supabase-db-init creates it if missing and sets its password.
SUPABASE_AUTH_DB_PASSWORD supabase atlas-db-password Auto-generated login password for the upstream auth schema owner.
SUPABASE_AUTH_DB_USER_URI supabase supabase_auth_admin Bootstrapper-synchronized percent-encoded SUPABASE_AUTH_DB_USER for DSN userinfo.
SUPABASE_AUTH_DB_PASSWORD_URI supabase atlas-db-password Bootstrapper-synchronized percent-encoded SUPABASE_AUTH_DB_PASSWORD for DSN userinfo.
SUPABASE_STORAGE_DB_USER supabase supabase_storage_admin Login name of the Supabase Storage schema owner. supabase-db-init creates it if missing and sets its password.
SUPABASE_STORAGE_DB_PASSWORD supabase atlas-db-password Auto-generated login password for the upstream storage schema owner.
SUPABASE_STORAGE_DB_USER_URI supabase supabase_storage_admin Bootstrapper-synchronized percent-encoded SUPABASE_STORAGE_DB_USER for DSN userinfo.
SUPABASE_STORAGE_DB_PASSWORD_URI supabase atlas-db-password Bootstrapper-synchronized percent-encoded SUPABASE_STORAGE_DB_PASSWORD for DSN userinfo.
SUPABASE_API_DB_USER supabase authenticator Login name of the PostgREST's role-switching authenticator. supabase-db-init creates it if missing and sets its password.
SUPABASE_API_DB_PASSWORD supabase atlas-db-password Auto-generated login password for PostgREST's role-switching authenticator.
SUPABASE_API_DB_USER_URI supabase authenticator Bootstrapper-synchronized percent-encoded SUPABASE_API_DB_USER for DSN userinfo.
SUPABASE_API_DB_PASSWORD_URI supabase atlas-db-password Bootstrapper-synchronized percent-encoded SUPABASE_API_DB_PASSWORD for DSN userinfo.
SUPABASE_REALTIME_DB_USER supabase atlas_realtime Login name of the replication-scoped Realtime role. supabase-db-init creates it if missing and sets its password.
SUPABASE_REALTIME_DB_PASSWORD supabase atlas-db-password Auto-generated password for the replication-scoped Realtime role.
SUPABASE_META_DB_USER supabase atlas_meta Login name of the dashboard metadata role used by pg-meta and Studio. supabase-db-init creates it if missing and sets its password.
SUPABASE_META_DB_PASSWORD supabase atlas-db-password Auto-generated password for the dashboard metadata role used by Meta and Studio.
SUPABASE_META_CRYPTO_KEY supabase Auto-generated key shared by Studio (as PG_META_CRYPTO_KEY) and Postgres Meta (as CRYPTO_KEY) to encrypt the connection header Studio sends Meta. Empty falls back to the images' public SAMPLE_KEY constant.
SUPABASE_META_DB_USER_URI supabase atlas_meta Bootstrapper-synchronized percent-encoded SUPABASE_META_DB_USER for DSN userinfo.
SUPABASE_META_DB_PASSWORD_URI supabase atlas-db-password Bootstrapper-synchronized percent-encoded SUPABASE_META_DB_PASSWORD for DSN userinfo.
SUPABASE_STUDIO_DB_USER supabase atlas_studio_readonly Read-only SQL-editor identity used by Studio; it shares Studio's single password interface with Meta but has no Meta admin authority.
SUPABASE_STUDIO_DB_USER_URI supabase atlas_studio_readonly Bootstrapper-synchronized percent-encoded SUPABASE_STUDIO_DB_USER for Studio's constructed DSN.
SUPABASE_DB_INIT_SOURCE supabase container Container only: the post-init SQL runner every Supabase-backed service waits for. Other values are rejected.
POSTGRES_EXPORTER_PORT supabase 63013 Host port for postgres-exporter (in-container 9187). Sidecar gated by PROMETHEUS_SOURCE.
POSTGRES_EXPORTER_SCALE supabase Set by _generate_prometheus_config() to 1 when PROMETHEUS_SOURCE=container, 0 otherwise.
POSTGRES_EXPORTER_DB_USER supabase atlas_metrics Login name of the pg_monitor-only role postgres-exporter uses. supabase-db-init creates it if missing and sets its password.
POSTGRES_EXPORTER_DB_PASSWORD supabase atlas-db-password Auto-generated password for the pg_monitor-only exporter role.
