# Configuration reference
The Helm chart owns the deployment configuration. This page comes from the chart schema, chart defaults, rendered workloads, application YAML, and Spring configuration metadata.
Set chart values in your Helm values file. The Required column reports the schema at each object. Conditional requirements also apply. See [Kubernetes deployment](/next/admin/kubernetes.md) for those requirements, Secret keys, profiles, and operator procedures. The chart [values](https://github.com/hephaestus-build/Hephaestus/blob/main/deploy/chart/hephaestus/values.yaml) describe each group. Helm validates the complete schema, including conditions on parent objects.
The Constraints column gives units, parsers and schema bounds. Use the format of that parser: [Kubernetes quantities](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-units-in-kubernetes), [Spring conversion](https://docs.spring.io/spring-boot/reference/features/external-config.html#features.external-config.typesafe-configuration-properties.conversion), [Spring sizes](https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/util/unit/DataSize.html), [PostgreSQL settings](https://www.postgresql.org/docs/current/config-setting.html#CONFIG-SETTING-NAMES-VALUES), [pgBackRest retention](https://pgbackrest.org/configuration.html#section-repository/option-repo-retention-full), or [VictoriaMetrics retention](https://docs.victoriametrics.com/victoriametrics/#retention).
When the chart renders them, it converts `server.resources.limits.memory` to MiB for memory limits. These values, Git-cache `sizeLimit` values and `sandbox.reviewMemory` require whole Mi or Gi. Automatic turn admission converts CPU requests to millicores. Use cores or millicores for those requests. Other Kubernetes resource quantities are passed through as written.
## Helm values
### `config`
| Key | Type | Default | Required in object | Constraints |
| ---------------------------------------- | ------- | -------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `config.browserFaultReports` | boolean | `false` | yes | — |
| `config.commitIdentityResolutionEnabled` | boolean | `true` | yes | — |
| `config.feedbackRetention` | string | `"P400D"` | yes | Retention of at least 15 whole days, parsed by Spring Boot Duration from ISO-8601 P followed by an integer and D, such as P400D.
`pattern: "^P(1[5-9]\|[2-9][0-9]\|[1-9][0-9]{2,})D$"` |
| `config.llmDisplayCurrency` | string | `""` | yes | `enum: ["","EUR"]` |
| `config.llmPrivateHosts` | array | `[]` | yes | `maxItems: 32` |
| `config.llmPrivateHostsAllowHttp` | boolean | `false` | yes | — |
| `config.llmUsageRetention` | string | `"P400D"` | yes | Retention in whole days, parsed by Spring Boot Duration from ISO-8601 P followed by an integer and D, such as P400D.
`pattern: "^P[0-9]+D$"` |
| `config.pageExperienceMetrics` | boolean | `false` | yes | — |
| `config.releaseCheckEnabled` | boolean | `true` | yes | — |
| `config.researchOrganization` | string | `""` | yes | — |
| `config.scmPrivateHosts` | array | `[]` | yes | `maxItems: 32` |
| `config.workspaceCreationPolicy` | string | `"ADMIN_ONLY"` | yes | `enum: ["ADMIN_ONLY","SELF_SERVICE"]` |
### `config.auth`
| Key | Type | Default | Required in object | Constraints |
| --------------------------------------------- | ------- | ------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `config.auth.assuranceEnforced` | boolean | `true` | yes | — |
| `config.auth.bootstrapAdmins` | array | `[]` | yes | — |
| `config.auth.browserExtensionIds` | array | `[]` | yes | — |
| `config.auth.passkeys.adminMaxAge` | string | `"6h"` | yes | Time parsed by Spring Boot Duration. Use a nonnegative integer followed by ms, s, m, h or d; d is 24 hours.
