Configuration reference

The Helm chart owns the deployment configuration. This page comes from the chart schema, chart defaults, rendered workloads, application YAML, and Spring configuration metadata.

Set chart values in your Helm values file. The Required column reports the schema at each object. Conditional requirements also apply. See Kubernetes deployment for those requirements, Secret keys, profiles, and operator procedures. The chart values describe each group. Helm validates the complete schema, including conditions on parent objects.

The Constraints column gives units, parsers and schema bounds. Use the format of that parser: Kubernetes quantities, Spring conversion, Spring sizes, PostgreSQL settings, pgBackRest retention, or VictoriaMetrics retention.

When the chart renders them, it converts server.resources.limits.memory to MiB for memory limits. These values, Git-cache sizeLimit values and sandbox.reviewMemory require whole Mi or Gi. Automatic turn admission converts CPU requests to millicores. Use cores or millicores for those requests. Other Kubernetes resource quantities are passed through as written.

Helm values

config

Key	Type	Default	Required in object	Constraints
config.browserFaultReports	boolean	false	yes	—
config.commitIdentityResolutionEnabled	boolean	true	yes	—
config.feedbackRetention	string	"P400D"	yes	Retention of at least 15 whole days, parsed by Spring Boot Duration from ISO-8601 P followed by an integer and D, such as P400D. pattern: "^P(1[5-9]|[2-9][0-9]|[1-9][0-9]{2,})D$"
config.llmDisplayCurrency	string	""	yes	enum: ["","EUR"]
config.llmPrivateHosts	array	[]	yes	maxItems: 32
config.llmPrivateHostsAllowHttp	boolean	false	yes	—
config.llmUsageRetention	string	"P400D"	yes	Retention in whole days, parsed by Spring Boot Duration from ISO-8601 P followed by an integer and D, such as P400D. pattern: "^P[0-9]+D$"
config.pageExperienceMetrics	boolean	false	yes	—
config.releaseCheckEnabled	boolean	true	yes	—
config.researchOrganization	string	""	yes	—
config.scmPrivateHosts	array	[]	yes	maxItems: 32
config.workspaceCreationPolicy	string	"ADMIN_ONLY"	yes	enum: ["ADMIN_ONLY","SELF_SERVICE"]

config.auth

Key	Type	Default	Required in object	Constraints
config.auth.assuranceEnforced	boolean	true	yes	—
config.auth.bootstrapAdmins	array	[]	yes	—
config.auth.browserExtensionIds	array	[]	yes	—
config.auth.passkeys.adminMaxAge	string	"6h"	yes	Time parsed by Spring Boot Duration. Use a nonnegative integer followed by ms, s, m, h or d; d is 24 hours. pattern: "^[0-9]+(?:ms|s|m|h|d)$"
config.auth.passkeys.allowedOrigins	array	[]	yes	—
config.auth.passkeys.instanceAdminRequired	boolean	true	yes	—
config.auth.passkeys.rpId	string	""	yes	—
config.auth.passkeys.workspaceAdminRequired	boolean	false	yes	—

config.credentialKey

Key	Type	Default	Required in object	Constraints
config.credentialKey.priorVersion	string	""	yes	pattern: "^(?:[1-9][0-9]*)?$"
config.credentialKey.rotationEnabled	boolean	false	yes	—
config.credentialKey.version	integer	1	yes	minimum: 1

config.email

Key	Type	Default	Required in object	Constraints
config.email.from	string	""	yes	—
config.email.fromName	string	"Hephaestus"	yes	—
config.email.host	string	""	yes	—
config.email.port	integer	587	yes	minimum: 1. maximum: 65535
config.email.replyTo	string	""	yes	—
config.email.tls	string	"starttls"	yes	enum: ["starttls","implicit"]
config.email.username	string	""	yes	—

config.github

Key	Type	Default	Required in object	Constraints
config.github.appClientId	string	""	yes	—
config.github.appId	integer	0	yes	minimum: 0
config.github.appInstallationUrl	string	""	yes	—
config.github.oauthClientId	string	""	yes	—

config.gitlab

Key	Type	Default	Required in object	Constraints
config.gitlab.enabled	boolean	false	yes	—
config.gitlab.oauthBaseUrl	string	"https://gitlab.com"	yes	pattern: "^https://"
config.gitlab.oauthClientId	string	""	yes	—
config.gitlab.oauthDisplayName	string	"GitLab"	yes	—

config.outline

Key	Type	Default	Required in object	Constraints
config.outline.allowedOrigins	array	[]	yes	—
config.outline.enabled	boolean	false	yes	—
config.outline.oauthBaseUrl	string	""	yes	—
config.outline.oauthClientId	string	""	yes	—
config.outline.oauthDisplayName	string	"Outline"	yes	—

config.privateCa

Key	Type	Default	Required in object	Constraints
config.privateCa.existingSecret	string	""	yes	—
config.privateCa.key	string	"ca.crt"	yes	—

config.publicActivity

Key	Type	Default	Required in object	Constraints
config.publicActivity.enabled	boolean	false	yes	—
config.publicActivity.repositoryVisibilityMaxAge	string	"48h"	yes	Time parsed by Spring Boot Duration. Use a nonnegative integer followed by ms, s, m, h or d; d is 24 hours. pattern: "^[0-9]+(?:ms|s|m|h|d)$"

config.slack

Key	Type	Default	Required in object	Constraints
config.slack.clientId	string	""	yes	—
config.slack.enabled	boolean	false	yes	—

config.sync

Key	Type	Default	Required in object	Constraints
config.sync.cooldownMinutes	integer	60	yes	Whole minutes, bound to an application integer. This is the minimum interval between syncs. minimum: 1. maximum: 1440
config.sync.runOnStartup	boolean	true	yes	—
config.sync.syncCron	string	"0 0 * * * *"	yes	A Spring cron expression with six fields, seconds first. pattern: "^\\S+( \\S+){5}$"
config.sync.timeframeDays	integer	7	yes	Whole days, bound to an application integer. This is the initial sync and reconciliation timeframe. minimum: 1. maximum: 365