POSTGRES_EXPORTER_DB_USER_URI supabase atlas_metrics Bootstrapper-synchronized percent-encoded POSTGRES_EXPORTER_DB_USER for DSN userinfo.
POSTGRES_EXPORTER_DB_PASSWORD_URI supabase atlas-db-password Bootstrapper-synchronized percent-encoded POSTGRES_EXPORTER_DB_PASSWORD for DSN userinfo.
SUPABASE_META_SOURCE supabase container Deployment source for pg-meta (supabase-meta): container (default) or disabled.
SUPABASE_META_SCALE supabase Set by ./start.sh from SUPABASE_META_SOURCE; do not edit. 1 runs the container, 0 (disabled) does not.
SUPABASE_META_PORT supabase 63014 Reserved port slot for pg-meta; not published on the host. Reach it through Kong at /pg/.
SUPABASE_STORAGE_SOURCE supabase container Deployment source for Supabase Storage (supabase-storage): container (default) or disabled.
SUPABASE_STORAGE_SCALE supabase Set by ./start.sh from SUPABASE_STORAGE_SOURCE; do not edit. 1 runs the container, 0 (disabled) does not.
SUPABASE_STORAGE_PORT supabase 63015 Host port for Supabase Storage (in-container 5000), bound to HOST_BIND_IP (loopback by default).
STORAGE_REGION supabase local Region name passed to Supabase Storage as REGION.
STORAGE_FILE_SIZE_LIMIT supabase 52428800 Maximum upload size in bytes for Supabase Storage (FILE_SIZE_LIMIT). The default is 50 MiB.
STORAGE_BACKEND supabase file Supabase Storage backend. The default file stores objects in the storage volume at /var/lib/storage.
PROJECT_REF supabase default Project reference passed to Supabase Storage as PROJECT_REF.
TENANT_ID supabase stub Tenant id passed to Supabase Storage as TENANT_ID.
SUPABASE_AUTH_SOURCE supabase container Deployment source for Supabase Auth, GoTrue (supabase-auth): container (default) or disabled.
SUPABASE_AUTH_SCALE supabase Set by ./start.sh from SUPABASE_AUTH_SOURCE; do not edit. 1 runs the container, 0 (disabled) does not.
SUPABASE_AUTH_PORT supabase 63016 Reserved port slot for Supabase Auth (GoTrue); not published on the host. Reach it through Kong at /auth/v1.
SUPABASE_JWT_SECRET supabase Auto-generated by bootstrapper/generate_supabase_keys.py on first run.
SUPABASE_ANON_KEY supabase Auto-generated.
SUPABASE_SERVICE_KEY supabase Auto-generated.
SUPABASE_API_SOURCE supabase container Deployment source for PostgREST (supabase-api): container (default) or disabled.
SUPABASE_API_SCALE supabase Set by ./start.sh from SUPABASE_API_SOURCE; do not edit. 1 runs the container, 0 (disabled) does not.
SUPABASE_API_PORT supabase 63017 Host port for PostgREST (in-container 3000), bound to HOST_BIND_IP (loopback by default).
SUPABASE_REALTIME_SOURCE supabase container Deployment source for Supabase Realtime (supabase-realtime): container (default) or disabled.
SUPABASE_REALTIME_SCALE supabase Set by ./start.sh from SUPABASE_REALTIME_SOURCE; do not edit. 1 runs the container, 0 (disabled) does not.
SUPABASE_REALTIME_PORT supabase 63018 Host port for Supabase Realtime (in-container 4000), bound to HOST_BIND_IP (loopback by default).
SUPABASE_STUDIO_SOURCE supabase container Deployment source for Supabase Studio (supabase-studio): container (default) or disabled.
SUPABASE_STUDIO_SCALE supabase Set by ./start.sh from SUPABASE_STUDIO_SOURCE; do not edit. 1 runs the container, 0 (disabled) does not.
SUPABASE_STUDIO_PORT supabase 63019 Reserved port slot for Supabase Studio; not published on the host. Reach it through Kong.
SUPABASE_DB_IMAGE supabase supabase/postgres:17.6.1.139 Container image for supabase-db.
SUPABASE_DB_INIT_IMAGE supabase postgres:15.19-alpine Container image for supabase-db-init.
SUPABASE_META_IMAGE supabase supabase/postgres-meta:v0.96.6 Container image for supabase-meta.