`pattern: "^[0-9]+(?:ms\|s\|m\|h\|d)$"` |
| `config.auth.passkeys.allowedOrigins` | array | `[]` | yes | — |
| `config.auth.passkeys.instanceAdminRequired` | boolean | `true` | yes | — |
| `config.auth.passkeys.rpId` | string | `""` | yes | — |
| `config.auth.passkeys.workspaceAdminRequired` | boolean | `false` | yes | — |
### `config.credentialKey`
| Key | Type | Default | Required in object | Constraints |
| -------------------------------------- | ------- | ------- | ------------------ | ------------------------------- |
| `config.credentialKey.priorVersion` | string | `""` | yes | `pattern: "^(?:[1-9][0-9]*)?$"` |
| `config.credentialKey.rotationEnabled` | boolean | `false` | yes | — |
| `config.credentialKey.version` | integer | `1` | yes | `minimum: 1` |
### `config.email`
| Key | Type | Default | Required in object | Constraints |
| ----------------------- | ------- | -------------- | ------------------ | ------------------------------- |
| `config.email.from` | string | `""` | yes | — |
| `config.email.fromName` | string | `"Hephaestus"` | yes | — |
| `config.email.host` | string | `""` | yes | — |
| `config.email.port` | integer | `587` | yes | `minimum: 1. maximum: 65535` |
| `config.email.replyTo` | string | `""` | yes | — |
| `config.email.tls` | string | `"starttls"` | yes | `enum: ["starttls","implicit"]` |
| `config.email.username` | string | `""` | yes | — |
### `config.github`
| Key | Type | Default | Required in object | Constraints |
| ---------------------------------- | ------- | ------- | ------------------ | ------------ |
| `config.github.appClientId` | string | `""` | yes | — |
| `config.github.appId` | integer | `0` | yes | `minimum: 0` |
| `config.github.appInstallationUrl` | string | `""` | yes | — |
| `config.github.oauthClientId` | string | `""` | yes | — |
### `config.gitlab`
| Key | Type | Default | Required in object | Constraints |
| -------------------------------- | ------- | ---------------------- | ------------------ | ---------------------- |
| `config.gitlab.enabled` | boolean | `false` | yes | — |
| `config.gitlab.oauthBaseUrl` | string | `"https://gitlab.com"` | yes | `pattern: "^https://"` |
| `config.gitlab.oauthClientId` | string | `""` | yes | — |
| `config.gitlab.oauthDisplayName` | string | `"GitLab"` | yes | — |
### `config.outline`
| Key | Type | Default | Required in object | Constraints |
| --------------------------------- | ------- | ----------- | ------------------ | ----------- |
| `config.outline.allowedOrigins` | array | `[]` | yes | — |
| `config.outline.enabled` | boolean | `false` | yes | — |
| `config.outline.oauthBaseUrl` | string | `""` | yes | — |
| `config.outline.oauthClientId` | string | `""` | yes | — |
| `config.outline.oauthDisplayName` | string | `"Outline"` | yes | — |
### `config.privateCa`
| Key | Type | Default | Required in object | Constraints |
| --------------------------------- | ------ | ---------- | ------------------ | ----------- |
| `config.privateCa.existingSecret` | string | `""` | yes | — |
| `config.privateCa.key` | string | `"ca.crt"` | yes | — |
### `config.publicActivity`
| Key | Type | Default | Required in object | Constraints |
| -------------------------------------------------- | ------- | ------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `config.publicActivity.enabled` | boolean | `false` | yes | — |
| `config.publicActivity.repositoryVisibilityMaxAge` | string | `"48h"` | yes | Time parsed by Spring Boot Duration. Use a nonnegative integer followed by ms, s, m, h or d; d is 24 hours.
`pattern: "^[0-9]+(?:ms\|s\|m\|h\|d)$"` |
### `config.slack`
| Key | Type | Default | Required in object | Constraints |
| ----------------------- | ------- | ------- | ------------------ | ----------- |
| `config.slack.clientId` | string | `""` | yes | — |
| `config.slack.enabled` | boolean | `false` | yes | — |
### `config.sync`
| Key | Type | Default | Required in object | Constraints |
| ----------------------------- | ------- | --------------- | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
| `config.sync.cooldownMinutes` | integer | `60` | yes | Whole minutes, bound to an application integer. This is the minimum interval between syncs.
`minimum: 1. maximum: 1440` |
| `config.sync.runOnStartup` | boolean | `true` | yes | — |
| `config.sync.syncCron` | string | `"0 0 * * * *"` | yes | A Spring cron expression with six fields, seconds first.
`pattern: "^\\S+( \\S+){5}$"` |
| `config.sync.timeframeDays` | integer | `7` | yes | Whole days, bound to an application integer. This is the initial sync and reconciliation timeframe.