config.tracing

Key	Type	Default	Required in object	Constraints
config.tracing.otlpEnabled	boolean	false	yes	—
config.tracing.otlpEndpoint	string	"http://localhost:4318/v1/traces"	yes	—
config.tracing.samplingProbability	string	"0.0"	yes	pattern: "^(?:0(?:\\.[0-9]+)?|1(?:\\.0+)?)$"

images

Key	Type	Default	Required in object	Constraints
images.agent-pi	string	supplied by release or operator	yes	An index digest from the verified release lock. Tags are refused. pattern: "^(?:ghcr\\.io|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"
images.alertmanager	string	supplied by release or operator	yes	An index digest from the verified release lock. Tags are refused. pattern: "^(?:ghcr\\.io|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"
images.application-server	string	supplied by release or operator	yes	An index digest from the verified release lock. Tags are refused. pattern: "^(?:ghcr\\.io|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"
images.postgres	string	supplied by release or operator	yes	An index digest from the verified release lock. Tags are refused. pattern: "^(?:ghcr\\.io|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"
images.postgres-exporter	string	supplied by release or operator	yes	An index digest from the verified release lock. Tags are refused. pattern: "^(?:ghcr\\.io|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"
images.victoria-metrics	string	supplied by release or operator	yes	An index digest from the verified release lock. Tags are refused. pattern: "^(?:ghcr\\.io|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"
images.vmalert	string	supplied by release or operator	yes	An index digest from the verified release lock. Tags are refused. pattern: "^(?:ghcr\\.io|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"
images.webapp	string	supplied by release or operator	yes	An index digest from the verified release lock. Tags are refused. pattern: "^(?:ghcr\\.io|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"

migration

Key	Type	Default	Required in object	Constraints
migration.databasePool.maximumPoolSize	integer	2	yes	minimum: 1. maximum: 400
migration.databasePool.minimumIdle	integer	1	yes	minimum: 0. maximum: 400
migration.enabled	boolean	true	yes	—
migration.resources.limits.cpu	string	"2"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
migration.resources.limits.ephemeral-storage	string	"256Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
migration.resources.limits.memory	string	"1536Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
migration.resources.requests.cpu	string	"250m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
migration.resources.requests.ephemeral-storage	string	"64Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
migration.resources.requests.memory	string	"1536Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"

networkPolicy

Key	Type	Default	Required in object	Constraints
networkPolicy.dns.namespace	string	"kube-system"	yes	pattern: "^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$"
networkPolicy.dns.podLabels	object	{"k8s-app":"kube-dns"}	yes	additionalProperties: {"type":"string","maxLength":63}
networkPolicy.externalEgress.cidr	string	"0.0.0.0/0"	yes	pattern: "^(?:|[0-9]{1,3}(?:\\.[0-9]{1,3}){3}/[0-9]{1,2}|[0-9a-fA-F:]+/[0-9]{1,3})$"
networkPolicy.externalEgress.except	array	["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","169.254.0.0/16","100.64.0.0/10"]	yes	maxItems: 16
networkPolicy.gateway.namespace	string	""	yes	pattern: "^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$"
networkPolicy.gateway.podLabels	object	{}	yes	additionalProperties: {"type":"string","maxLength":63}
networkPolicy.kubernetesApi.cidr	string	""	yes	pattern: "^(?:|[0-9]{1,3}(?:\\.[0-9]{1,3}){3}/[0-9]{1,2}|[0-9a-fA-F:]+/[0-9]{1,3})$"
networkPolicy.kubernetesApi.port	integer	0	yes	minimum: 0. maximum: 65535
networkPolicy.metrics.namespace	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
networkPolicy.metrics.podLabels	object	{}	yes	additionalProperties: {"type":"string","maxLength":63}
networkPolicy.modelEndpoints	array	[]		maxItems: 16
networkPolicy.modelGatewayPorts	array	[]		maxItems: 4
networkPolicy.scmEndpoints	array	[]		maxItems: 16
networkPolicy.traceCollector.namespace	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
networkPolicy.traceCollector.podLabels	object	{}	yes	additionalProperties: {"type":"string","maxLength":63}

observability

Key	Type	Default	Required in object	Constraints
observability.alertRules.configMap	boolean	false		Render a ConfigMap with the rule file as it is.
observability.alertRules.labels	object	{}		Labels for the ConfigMap and the PrometheusRule, for the rule selector of your Prometheus. additionalProperties: {"type":"string","maxLength":63}
observability.alertRules.prometheusRule	boolean	false		Render a PrometheusRule with the groups of the rule file. The CRD of the Prometheus Operator must exist.
observability.dashboards.namespace	string	""		An existing namespace for the release dashboards of an external VictoriaMetrics. Empty renders them only with the bundled stack, in the release namespace. pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
observability.stack.alertmanager.configSecret	string	""		The Secret with the key alertmanager.yml. Required when the stack is enabled. pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
observability.stack.enabled	boolean	false		—
observability.stack.persistence.size	string	"5Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
observability.stack.persistence.storageClassName	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
observability.stack.retention	string	"30d"		Sample retention, parsed by VictoriaMetrics retentionPeriod. Use a positive integer followed by d for days or w for weeks. pattern: "^[1-9][0-9]*[dw]$"