SUPABASE_STORAGE_IMAGE supabase supabase/storage-api:v1.61.5 Container image for supabase-storage.
SUPABASE_AUTH_IMAGE supabase supabase/gotrue:v2.191.0 Container image for supabase-auth.
SUPABASE_API_IMAGE supabase postgrest/postgrest:v12.2.10 Container image for supabase-api.
SUPABASE_REALTIME_IMAGE supabase supabase/realtime:v2.112.0 Container image for supabase-realtime.
SUPABASE_STUDIO_IMAGE supabase supabase/studio:2026.06.22-sha-2207d7f Container image for supabase-studio.
POSTGRES_EXPORTER_IMAGE supabase prometheuscommunity/postgres-exporter:v0.19.1 Prometheus exporter sidecar. Scales 1↔0 with PROMETHEUS_SOURCE (gated by _generate_prometheus_config).
SUPAVISOR_DB_ADMIN_USER supavisor atlas_supavisor Scoped owner for Supavisor's dedicated management database.
SUPAVISOR_DB_ADMIN_PASSWORD supavisor atlas-db-password Auto-generated password for Supavisor management migrations and auth lookup.
SUPAVISOR_DB_ADMIN_USER_URI supavisor atlas_supavisor Bootstrapper-synchronized percent-encoded SUPAVISOR_DB_ADMIN_USER for DSN userinfo.
SUPAVISOR_DB_ADMIN_PASSWORD_URI supavisor atlas-db-password Bootstrapper-synchronized percent-encoded SUPAVISOR_DB_ADMIN_PASSWORD for DSN userinfo.
SUPAVISOR_SOURCE supavisor disabled Deployment mode: container (transaction pooler) or disabled/direct Postgres.
SUPAVISOR_SCALE supavisor 1 when SUPAVISOR_SOURCE=container, otherwise 0.
SUPAVISOR_TENANT_ID supavisor atlas Supavisor tenant suffix. Clients connect as <db_user>.<tenant>; only ASCII letters, digits, underscores, and hyphens are accepted because dot is the upstream user/tenant delimiter.
SUPAVISOR_DEFAULT_POOL_SIZE supavisor 20 Default upstream Postgres pool size for the Atlas tenant.
SUPAVISOR_MAX_CLIENT_CONN supavisor 100 Maximum client connections accepted by the Atlas tenant.
SUPAVISOR_DB_POOL_SIZE supavisor 5 Supavisor metadata database pool size.
SUPAVISOR_DATABASE_URL supavisor Generated Postgres URL consumed by backend/Celery; points at Supavisor when enabled and direct Supabase Postgres when disabled.
SUPAVISOR_DB_HOST supavisor Generated n8n Postgres host; supavisor when enabled, supabase-db when disabled.
SUPAVISOR_DB_PORT_VALUE supavisor Generated n8n Postgres port; 6543 when enabled, 5432 when disabled.
SUPAVISOR_DB_USER supavisor Generated n8n Postgres user; appends .${SUPAVISOR_TENANT_ID} when Supavisor is enabled.
SUPAVISOR_SECRET_KEY_BASE supavisor Supavisor Phoenix secret; auto-generated by the bootstrapper when blank.
SUPAVISOR_VAULT_ENC_KEY supavisor Supavisor vault encryption key; must be exactly 32 bytes and is auto-generated when blank.
SUPAVISOR_API_JWT_SECRET supavisor Supavisor tenant API JWT secret; auto-generated by the bootstrapper when blank.
SUPAVISOR_METRICS_JWT_SECRET supavisor Supavisor metrics JWT secret; auto-generated by the bootstrapper when blank.
SUPAVISOR_IMAGE supavisor supabase/supavisor:2.9.5 Container image for supavisor.
TEI_RERANKER_SOURCE tei-reranker disabled Deployment source for the TEI reranker: container-cpu, container-gpu, localhost or disabled (default).
TEI_RERANKER_PORT tei-reranker 63041 Host port for the TEI rerank API (in-container listen port is 80).
TEI_RERANKER_LOCALHOST_PORT tei-reranker 63049 Host port for the host-installed TEI rerank source variant.
TEI_RERANKER_MODEL_ID tei-reranker mixedbread-ai/mxbai-rerank-base-v1 Hugging Face model id TEI serves (--model-id).
TEI_RERANKER_REVISION tei-reranker 800f24c113213a187e65bde9db00c15a2bb12738 Model revision TEI loads (--revision). The default pins a commit of the default model.