`minimum: 1. maximum: 365` |
### `config.tracing`
| Key | Type | Default | Required in object | Constraints |
| ------------------------------------ | ------- | ----------------------------------- | ------------------ | ----------------------------------------------- |
| `config.tracing.otlpEnabled` | boolean | `false` | yes | — |
| `config.tracing.otlpEndpoint` | string | `"http://localhost:4318/v1/traces"` | yes | — |
| `config.tracing.samplingProbability` | string | `"0.0"` | yes | `pattern: "^(?:0(?:\\.[0-9]+)?\|1(?:\\.0+)?)$"` |
### `images`
| Key | Type | Default | Required in object | Constraints |
| --------------------------- | ------ | --------------------------------- | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `images.agent-pi` | string | `supplied by release or operator` | yes | An index digest from the verified release lock. Tags are refused.
`pattern: "^(?:ghcr\\.io\|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"` |
| `images.alertmanager` | string | `supplied by release or operator` | yes | An index digest from the verified release lock. Tags are refused.
`pattern: "^(?:ghcr\\.io\|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"` |
| `images.application-server` | string | `supplied by release or operator` | yes | An index digest from the verified release lock. Tags are refused.
`pattern: "^(?:ghcr\\.io\|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"` |
| `images.postgres` | string | `supplied by release or operator` | yes | An index digest from the verified release lock. Tags are refused.
`pattern: "^(?:ghcr\\.io\|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"` |
| `images.postgres-exporter` | string | `supplied by release or operator` | yes | An index digest from the verified release lock. Tags are refused.
`pattern: "^(?:ghcr\\.io\|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"` |
| `images.victoria-metrics` | string | `supplied by release or operator` | yes | An index digest from the verified release lock. Tags are refused.
`pattern: "^(?:ghcr\\.io\|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"` |
| `images.vmalert` | string | `supplied by release or operator` | yes | An index digest from the verified release lock. Tags are refused.
`pattern: "^(?:ghcr\\.io\|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"` |
| `images.webapp` | string | `supplied by release or operator` | yes | An index digest from the verified release lock. Tags are refused.
`pattern: "^(?:ghcr\\.io\|docker\\.io)/[a-z0-9][a-z0-9._/-]*@sha256:[a-f0-9]{64}$"` |
### `migration`
| Key | Type | Default | Required in object | Constraints |
| ------------------------------------------------ | ------- | ---------- | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `migration.databasePool.maximumPoolSize` | integer | `2` | yes | `minimum: 1. maximum: 400` |
| `migration.databasePool.minimumIdle` | integer | `1` | yes | `minimum: 0. maximum: 400` |
| `migration.enabled` | boolean | `true` | yes | — |
| `migration.resources.limits.cpu` | string | `"2"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `migration.resources.limits.ephemeral-storage` | string | `"256Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `migration.resources.limits.memory` | string | `"1536Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `migration.resources.requests.cpu` | string | `"250m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `migration.resources.requests.ephemeral-storage` | string | `"64Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `migration.resources.requests.memory` | string | `"1536Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
### `networkPolicy`
| Key | Type | Default | Required in object | Constraints |
| ---------------------------------------- | ------- | ---------------------------------------------------------------------------------- | ------------------ | ---------------------------------------------------------------------------------------- |
| `networkPolicy.dns.namespace` | string | `"kube-system"` | yes | `pattern: "^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$"` |
| `networkPolicy.dns.podLabels` | object | `{"k8s-app":"kube-dns"}` | yes | `additionalProperties: {"type":"string","maxLength":63}` |
| `networkPolicy.externalEgress.cidr` | string | `"0.0.0.0/0"` | yes | `pattern: "^(?:\|[0-9]{1,3}(?:\\.[0-9]{1,3}){3}/[0-9]{1,2}\|[0-9a-fA-F:]+/[0-9]{1,3})$"` |
| `networkPolicy.externalEgress.except` | array | `["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","169.254.0.0/16","100.64.0.0/10"]` | yes | `maxItems: 16` |
| `networkPolicy.gateway.namespace` | string | `""` | yes | `pattern: "^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$"` |
| `networkPolicy.gateway.podLabels` | object | `{}` | yes | `additionalProperties: {"type":"string","maxLength":63}` |
| `networkPolicy.kubernetesApi.cidr` | string | `""` | yes | `pattern: "^(?:\|[0-9]{1,3}(?:\\.[0-9]{1,3}){3}/[0-9]{1,2}\|[0-9a-fA-F:]+/[0-9]{1,3})$"` |
| `networkPolicy.kubernetesApi.port` | integer | `0` | yes | `minimum: 0. maximum: 65535` |
| `networkPolicy.metrics.namespace` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `networkPolicy.metrics.podLabels` | object | `{}` | yes | `additionalProperties: {"type":"string","maxLength":63}` |
| `networkPolicy.modelEndpoints` | array | `[]` | | `maxItems: 16` |
| `networkPolicy.modelGatewayPorts` | array | `[]` | | `maxItems: 4` |
| `networkPolicy.scmEndpoints` | array | `[]` | | `maxItems: 16` |
| `networkPolicy.traceCollector.namespace` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `networkPolicy.traceCollector.podLabels` | object | `{}` | yes | `additionalProperties: {"type":"string","maxLength":63}` |
### `observability`
| Key | Type | Default | Required in object | Constraints |
| -------------------------------------------------- | ------- | ------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `observability.alertRules.configMap` | boolean | `false` | | Render a ConfigMap with the rule file as it is. |
| `observability.alertRules.labels` | object | `{}` | | Labels for the ConfigMap and the PrometheusRule, for the rule selector of your Prometheus.