postgresql

Key	Type	Default	Required in object	Constraints
postgresql.backup.clientTlsSecret	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
postgresql.backup.enabled	boolean	false	yes	—
postgresql.backup.resources.limits.cpu	string	"1"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.backup.resources.limits.ephemeral-storage	string	"1Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.backup.resources.limits.memory	string	"512Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.backup.resources.requests.cpu	string	"100m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.backup.resources.requests.ephemeral-storage	string	"64Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.backup.resources.requests.memory	string	"512Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.backup.restore.enabled	boolean	false	yes	—
postgresql.backup.restore.time	string	""	yes	pattern: "^(?:[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?[+-][0-9]{2}(?::?[0-9]{2})?)?$"
postgresql.backup.retentionFull	integer	2	yes	Number of full backups, parsed as an integer by pgBackRest repo1-retention-full. minimum: 1. maximum: 52
postgresql.backup.s3.bucket	string	""	yes	pattern: "^(?:[a-z0-9][a-z0-9.-]{1,61}[a-z0-9])?$"
postgresql.backup.s3.cidr	string	""	yes	pattern: "^(?:|[0-9]{1,3}(?:\\.[0-9]{1,3}){3}/[0-9]{1,2}|[0-9a-fA-F:]+/[0-9]{1,3})$"
postgresql.backup.s3.endpoint	string	""	yes	pattern: "^[A-Za-z0-9.-]{0,253}(?::[0-9]{1,5})?$"
postgresql.backup.s3.port	integer	443	yes	minimum: 1. maximum: 65535
postgresql.backup.s3.privateCa	boolean	false	yes	—
postgresql.backup.s3.region	string	""	yes	pattern: "^[A-Za-z0-9-]{0,64}$"
postgresql.backup.s3.uriStyle	string	"path"	yes	enum: ["path","host"]
postgresql.backup.schedule.differential	string	"15 2 * * 1-6"	yes	—
postgresql.backup.schedule.full	string	"15 2 * * 0"	yes	—
postgresql.bundled	boolean	true	yes	—
postgresql.database	string	"hephaestus"	yes	pattern: "^[a-z_][a-z0-9_]{0,62}$"
postgresql.external.cidr	string	""	yes	pattern: "^(?:|[0-9]{1,3}(?:\\.[0-9]{1,3}){3}/[0-9]{1,2}|[0-9a-fA-F:]+/[0-9]{1,3})$"
postgresql.external.host	string	""	yes	pattern: "^[A-Za-z0-9.-]{0,253}$"
postgresql.external.port	integer	5432	yes	minimum: 1. maximum: 65535
postgresql.metrics.enabled	boolean	false	yes	—
postgresql.metrics.resources.limits.cpu	string	"200m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.metrics.resources.limits.ephemeral-storage	string	"64Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.metrics.resources.limits.memory	string	"96Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.metrics.resources.requests.cpu	string	"10m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.metrics.resources.requests.ephemeral-storage	string	"16Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.metrics.resources.requests.memory	string	"32Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.metrics.statementLimit	integer	20	yes	The statements with the most total execution time that the exporter reports, by query id only. minimum: 1. maximum: 100
postgresql.parameters.autovacuum_max_workers	integer	supplied by release or operator		minimum: 1. maximum: 16
postgresql.parameters.autovacuum_work_mem	string	supplied by release or operator		Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024. pattern: "^[1-9][0-9]*(?:kB|MB|GB)$"
postgresql.parameters.effective_cache_size	string	supplied by release or operator		Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024. pattern: "^[1-9][0-9]*(?:kB|MB|GB)$"
postgresql.parameters.hash_mem_multiplier	number	supplied by release or operator		minimum: 1. maximum: 10
postgresql.parameters.maintenance_work_mem	string	supplied by release or operator		Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024. pattern: "^[1-9][0-9]*(?:kB|MB|GB)$"
postgresql.parameters.max_connections	integer	supplied by release or operator		minimum: 4
postgresql.parameters.max_parallel_workers_per_gather	integer	supplied by release or operator		minimum: 0. maximum: 16
postgresql.parameters.max_wal_size	string	supplied by release or operator		Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024. pattern: "^[1-9][0-9]*(?:kB|MB|GB)$"
postgresql.parameters.shared_buffers	string	supplied by release or operator		Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024. pattern: "^[1-9][0-9]*(?:kB|MB|GB)$"
postgresql.parameters.work_mem	string	supplied by release or operator		Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024. pattern: "^[1-9][0-9]*(?:kB|MB|GB)$"
postgresql.persistence.size	string	"20Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.persistence.storageClassName	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
postgresql.resources.limits.cpu	string	"2"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.resources.limits.ephemeral-storage	string	"1Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.resources.limits.memory	string	"2Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.resources.requests.cpu	string	"250m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.resources.requests.ephemeral-storage	string	"256Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.resources.requests.memory	string	"2Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
postgresql.tls.existingSecret	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9.]{0,251}[a-z0-9])?)?$"

priorityClasses

Key	Type	Default	Required in object	Constraints
priorityClasses.conversations	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
priorityClasses.create	boolean	true	yes	—
priorityClasses.reviews	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
priorityClasses.roles	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"

release

Key	Type	Default	Required in object	Constraints
release.commit	string	""	yes	pattern: "^[a-f0-9]{40}$"
release.version	string	""	yes	pattern: "^(?:v(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?|[a-f0-9]{40})$"

route

Key	Type	Default	Required in object	Constraints
route.parentRefs	array	[]	yes	minItems: 1. maxItems: 4

sandbox

Key	Type	Default	Required in object	Constraints
sandbox.budget.cpu	string	supplied by release or operator		Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.budget.memory	string	supplied by release or operator		Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.controller.enabled	boolean	false	yes	—
sandbox.controller.image	string	"registry.k8s.io/agent-sandbox/agent-sandbox-controller:v1.0.10@sha256:594f4853913bca2b336d0267fe0978445f1aaa5837ed23797e48e745c8d6b610"	yes	The controller image of k3s-agent-sandbox.yaml, by digest. A chart test keeps the two equal. pattern: "^registry\\.k8s\\.io/agent-sandbox/agent-sandbox-controller:[^@]+@sha256:[a-f0-9]{64}$"
sandbox.controller.resources.limits.cpu	string	"1"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.controller.resources.limits.ephemeral-storage	string	"128Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.controller.resources.limits.memory	string	"256Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.controller.resources.requests.cpu	string	"10m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.controller.resources.requests.ephemeral-storage	string	"64Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.controller.resources.requests.memory	string	"64Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.conversationTurns	string or integer	8	yes	Concurrent conversation turns: auto derives the largest count within sandbox.budget; an explicit count is checked when a budget is set. oneOf: [{"const":"auto"},{"type":"integer","minimum":0,"maximum":2147483647}]
sandbox.enabled	boolean	false	yes	—
sandbox.gateway.maxConnections	integer	4096	yes	Connections that the sandbox gateway holds open at most. minimum: 1
sandbox.namespace	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"
sandbox.quota.enabled	boolean	true	yes	—
sandbox.reviewMemory	string	"3840Mi"	yes	Memory for review Pods, in whole Mi or Gi, parsed by chart memory conversion and Kubernetes Quantity. Concurrent reviews are this over one review Pod request and its RuntimeClass overhead. pattern: "^[1-9][0-9]*(?:Mi|Gi)$"
sandbox.runtime.nodeSelector	object	{}	yes	additionalProperties: {"type":"string","maxLength":63}
sandbox.runtime.tolerations	array	[]	yes	—
sandbox.templates.conversation.resources.limits.cpu	string	"2"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.conversation.resources.limits.ephemeral-storage	string	"2Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.conversation.resources.limits.memory	string	"1Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.conversation.resources.requests.cpu	string	"100m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.conversation.resources.requests.ephemeral-storage	string	"256Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.conversation.resources.requests.memory	string	"384Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.podOverhead.cpuMillis	integer	0	yes	Whole millicores, read as an integer by chart arithmetic. 1000 millicores is one CPU. minimum: 0
sandbox.templates.podOverhead.memoryMi	integer	0	yes	Whole mebibytes, read as an integer by chart arithmetic. One mebibyte is 1048576 bytes. minimum: 0
sandbox.templates.review.resources.limits.cpu	string	"2"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.review.resources.limits.ephemeral-storage	string	"4Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.review.resources.limits.memory	string	"2Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.review.resources.requests.cpu	string	"100m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.review.resources.requests.ephemeral-storage	string	"1Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.review.resources.requests.memory	string	"512Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
sandbox.templates.runtimeClassName	string	""	yes	—