TEI_RERANKER_MAX_CLIENT_BATCH_SIZE tei-reranker 32 Maximum inputs per client request TEI accepts (--max-client-batch-size).
TEI_RERANKER_MEMORY_LIMIT tei-reranker 4g Container memory limit for tei-reranker (deploy.resources.limits.memory).
TEI_RERANKER_CPU_LIMIT tei-reranker 2.0 Container CPU limit for tei-reranker (deploy.resources.limits.cpus).
TEI_RERANKER_HF_CACHE_DIR tei-reranker /data In-container Hugging Face cache (HF_HOME). The default /data is the tei-reranker-data volume, so models persist across restarts.
TEI_RERANKER_SCALE tei-reranker Set by ./start.sh from TEI_RERANKER_SOURCE; do not edit. 1 runs tei-reranker for container-cpu and container-gpu, 0 otherwise.
TEI_RERANKER_ENDPOINT tei-reranker Resolved per TEI_RERANKER_SOURCE. Exposes TEI's rerank endpoint to compatible consumers.
TEI_RERANKER_IMAGE_RESOLVED tei-reranker Image picked per source variant (CPU vs GPU).
TEI_RERANKER_CPU_IMAGE tei-reranker ghcr.io/huggingface/text-embeddings-inference:cpu-1.9@sha256:ad950d30878eceb72aaf32024d26fa2b1d04a75304fa0b4776b49aa1941fea07 Used when TEI_RERANKER_SOURCE=container-cpu on amd64 hosts. Compiled with ORT backend (requires ONNX model weights). Digest-pinned: the cpu-1.9 family tag is republished per patch.
TEI_RERANKER_CPU_ARM64_IMAGE tei-reranker ghcr.io/huggingface/text-embeddings-inference:cpu-arm64-latest@sha256:35c50d7494de22deecdb783b8f5b7e1d05765709bd90071b03469b9440d28656 Used when TEI_RERANKER_SOURCE=container-cpu on arm64 hosts (Apple Silicon). Compiled with candle backend (loads safetensors natively, no ONNX required). Unversioned tag — HF doesn't publish versioned arm64 tags as of 2026-06-06.
TEI_RERANKER_GPU_IMAGE tei-reranker ghcr.io/huggingface/text-embeddings-inference:1.9@sha256:536efce2a0dc0acd0336d683ef1b81fcf900f76c8fb850e25a6d48a54a97df91 Used when TEI_RERANKER_SOURCE=container-gpu. CUDA host required. Digest-pinned: the 1.9 minor tag is republished per patch.
TEMPO_SOURCE tempo disabled Deployment source for Grafana Tempo trace storage: container or disabled (default).
TEMPO_SCALE tempo Set by ./start.sh from TEMPO_SOURCE; do not edit. 1 runs tempo, 0 does not.
TEMPO_ENDPOINT tempo Internal Tempo query/API endpoint consumed by Grafana.
TEMPO_RETENTION_PERIOD tempo 336h Trace retention (Tempo block_retention, applied by its backend scheduler and worker). Tempo's own default, 14 days; lower it to bound the tempo-data volume.
TEMPO_IMAGE tempo grafana/tempo:3.0.0 Container image for tempo.
TIKA_SOURCE tika disabled Deployment source for Apache Tika: container, tika-localhost or disabled (default).
TIKA_PORT tika 63057 Host port for the Tika server (in-container 9998), bound to HOST_BIND_IP (loopback by default).
TIKA_LOCALHOST_PORT tika 9998 Host port for the tika-localhost source variant.
TIKA_JAVA_TOOL_OPTIONS tika -Xmx768m JVM memory cap for the Tika server container.
TIKA_MAX_FILE_SIZE tika 52428800 Positive Backend maximum bytes accepted for Docling/Tika extraction; invalid values fail Backend startup.
TIKA_TIMEOUT_SECONDS tika 30 Finite Backend timeout in seconds for Tika fallback extraction calls. Must be greater than 0 and no greater than 3600; invalid values fail Backend startup.
TIKA_SCALE tika Set by ./start.sh from TIKA_SOURCE; do not edit. 1 runs tika for container, 0 otherwise.
TIKA_ENDPOINT tika Resolved per TIKA_SOURCE: http://tika:9998, the tika-localhost URL, or empty when disabled. Read by backend, celery and n8n.