`additionalProperties: {"type":"string","maxLength":63}` |
| `observability.alertRules.prometheusRule` | boolean | `false` | | Render a PrometheusRule with the groups of the rule file. The CRD of the Prometheus Operator must exist. |
| `observability.dashboards.namespace` | string | `""` | | An existing namespace for the release dashboards of an external VictoriaMetrics. Empty renders them only with the bundled stack, in the release namespace.
`pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `observability.stack.alertmanager.configSecret` | string | `""` | | The Secret with the key alertmanager.yml. Required when the stack is enabled.
`pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `observability.stack.enabled` | boolean | `false` | | — |
| `observability.stack.persistence.size` | string | `"5Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `observability.stack.persistence.storageClassName` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `observability.stack.retention` | string | `"30d"` | | Sample retention, parsed by VictoriaMetrics retentionPeriod. Use a positive integer followed by d for days or w for weeks.
`pattern: "^[1-9][0-9]*[dw]$"` |
### `postgresql`
| Key | Type | Default | Required in object | Constraints |
| --------------------------------------------------------- | ------- | --------------------------------- | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `postgresql.backup.clientTlsSecret` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `postgresql.backup.enabled` | boolean | `false` | yes | — |
| `postgresql.backup.resources.limits.cpu` | string | `"1"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.backup.resources.limits.ephemeral-storage` | string | `"1Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.backup.resources.limits.memory` | string | `"512Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.backup.resources.requests.cpu` | string | `"100m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.backup.resources.requests.ephemeral-storage` | string | `"64Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.backup.resources.requests.memory` | string | `"512Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.backup.restore.enabled` | boolean | `false` | yes | — |
| `postgresql.backup.restore.time` | string | `""` | yes | `pattern: "^(?:[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?[+-][0-9]{2}(?::?[0-9]{2})?)?$"` |
| `postgresql.backup.retentionFull` | integer | `2` | yes | Number of full backups, parsed as an integer by pgBackRest repo1-retention-full.