secret

Key	Type	Default	Required in object	Constraints
secret.name	string	""	yes	pattern: "^[a-z0-9](?:[-a-z0-9.]{0,251}[a-z0-9])?$"

server

Key	Type	Default	Required in object	Constraints
server.databasePool.maximumPoolSize	integer or string	"auto"	yes	oneOf: [{"type":"integer","minimum":1,"maximum":400},{"const":"auto"}]
server.databasePool.minimumIdle	integer	5	yes	minimum: 0. maximum: 400
server.drainTimeoutSeconds	integer	1800	yes	Whole seconds. The chart emits a Spring Boot Duration for the server's drain and an integer Kubernetes termination grace period. minimum: 0. maximum: 86400
server.gitCache.sizeLimit	string	"70Gi"	yes	This role's Git cache volume, in whole Mi or Gi. Kubernetes reads this quantity as written. The chart converts it to bytes for the application's eviction threshold. Above 80 % of the limit, the role deletes the Git mirrors that it used least recently. pattern: "^[1-9][0-9]*(?:Mi|Gi)$"
server.inboxClaimers	integer	8	yes	minimum: 0
server.replicas	integer	2	yes	minimum: 0
server.resources.limits.cpu	string	"4"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
server.resources.limits.ephemeral-storage	string	"72Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
server.resources.limits.memory	string	"3Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
server.resources.requests.cpu	string	"500m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
server.resources.requests.ephemeral-storage	string	"512Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
server.resources.requests.memory	string	"3Gi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"

top-level

Key	Type	Default	Required in object	Constraints
deploymentEnvironment	string	"local"		pattern: "^[a-z0-9._-]{1,64}$"
global	object	supplied by release or operator		—
host	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?\\.)+[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$"
priorityClasses	object	{"create":true,"roles":"","conversations":"","reviews":""}		Create the three PriorityClasses, or name three that exist: the roles' above the conversations' above the reviews'.
trustedProxies	string	""	yes	—

webapp

Key	Type	Default	Required in object	Constraints
webapp.legalOverrides	string	""	yes	pattern: "^(?:[a-z0-9](?:[-a-z0-9.]{0,251}[a-z0-9])?)?$"
webapp.replicas	integer	1	yes	minimum: 1. maximum: 5
webapp.resources.limits.cpu	string	"500m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
webapp.resources.limits.ephemeral-storage	string	"256Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
webapp.resources.limits.memory	string	"256Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
webapp.resources.requests.cpu	string	"50m"	yes	Positive CPU as a Kubernetes Quantity. 1000m is one CPU. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
webapp.resources.requests.ephemeral-storage	string	"64Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
webapp.resources.requests.memory	string	"64Mi"	yes	Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi. pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?|0\\.[0-9]*[1-9][0-9]*)(?:m|k|M|G|T|P|E|Ki|Mi|Gi|Ti|Pi|Ei)?$"
webapp.securityContact	string	""	yes	pattern: "^(?:(?:mailto:|https://|tel:)\\S+)?$"

workspaceSubdomains

Key	Type	Default	Required in object	Constraints
workspaceSubdomains.enabled	boolean	false	yes	—

Application environment

The chart sets these variables on the listed workload containers. Use Helm values and Secret keys for configurable inputs. The chart fixes role flags, profiles, and runtime connections internally. A host .env file does not configure a Pod.

Defaults below come from the application YAML. They are not the deployed values. Configuration readiness reports incomplete instance configuration.

hephaestus.agent

Variable	Setting	Application default	Containers	Description
AGENT_ENABLED	hephaestus.agent.enabled	default: false	server	Turns on agent jobs, which run practice reviews, on this server.
HEPHAESTUS_AGENT_DRAIN_TIMEOUT	hephaestus.agent.drain-timeout		server	How long shutdown waits for leased review runs, with the gateway still available.
HEPHAESTUS_AGENT_IMAGE_REFERENCE	hephaestus.agent.image.reference		server	Image reference used by Pi practice sandboxes and the Hephaestus container. Production must be digest-pinned (registry/path@sha256:<64 lowercase hex>).
HEPHAESTUS_AGENT_IMAGE_REQUIRE_DIGEST	hephaestus.agent.image.require-digest		server	Refuses startup unless the agent image reference is pinned by digest.
HEPHAESTUS_AGENT_SANDBOX_GATEWAY_URL	hephaestus.agent.sandbox.gateway-url		server	The gateway address that a claim passes to its sandbox, such as http://10.43.0.12:8081. The server resolves the host to an address when it creates a claim, so the sandbox needs no DNS. Empty where this process creates no claim.
HEPHAESTUS_AGENT_SANDBOX_WARM_POOLS_CONVERSATION	hephaestus.agent.sandbox.warm-pools.conversation		server	The warm pool that a conversation's sandbox is claimed from.
HEPHAESTUS_AGENT_SANDBOX_WARM_POOLS_REVIEW	hephaestus.agent.sandbox.warm-pools.review		server	The warm pool that a review's sandbox is claimed from.
HEPHAESTUS_MENTOR_TURN_CAPACITY	hephaestus.agent.capacity.turns	default: (empty)	server	How many conversation turns run at once in the installation; zero stops new turns, and unset runs as many as are asked. The claim leases no turn beyond it, so a question waits for a free Heph instead.