TIKA_IMAGE tika apache/tika:3.3.1.0 Container image for tika.
TRINO_SOURCE trino disabled Deployment source for the Trino coordinator: container or disabled (default). container requires MinIO and the Iceberg REST catalog.
TRINO_PORT trino 63029 Host port for the Trino coordinator UI/API (in-container 8080).
TRINO_SCALE trino Set by ./start.sh from TRINO_SOURCE; do not edit. 1 runs trino, 0 does not.
TRINO_IMAGE trino trinodb/trino:482 Pinned to the current Trino release tag validated against the Iceberg REST + MinIO catalog contract.
TRUEFORGE_SOURCE trueforge disabled Deployment source for TrueForge (server, schedule controller and init): container or disabled (default).
TRUEFORGE_PORT trueforge 63079 Host port for the TrueForge server UI + API (in-container 8790).
TRUEFORGE_ENDPOINT trueforge Resolved per TRUEFORGE_SOURCE — http://trueforge:8790 for container, empty for disabled.
TRUEFORGE_API_KEY trueforge Auto-generated by the bootstrapper on first run. Service credential for the controller's internal schedule-dispatch calls to the server.
TRUEFORGE_DB_NAME trueforge trueforge Name of TrueForge's dedicated database, created by supabase-db-init.
TRUEFORGE_DB_NAME_URI trueforge trueforge Bootstrapper-synchronized percent-encoded TRUEFORGE_DB_NAME for DSN path components.
TRUEFORGE_DB_USER trueforge trueforge Login name of the owner of TrueForge's dedicated database, created by supabase-db-init.
TRUEFORGE_DB_PASSWORD trueforge atlas-db-password Auto-generated password for the owner of TrueForge's dedicated database.
TRUEFORGE_DB_USER_URI trueforge trueforge Bootstrapper-synchronized percent-encoded TRUEFORGE_DB_USER for DSN userinfo.
TRUEFORGE_DB_PASSWORD_URI trueforge atlas-db-password Bootstrapper-synchronized percent-encoded TRUEFORGE_DB_PASSWORD for DSN userinfo.
TRUEFORGE_SCALE trueforge Set by ./start.sh from TRUEFORGE_SOURCE; do not edit. 1 runs the trueforge server, 0 does not.
TRUEFORGE_CONTROLLER_SCALE trueforge Set by ./start.sh from TRUEFORGE_SOURCE; do not edit. 1 runs trueforge-controller, 0 does not.
TRUEFORGE_INIT_SCALE trueforge Set by ./start.sh from TRUEFORGE_SOURCE; do not edit. 1 runs trueforge-init, 0 does not.
TRUEFORGE_IMAGE trueforge tfy.jfrog.io/tfy-images/trueforge:0.2.0-8b1d98e Container image for trueforge.
TTS_PROVIDER_SOURCE tts-provider speaches-container-cpu Text-to-speech engine: speaches-container-cpu (default), speaches-container-gpu, chatterbox-container-gpu, chatterbox-localhost or disabled.
TTS_PROVIDER_PORT tts-provider 63058 Wizard display slot. Real engine port lives on its own container manifest.
TTS_PROVIDER_SCALE tts-provider Set by ./start.sh; do not edit. 1 when a container engine serves text-to-speech, else 0. The wizard uses it to colour the TTS row.
TTS_ENDPOINT tts-provider Resolved per TTS_PROVIDER_SOURCE. Read by n8n and jupyterhub; hermes-init receives it as TTS_INTERNAL_URL, and Open WebUI gets derived OPEN_WEB_UI_TTS_* values. The backend receives it but does not use it.
VERBA_SOURCE verba disabled Deployment source for the Verba RAG UI: container or disabled (default).
VERBA_PORT verba 63098 Host port for the Verba UI/API (in-container 8000).
VERBA_ENDPOINT verba In-network URL for Atlas services and notebooks.
VERBA_SCALE verba Set by ./start.sh from VERBA_SOURCE; do not edit. 1 runs verba, 0 does not.
VERBA_WEAVIATE_URL verba Resolved Weaviate URL passed to upstream WEAVIATE_URL_VERBA, which Verba reads only for its Weaviate (cloud) deployment; the default Docker deployment always dials weaviate:8080. For WEAVIATE_SOURCE=localhost pick Custom on Verba's connect screen.