hephaestus.auth

Variable	Setting	Application default	Containers	Description
GITHUB_OAUTH_CLIENT_ID	hephaestus.auth.login-providers.github.client-id	default: (empty)	server	Client ID of the GitHub OAuth App for sign-in. Set it with its client secret: a provider with only one of the two is not seeded. It seeds the github login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.
GITHUB_OAUTH_CLIENT_SECRET	hephaestus.auth.login-providers.github.client-secret	default: (empty)	server	Client secret of the GitHub OAuth App for sign-in. Set it with its client ID. It seeds the github login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.
GITLAB_OAUTH_BASE_URL	hephaestus.auth.login-providers.gitlab.base-url	default: https://gitlab.com	server	Origin of the GitLab instance for sign-in, such as https://gitlab.example.com. It seeds the gitlab login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.
GITLAB_OAUTH_CLIENT_ID	hephaestus.auth.login-providers.gitlab.client-id	default: (empty)	server	Client ID of the GitLab OAuth application for sign-in. Set it with its client secret: a provider with only one of the two is not seeded. It seeds the gitlab login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.
GITLAB_OAUTH_CLIENT_SECRET	hephaestus.auth.login-providers.gitlab.client-secret	default: (empty)	server	Client secret of the GitLab OAuth application for sign-in. Set it with its client ID. It seeds the gitlab login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.
GITLAB_OAUTH_DISPLAY_NAME	hephaestus.auth.login-providers.gitlab.display-name	default: GitLab	server	Label of the GitLab button on the sign-in or account-linking page. It seeds the gitlab login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.
HEPHAESTUS_AUTH_ASSURANCE_ENFORCED	hephaestus.auth.assurance-enforced	default: true	server	Requires passkey verification and a recent sign-in for protected admin actions. Turn it off only on an isolated test instance.
HEPHAESTUS_AUTH_BOOTSTRAP_ADMINS	hephaestus.auth.bootstrap-admins		server	Identities that become instance admins when they sign in, as provider:@username or provider:subject. Use the subject where a username can be claimed again. Email addresses are never matched.
HEPHAESTUS_AUTH_BOOTSTRAP_TOKEN	hephaestus.auth.bootstrap-token		server	Optional token, controlled by the deployment, that recovers an instance without an active admin. A blank value turns off the recovery endpoint.
HEPHAESTUS_AUTH_BROWSER_EXTENSION_IDS	hephaestus.auth.browser-extension-ids	default: (empty)	server	Chrome extension IDs that may sign in as installed clients. Each ID gets exactly one callback and one CORS origin.
HEPHAESTUS_AUTH_ISSUER	hephaestus.auth.issuer	default: http://localhost:${SERVER_PORT}; prod: http://localhost:${SERVER_PORT}	server	Canonical iss claim. Its origin is also the public origin of the API and of the webhook receivers that GitLab and Outline registrations name.
HEPHAESTUS_AUTH_PASSKEYS_ADMIN_MAX_AGE	hephaestus.auth.passkeys.admin-max-age	default: 6h	server	How long one passkey verification opens admin work that a passkey protects. After it, the admin verifies a passkey again; the session itself continues. Sensitive actions keep the shorter hephaestus.auth.step-up-max-age.
HEPHAESTUS_AUTH_PASSKEYS_ALLOWED_ORIGINS	hephaestus.auth.passkeys.allowed-origins	default: http://localhost:${WEBAPP_PORT}; prod: (empty)	server	Browser origins that may register and use passkeys, as a comma-separated list. Each must be an HTTPS origin on the RP ID or one of its subdomains. When it is empty, the origin of the auth issuer is used.
HEPHAESTUS_AUTH_PASSKEYS_INSTANCE_ADMIN_REQUIRED	hephaestus.auth.passkeys.instance-admin-required	default: false; prod: true	server	Requires a verified passkey sign-in from every instance admin. Workspace and account settings cannot turn this off.
HEPHAESTUS_AUTH_PASSKEYS_RP_ID	hephaestus.auth.passkeys.rp-id	default: (empty); prod: (empty)	server	WebAuthn relying party ID, the domain that passkeys are bound to. When it is empty, the host of the auth issuer is used. Passkeys registered under one RP ID do not work under another.
HEPHAESTUS_AUTH_PASSKEYS_WORKSPACE_ADMIN_REQUIRED	hephaestus.auth.passkeys.workspace-admin-required	default: false; prod: false	server	Requires a verified passkey sign-in for workspace administration in every workspace. A workspace cannot turn this off.
HEPHAESTUS_AUTH_STATE_COOKIE_KEY	hephaestus.auth.state-cookie-key	default: (empty); prod: (empty)	server	Base64-encoded 32-byte AES key that seals the OAuth state and sign-in intent cookies. Required outside development.
HEPHAESTUS_INTEGRATION_SLACK_CLIENT_ID	hephaestus.auth.login-providers.slack.client-id hephaestus.integration.slack.client-id	default: (empty)	server	Use the Slack app's client ID to link a Slack account. It falls back to the Slack workspace-install credentials. Set it with its client secret: a provider with only one of the two is not seeded. It seeds the slack login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. Use the Slack app's client ID to connect workspaces to Slack.
HEPHAESTUS_INTEGRATION_SLACK_CLIENT_SECRET	hephaestus.auth.login-providers.slack.client-secret hephaestus.integration.slack.client-secret	default: (empty)	server	Use the Slack app's client secret to link a Slack account. It falls back to the Slack workspace-install credentials. Set it with its client ID. It seeds the slack login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. Use the Slack app's client secret to connect workspaces to Slack.
OUTLINE_OAUTH_BASE_URL	hephaestus.auth.login-providers.outline.base-url	default: (empty)	server	Origin of the Outline instance for account linking, such as https://wiki.example.com. Required when the client ID is set. It seeds the outline login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.
OUTLINE_OAUTH_CLIENT_ID	hephaestus.auth.login-providers.outline.client-id	default: (empty)	server	Client ID of the Outline OAuth application for linking an Outline account. Set it with its client secret: a provider with only one of the two is not seeded. It seeds the outline login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.
OUTLINE_OAUTH_CLIENT_SECRET	hephaestus.auth.login-providers.outline.client-secret	default: (empty)	server	Client secret of the Outline OAuth application for linking an Outline account. Set it with its client ID. It seeds the outline login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.
OUTLINE_OAUTH_DISPLAY_NAME	hephaestus.auth.login-providers.outline.display-name	default: Outline	server	Label of the Outline button on the sign-in or account-linking page. It seeds the outline login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers.