VERBA_OPENAI_MODEL verba Optional Verba OpenAI generator model name. Empty uses LITELLM_DEFAULT_MODEL (Verba itself would otherwise start with an empty model name).
VERBA_OPENAI_EMBED_MODEL verba Optional Verba OpenAI-compatible embedding model name. Empty uses LITELLM_EMBEDDING_MODEL.
VERBA_DEFAULT_DEPLOYMENT verba Docker Verba deployment selector. Atlas uses Docker to target the external Weaviate container.
VERBA_IMAGE verba semitechnologies/verba@sha256:0947d289ebff2c9814941c8d4282ee994dc79598e76162ae82e6efda4682b0b7 Upstream publishes semitechnologies/verba:latest but no v2.1.3 Docker tag; Atlas pins the observed multi-arch index digest.
VLLM_METAL_SOURCE vllm-metal disabled Options: managed-localhost (bootstrapper-supervised host process on Apple silicon), disabled.
VLLM_METAL_MODEL vllm-metal Qwen/Qwen2.5-7B-Instruct Hugging Face model id served by the managed vLLM Metal process and registered with LiteLLM under the same alias.
VLLM_METAL_LOCALHOST_PORT vllm-metal 8000 Host port the managed vLLM Metal OpenAI server listens on. Not a BASE_PORT slot — vLLM Metal has no Kong route or exposed stack port.
VLLM_METAL_PLUGIN_VERSION vllm-metal 0.3.0.dev20260713103604 Atlas-verified vllm-metal GitHub release wheel installed with checksum verification; unverified overrides are rejected.
VLLM_METAL_CORE_VERSION vllm-metal 0.24.0 Atlas-verified compatible vllm core source release; it must match the supported plugin release.
VLLM_METAL_PYTHON vllm-metal python3.12 Python interpreter used to build the managed host venv (vllm-metal requires 3.12).
VLLM_METAL_STATE_DIR vllm-metal ~/.atlas/vllm-metal Host directory holding the managed venv plus the pid / log / status files.
VLLM_METAL_MODELS_PATH vllm-metal Optional Hugging Face cache dir (HF_HOME) for the managed process. Blank = default HF cache.
VLLM_METAL_MIN_MEMORY_GB vllm-metal 16 Unified-memory warning floor (GB) checked before lifecycle work; memory below it warns and unreadable memory skips the check. The result does not block install or start and does not certify model fit or prevent OOM.
VLLM_METAL_SCALE vllm-metal Always 0 — vLLM Metal never runs as a container. Reserved for interface parity with container services.
VLLM_METAL_ENDPOINT vllm-metal Resolved docker-internal URL of the managed host process (http://host.docker.internal:${VLLM_METAL_LOCALHOST_PORT}). Consumed by litellm-init to register the model. Blank when disabled.
WEAVIATE_SOURCE weaviate container Deployment source for Weaviate: container (default), localhost or disabled.
WEAVIATE_PORT weaviate 63030 Host port for the Weaviate REST API (in-container 8080), bound to HOST_BIND_IP (loopback by default).
WEAVIATE_GRPC_PORT weaviate 63031 Host port for the Weaviate gRPC API (in-container 50051), bound to HOST_BIND_IP (loopback by default).
WEAVIATE_INIT_SOURCE weaviate container Auto-managed by weaviate. Container/disabled.
MULTI2VEC_CLIP_SOURCE weaviate container-cpu Options: container-cpu, container-gpu, disabled. container-gpu sets ENABLE_CUDA=1, but Compose reserves no GPU device yet. The CLIP container then fails to start; use container-cpu.
WEAVIATE_ENABLE_MODULES weaviate text2vec-openai,text2vec-ollama,multi2vec-clip,generative-openai,generative-ollama,backup-filesystem Weaviate module list (ENABLE_MODULES). ./start.sh adds or removes multi2vec-clip to match MULTI2VEC_CLIP_SOURCE and keeps any other modules you list.
CLIP_INFERENCE_API weaviate http://multi2vec-clip:8080 URL Weaviate uses for the multi2vec-clip module. ./start.sh empties it when MULTI2VEC_CLIP_SOURCE=disabled.
MULTI2VEC_CLIP_SIGLIP2_IMAGE weaviate semitechnologies/multi2vec-clip:google-siglip2-so400m-patch16-512-1.5.1 Opt-in SigLIP 2 image reference for MULTI2VEC_CLIP_IMAGE. Produces 1152-d vectors; revectorize or create new Weaviate collections before switching.