hephaestus.commit-identity-resolution

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_COMMIT_IDENTITY_RESOLUTION_ENABLED	hephaestus.commit-identity-resolution.enabled	default: true	server	Whether the job runs.

hephaestus.consent

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_RESEARCH_ORGANIZATION	hephaestus.consent.research-organization	default: (empty)	server	Name of the organization that runs a research study on this instance. When it is set, first-login setup and account settings ask users for research consent. At most 255 characters.

hephaestus.contributors

Variable	Setting	Application default	Containers	Description
GH_AUTH_TOKEN	hephaestus.contributors.github.auth-token	default: (empty)	server	Use a personal access token or fine-grained token to read this application's contributor list from GitHub.

hephaestus.email

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_EMAIL_FROM	hephaestus.email.from	default: (empty)	server	The sender address in the envelope and the header. Required when spring.mail.host is set. The relay must be allowed to send for its domain through SPF and DKIM.
HEPHAESTUS_EMAIL_FROM_NAME	hephaestus.email.from-name	default: Hephaestus	server	The display name shown next to from.
HEPHAESTUS_EMAIL_REPLY_TO	hephaestus.email.reply-to	default: (empty)	server	The address that receives human replies. When it is blank, replies go to the sender address.

hephaestus.fabric

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_FABRIC_ROOT	hephaestus.fabric.root	default: /data/git-repos	server	Local directory for the bare Git mirrors and the evidence folders of running reviews. The process must be able to write to it. Its contents are not durable application state.

hephaestus.features

Variable	Setting	Application default	Containers	Description
BROWSER_FAULT_REPORTS	hephaestus.features.flags.browser-fault-reports	default: false	server	Lets the browser of each reader, signed in or not, report the failures that it met to the server's logs and metrics. In the EU, turning it on can require consent or a documented legal basis.
PAGE_EXPERIENCE_METRICS	hephaestus.features.flags.page-experience-metrics	default: false	server	Lets the browser of a signed-in reader measure how fast each visit loads and responds and report it to the page experience metrics. In the EU, turning it on can require consent or a documented legal basis.

hephaestus.feedback-retention

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_FEEDBACK_RETENTION	hephaestus.feedback-retention	default: P400D	server	The age at which conversation entries, feedback and practice results are erased. An entry counts from when it was written, feedback from its delivery or its creation when never delivered, and a result from when it was recorded, once no kept feedback cites it.

hephaestus.git

Variable	Setting	Application default	Containers	Description
GIT_CHECKOUT_ENABLED	hephaestus.git.enabled	default: false	server	Keeps local Git mirrors of monitored repositories, which practice reviews read code from. Turn it on wherever agent jobs run. Without it, the practice review health check reports out of service.
GIT_MAX_CACHE_BYTES	hephaestus.git.max-cache-bytes	default: 10737418240	server	The most disk that Git mirrors, review checkouts and staged archives may use on this process's volume. Set it to the size of that volume. Above 80 % of it, Hephaestus deletes the mirrors it used least recently. A deleted mirror costs one full fetch at its next capture.

hephaestus.host-url

Variable	Setting	Application default	Containers	Description
APPLICATION_HOST_URL	hephaestus.host-url hephaestus.cors.allowed-origins[0] hephaestus.webapp.url	default: http://localhost:4200; prod: (empty)	server	Set the public URL of this Hephaestus instance. Browsers at these origins can make cross-origin requests to this instance. Set the webapp's base URL for generated links.

hephaestus.integration

Variable	Setting	Application default	Containers	Description
GH_APP_CLIENT_ID	hephaestus.integration.github.app.client-id	default: (empty)	server	The App's client ID, which exchanges the code GitHub returns when an installation requests user authorization.
GH_APP_CLIENT_SECRET	hephaestus.integration.github.app.client-secret	default: (empty)	server	The client secret of the GitHub App. Set it together with the client ID.
GH_APP_ID	hephaestus.integration.github.app.id	default: 0; prod: 0	server	ID of the GitHub App. The value 0 turns GitHub App mode off. Must not be negative.
GH_APP_INSTALLATION_URL	hephaestus.integration.github.app.installation-url	default: (empty)	server	URL where users install the GitHub App, such as https://github.com/apps/my-app/installations/new.
GH_APP_PRIVATE_KEY	hephaestus.integration.github.app.private-key	default: (empty); prod: (empty)	server	PEM-encoded private key of the GitHub App, as an inline value.
GITLAB_DEFAULT_SERVER_URL	hephaestus.integration.gitlab.default-server-url	default: ${hephaestus.auth.login-providers.gitlab.base-url}	server, migration	The GitLab server URL for a workspace that names no server of its own.
GITLAB_ENABLED	hephaestus.integration.gitlab.enabled	default: false	server	Turns on the GitLab integration, which syncs GitLab groups and projects and delivers feedback on merge requests.
HEPHAESTUS_INTEGRATION_CONSUMER_CLAIMERS	hephaestus.integration.consumer.claimers		server	How many events one server handles at once, each of another scope. 0 claims none.
HEPHAESTUS_INTEGRATION_OUTLINE_ALLOWED_ORIGINS	hephaestus.integration.outline.allowed-origins	default: (empty)	server	Outline origins that workspace connections and Outline sign-in may use, as a comma-separated list such as https://wiki.example.com. Each must be an HTTPS origin without a path. Hephaestus refuses every Outline address that is not listed.
HEPHAESTUS_INTEGRATION_OUTLINE_ENABLED	hephaestus.integration.outline.enabled	default: false	server	Turns on the Outline integration, which lets workspaces connect Outline and syncs its documents. Each workspace admin still connects their workspace separately.
HEPHAESTUS_INTEGRATION_SLACK_ENABLED	hephaestus.integration.slack.enabled	default: false	server	Master toggle for the Slack integration (OAuth install, lifecycle listeners, outbound messaging).
HEPHAESTUS_INTEGRATION_SLACK_SIGNING_SECRET	hephaestus.integration.slack.signing-secret	default: (empty)	server	Signing secret of the Slack app, which verifies inbound Events API and interactivity requests. Required when the Slack integration is on, or the server does not start.

hephaestus.llm

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_LLM_DISPLAY_CURRENCY	hephaestus.llm.display-currency	default: (empty)	server	Code of the second currency in which spend in USD is also shown. Empty shows USD only.
HEPHAESTUS_LLM_EGRESS_PRIVATE_HOSTS	hephaestus.llm.egress.private-hosts	default: (empty)	server	Model endpoints on private networks that provider base URLs may use, as host names, IP addresses or CIDR ranges. A host name entry lets that name resolve to a private address. A range admits every host name that resolves into it. Only private addresses qualify: loopback, link-local and the known cloud metadata ranges stay blocked. A range wider than /16 (IPv4) or /48 (IPv6), outside the private ranges, or covering this server's own address stops startup. Empty allows public hosts only.
HEPHAESTUS_LLM_EGRESS_PRIVATE_HOSTS_ALLOW_HTTP	hephaestus.llm.egress.private-hosts-allow-http	default: false	server	Accepts http:// base URLs whose host is in private-hosts. Every other host still needs HTTPS.
HEPHAESTUS_LLM_USAGE_RETENTION	hephaestus.llm.usage.retention	default: P400D	server	Age from occurred_at at which a ledger row is deleted. Operator-tunable because the ledger is accounting data: a commercial or tax retention obligation can run years beyond the default, and the deletion is irreversible.

hephaestus.public-activity

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_PUBLIC_ACTIVITY_ENABLED	hephaestus.public-activity.enabled		server	Allows public activity pages on this instance until an instance admin changes the switch in the admin console. Each workspace must also opt in.
HEPHAESTUS_PUBLIC_ACTIVITY_REPOSITORY_VISIBILITY_MAX_AGE	hephaestus.public-activity.repository-visibility-max-age		server	How recently a sync must have confirmed that a repository is public for its work to appear on public activity pages. Must be positive. Accepts 48h, 2d, PT48H.

hephaestus.release

Variable	Setting	Application default	Containers	Description
DEPLOYMENT_ENVIRONMENT	hephaestus.release.environment	default: local	server, migration	The name of this deployment, such as production. The webapp, log lines and traces use the same name.
HEPHAESTUS_IMAGE_APPLICATION_SERVER	hephaestus.release.image	default: (empty)	server	The digest reference of the image that this container started from. It is empty outside a deployment from a release lock.
HEPHAESTUS_RELEASE_CHECK_ENABLED	hephaestus.release.check-enabled	default: true	server	Whether the server role may ask GitHub for the newest published release.
HEPHAESTUS_RELEASE_COMMIT	hephaestus.release.commit	default: (empty)	server, migration	The source commit that the release lock names. It is empty outside a deployment from a release lock.

hephaestus.sandbox

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_SANDBOX_KUBERNETES_NAMESPACE	hephaestus.sandbox.kubernetes.namespace	default: (empty)	server	The dedicated Kubernetes namespace for this release's sandbox claims, Pods and warm pools.
SANDBOX_API_MAX_CONNECTIONS	hephaestus.sandbox.gateway.max-connections	default: 4096	server	Most connections that the sandbox gateway holds open at once. Up to 100 further connections wait in the operating system's queue, and the rest fail. A review at its most calls in flight holds 170, and a normal review about 54 (estimated).
SANDBOX_API_PORT	hephaestus.sandbox.gateway.port	default: 8081	server	Port of the extra server connector that serves the sandbox gateway. The gateway API answers only on this port. The value 0 binds a free port at start.
SANDBOX_MAX_CONCURRENT	hephaestus.sandbox.max-concurrent-containers	default: 5	server	The most review sandboxes this server runs at once.

hephaestus.scm

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_SCM_EGRESS_PRIVATE_HOSTS	hephaestus.scm.egress.private-hosts	default: (empty)	server	Host names, IP addresses or CIDR ranges of a Git provider on a private network. Only private addresses qualify: loopback, link-local and the known cloud metadata ranges stay blocked. A range wider than /16 (IPv4) or /48 (IPv6), outside the private ranges, or covering this server's own address stops startup. Empty allows public hosts only.

hephaestus.security

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_SECURITY_CREDENTIAL_ENCRYPTION_KEY	hephaestus.security.credential-encryption-key		server	Active key that encrypts the stored credentials of integration connections. Exactly 32 bytes, so 32 ASCII characters. Required in production.
HEPHAESTUS_SECURITY_CREDENTIAL_ENCRYPTION_KEY_VERSION	hephaestus.security.credential-encryption-key-version		server	Positive version number stored with each credential that the active credential key encrypts. Must differ from prior-credential-encryption-key-version.
HEPHAESTUS_SECURITY_CREDENTIAL_ROTATION_ENABLED	hephaestus.security.credential-rotation-enabled		server	Re-encrypts stored credentials with the active credential key in batches on the server role. Requires both the active and the prior credential key.
HEPHAESTUS_SECURITY_ENCRYPTION_KEY	hephaestus.security.encryption-key		server	Key that encrypts sensitive values at rest, such as login provider secrets, LLM connection keys and JWT signing keys. Exactly 32 bytes, so 32 ASCII characters. Required in production.
HEPHAESTUS_SECURITY_PRIOR_CREDENTIAL_ENCRYPTION_KEY	hephaestus.security.prior-credential-encryption-key		server	Previous credential key, still used to decrypt credentials stored under its version during a key rotation. Exactly 32 bytes. Set it together with prior-credential-encryption-key-version.
HEPHAESTUS_SECURITY_PRIOR_CREDENTIAL_ENCRYPTION_KEY_VERSION	hephaestus.security.prior-credential-encryption-key-version		server	Version number of the previous credential key. Set it together with prior-credential-encryption-key.