WEAVIATE_URL weaviate Resolved per WEAVIATE_SOURCE. Consumed by n8n, backend, jupyterhub.
WEAVIATE_LITELLM_API_KEY weaviate Mirror of LITELLM_MASTER_KEY for Weaviate's vectorizer auth.
WEAVIATE_SCALE weaviate Set by ./start.sh from WEAVIATE_SOURCE; do not edit. 1 runs weaviate for container, 0 otherwise.
WEAVIATE_INIT_SCALE weaviate Set by ./start.sh from WEAVIATE_SOURCE; do not edit. 1 runs weaviate-init with a container Weaviate, 0 otherwise.
CLIP_SCALE weaviate Computed from MULTI2VEC_CLIP_SOURCE.
CLIP_ENABLE_CUDA weaviate Set by ./start.sh from MULTI2VEC_CLIP_SOURCE; do not edit. Passed to multi2vec-clip as ENABLE_CUDA. container-gpu sets 1, but compose requests no GPU device.
CLIP_DEPLOY_RESOURCES weaviate ~ Set by ./start.sh from the multi2vec-clip deploy slice; ~ means none. No compose file reads it.
WEAVIATE_LOCALHOST_PORT weaviate 8080 Host port for the weaviate-localhost source variant. URL is derived at compose-render time as http://host.docker.internal:8080.
WEAVIATE_MEMORY_LIMIT weaviate 2g Container memory limit for the weaviate container (deploy.resources.limits.memory). The 2g default is conservative for a 32 GB host. It fits the Go data plane and in-memory HNSW index for small-to-medium collections.
WEAVIATE_CPU_LIMIT weaviate 1.5 Container CPU limit for the weaviate container (deploy.resources.limits.cpus). 1.5 cores covers routine indexing and query serving on a shared host.
WEAVIATE_IMAGE weaviate cr.weaviate.io/semitechnologies/weaviate:1.38.17 Container image for weaviate.
WEAVIATE_INIT_IMAGE weaviate alpine:3.24.2 Container image for weaviate-init.
MULTI2VEC_CLIP_IMAGE weaviate semitechnologies/multi2vec-clip:sentence-transformers-clip-ViT-B-32-1.5.1 Container image for multi2vec-clip.
ZEPPELIN_SPARK_CORES_MAX zeppelin 1 Cores the long-lived Zeppelin Spark interpreter may hold (spark.cores.max, re-seeded each start). Uncapped, it takes every free worker core and leaves Airflow SparkSubmit drivers waiting. Raise it only with spare cores beyond Spark Connect and Airflow.
ZEPPELIN_DB_USER zeppelin atlas_zeppelin Read-only PostgreSQL login exposed to Zeppelin's JDBC interpreter.
ZEPPELIN_DB_PASSWORD zeppelin atlas-db-password Auto-generated password for Zeppelin's read-only database role.
ZEPPELIN_SOURCE zeppelin disabled Deployment source for Zeppelin: container or disabled (default). container requires SPARK_SOURCE=container.
ZEPPELIN_PORT zeppelin 63099 Host port for the Zeppelin Web UI (in-container 8080).
ZEPPELIN_SCALE zeppelin Set by ./start.sh from ZEPPELIN_SOURCE; do not edit. 1 runs zeppelin, 0 does not.
ZEPPELIN_INIT_SCALE zeppelin Set by ./start.sh from ZEPPELIN_SOURCE; do not edit. 1 runs zeppelin-init, 0 does not.
ZEPPELIN_MEMORY_LIMIT zeppelin 2g Container memory limit for the zeppelin container (deploy.resources.limits.memory). Zeppelin's JVM-based interpreter host typically uses under 1 g for a single-user session; 2 g leaves comfortable headroom on a 32 GB host.
ZEPPELIN_CPU_LIMIT zeppelin 1.5 Container CPU limit for the zeppelin container (deploy.resources.limits.cpus). 1.5 cores covers notebook rendering and interpreter dispatch. Compute-heavy work runs on the remote Spark cluster, not in this process.
ZEPPELIN_IMAGE zeppelin apache/zeppelin:0.12.1 Container image for zeppelin.
ZEPPELIN_INIT_IMAGE zeppelin python:3.12.13-alpine Container image for zeppelin-init.

Atlas documentation.

⚠️ **GitHub.com Fallback** ⚠️