hephaestus.sync

Variable	Setting	Application default	Containers	Description
SYNC_COOLDOWN_MINUTES	hephaestus.sync.cooldown-minutes	prod: 60	server	Minimum minutes between consecutive sync operations.
SYNC_CRON	hephaestus.sync.cron	prod: 0 0 * * * *	server	Cron expression for scheduled sync execution.
SYNC_RUN_ON_STARTUP	hephaestus.sync.run-on-startup	prod: true	server	Whether to trigger a sync run immediately when the application starts.
SYNC_TIMEFRAME_DAYS	hephaestus.sync.timeframe-days	prod: 7	server	Number of days to look back when synchronizing pull requests.

hephaestus.webhook

Variable	Setting	Application default	Containers	Description
WEBHOOK_ROUTING_PREVIOUS_SECRET	hephaestus.webhook.routing.previous-secret	default: (empty)	server	Previous routing key that the receiver still accepts during a rotation. Keep it until every hook signed with it is replaced. Requires routing.secret and must differ from it.
WEBHOOK_ROUTING_SECRET	hephaestus.webhook.routing.secret	default: (empty)	server	Key that signs the webhook token of each GitLab connection and derives the signing secret of each Outline subscription. At least 32 characters, and must differ from the webhook secret. GitLab and Outline webhook registration is skipped when it is unset.
WEBHOOK_SECRET	hephaestus.webhook.secret	default: (empty)	server	Shared secret that verifies GitHub webhook signatures. The server requires at least 32 printable ASCII characters without spaces, also on an instance without GitHub. Must differ from both routing secrets.

hephaestus.workspace

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_WORKSPACE_CREATIONPOLICY	hephaestus.workspace.creation-policy	default: ADMIN_ONLY	server	Who creates workspaces. Under ADMIN_ONLY, instance admins create them, and a GitHub App installation waits until an instance admin adopts it. Under SELF_SERVICE, every signed-in user can create one, and each GitHub App installation creates its own.
HEPHAESTUS_WORKSPACE_SUBDOMAINS_BASE_DOMAIN	hephaestus.workspace.subdomains.base-domain	default: (empty)	server	Domain under which each workspace gets its subdomain, such as hephaestus.build. Lowercase ASCII without a scheme, port or path, at most 189 characters. Required when subdomains are enabled.
HEPHAESTUS_WORKSPACE_SUBDOMAINS_ENABLED	hephaestus.workspace.subdomains.enabled	default: false	server	Gives each workspace its own subdomain address on the base domain. Authentication and the API stay on the apex domain. Prepare DNS, TLS and OAuth callbacks before you turn it on.

management.opentelemetry

Variable	Setting	Application default	Containers	Description
TRACING_OTLP_ENDPOINT	management.opentelemetry.tracing.export.otlp.endpoint	default: http://localhost:4318/v1/traces	server	URL to the OTel collector's HTTP API.

management.server

Variable	Setting	Application default	Containers	Description
MANAGEMENT_SERVER_ADDRESS	management.server.address		server	Network address to which the management endpoints should bind. Requires a custom management.server.port.

management.tracing

Variable	Setting	Application default	Containers	Description
TRACING_OTLP_ENABLED	management.tracing.export.otlp.enabled	default: false	server	Whether auto-configuration of tracing is enabled to export OTLP traces.
TRACING_SAMPLING_PROBABILITY	management.tracing.sampling.probability	default: 0.0	server	Probability in the range from 0.0 to 1.0 that a trace will be sampled.

server.tomcat

Variable	Setting	Application default	Containers	Description
HEPHAESTUS_TRUSTED_PROXIES	server.tomcat.remoteip.internal-proxies	prod: (empty)	server	Internal proxies that are to be trusted. Can be set as a comma separate list of CIDR or as a regular expression.

spring.application

Variable	Setting	Application default	Containers	Description
APP_VERSION	spring.application.version logging.structured.ecs.service.version	default: 0.0.0-development; default: ${spring.application.version}	server, migration	Version that the application reports in its logs, traces and release card. The deployment sets it from the release. Each log record names this version as its service version.

spring.datasource

Variable	Setting	Application default	Containers	Description
DATABASE_PASSWORD	spring.datasource.password	prod: (empty)	server, migration	Login password of the database.
DATABASE_URL	spring.datasource.url	prod: (empty)	server, migration	JDBC URL of the database.
DATABASE_USERNAME	spring.datasource.username	prod: (empty)	server, migration	Login username of the database.
SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE	spring.datasource.hikari.maximum-pool-size		server, migration	Most PostgreSQL connections that one process holds in its pool. A server can hold two connections per running review. Keep the sum over all processes below the PostgreSQL connection limit.
SPRING_DATASOURCE_HIKARI_MINIMUM_IDLE	spring.datasource.hikari.minimum-idle		server, migration	The minimum number of idle database connections that this process tries to keep in its pool.

spring.mail

Variable	Setting	Application default	Containers	Description
SPRING_MAIL_HOST	spring.mail.host	default: (empty)	server	SMTP server host. For instance, 'smtp.example.com'.
SPRING_MAIL_PASSWORD	spring.mail.password	default: (empty)	server	Login password of the SMTP server.
SPRING_MAIL_PORT	spring.mail.port	default: 587	server	SMTP server port.
SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH	spring.mail.properties[mail.smtp.auth]	default: true	server	Additional JavaMail Session properties.
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE	spring.mail.properties[mail.smtp.ssl.enable]	default: false	server	Additional JavaMail Session properties.
SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE	spring.mail.properties[mail.smtp.starttls.enable]	default: true	server	Additional JavaMail Session properties.
SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_REQUIRED	spring.mail.properties[mail.smtp.starttls.required]	default: true	server	Additional JavaMail Session properties.
SPRING_MAIL_USERNAME	spring.mail.username	default: (empty)	server	Login user of the SMTP server.

spring.profiles

Variable	Setting	Application default	Containers	Description
SPRING_PROFILES_ACTIVE	spring.profiles.active		server, migration	Comma-separated list of active profiles. Can be overridden by a command line switch.