`minimum: 1. maximum: 52` |
| `postgresql.backup.s3.bucket` | string | `""` | yes | `pattern: "^(?:[a-z0-9][a-z0-9.-]{1,61}[a-z0-9])?$"` |
| `postgresql.backup.s3.cidr` | string | `""` | yes | `pattern: "^(?:\|[0-9]{1,3}(?:\\.[0-9]{1,3}){3}/[0-9]{1,2}\|[0-9a-fA-F:]+/[0-9]{1,3})$"` |
| `postgresql.backup.s3.endpoint` | string | `""` | yes | `pattern: "^[A-Za-z0-9.-]{0,253}(?::[0-9]{1,5})?$"` |
| `postgresql.backup.s3.port` | integer | `443` | yes | `minimum: 1. maximum: 65535` |
| `postgresql.backup.s3.privateCa` | boolean | `false` | yes | — |
| `postgresql.backup.s3.region` | string | `""` | yes | `pattern: "^[A-Za-z0-9-]{0,64}$"` |
| `postgresql.backup.s3.uriStyle` | string | `"path"` | yes | `enum: ["path","host"]` |
| `postgresql.backup.schedule.differential` | string | `"15 2 * * 1-6"` | yes | — |
| `postgresql.backup.schedule.full` | string | `"15 2 * * 0"` | yes | — |
| `postgresql.bundled` | boolean | `true` | yes | — |
| `postgresql.database` | string | `"hephaestus"` | yes | `pattern: "^[a-z_][a-z0-9_]{0,62}$"` |
| `postgresql.external.cidr` | string | `""` | yes | `pattern: "^(?:\|[0-9]{1,3}(?:\\.[0-9]{1,3}){3}/[0-9]{1,2}\|[0-9a-fA-F:]+/[0-9]{1,3})$"` |
| `postgresql.external.host` | string | `""` | yes | `pattern: "^[A-Za-z0-9.-]{0,253}$"` |
| `postgresql.external.port` | integer | `5432` | yes | `minimum: 1. maximum: 65535` |
| `postgresql.metrics.enabled` | boolean | `false` | yes | — |
| `postgresql.metrics.resources.limits.cpu` | string | `"200m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.metrics.resources.limits.ephemeral-storage` | string | `"64Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.metrics.resources.limits.memory` | string | `"96Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.metrics.resources.requests.cpu` | string | `"10m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.metrics.resources.requests.ephemeral-storage` | string | `"16Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.metrics.resources.requests.memory` | string | `"32Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.metrics.statementLimit` | integer | `20` | yes | The statements with the most total execution time that the exporter reports, by query id only.
`minimum: 1. maximum: 100` |
| `postgresql.parameters.autovacuum_max_workers` | integer | `supplied by release or operator` | | `minimum: 1. maximum: 16` |
| `postgresql.parameters.autovacuum_work_mem` | string | `supplied by release or operator` | | Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024.
`pattern: "^[1-9][0-9]*(?:kB\|MB\|GB)$"` |
| `postgresql.parameters.effective_cache_size` | string | `supplied by release or operator` | | Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024.
`pattern: "^[1-9][0-9]*(?:kB\|MB\|GB)$"` |
| `postgresql.parameters.hash_mem_multiplier` | number | `supplied by release or operator` | | `minimum: 1. maximum: 10` |
| `postgresql.parameters.maintenance_work_mem` | string | `supplied by release or operator` | | Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024.
`pattern: "^[1-9][0-9]*(?:kB\|MB\|GB)$"` |
| `postgresql.parameters.max_connections` | integer | `supplied by release or operator` | | `minimum: 4` |
| `postgresql.parameters.max_parallel_workers_per_gather` | integer | `supplied by release or operator` | | `minimum: 0. maximum: 16` |
| `postgresql.parameters.max_wal_size` | string | `supplied by release or operator` | | Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024.
`pattern: "^[1-9][0-9]*(?:kB\|MB\|GB)$"` |
| `postgresql.parameters.shared_buffers` | string | `supplied by release or operator` | | Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024.
`pattern: "^[1-9][0-9]*(?:kB\|MB\|GB)$"` |
| `postgresql.parameters.work_mem` | string | `supplied by release or operator` | | Bytes, parsed by PostgreSQL. Use whole kB, MB or GB; their multiplier is 1024.
`pattern: "^[1-9][0-9]*(?:kB\|MB\|GB)$"` |
| `postgresql.persistence.size` | string | `"20Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.persistence.storageClassName` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `postgresql.resources.limits.cpu` | string | `"2"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.resources.limits.ephemeral-storage` | string | `"1Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.resources.limits.memory` | string | `"2Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.resources.requests.cpu` | string | `"250m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.resources.requests.ephemeral-storage` | string | `"256Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.resources.requests.memory` | string | `"2Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `postgresql.tls.existingSecret` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9.]{0,251}[a-z0-9])?)?$"` |
### `priorityClasses`
| Key | Type | Default | Required in object | Constraints |
| ------------------------------- | ------- | ------- | ------------------ | -------------------------------------------------------- |
| `priorityClasses.conversations` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `priorityClasses.create` | boolean | `true` | yes | — |
| `priorityClasses.reviews` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `priorityClasses.roles` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
### `release`
| Key | Type | Default | Required in object | Constraints |
| ----------------- | ------ | ------- | ------------------ | ------------------------------------------------------------------------------------------------------------------ |
| `release.commit` | string | `""` | yes | `pattern: "^[a-f0-9]{40}$"` |
| `release.version` | string | `""` | yes | `pattern: "^(?:v(?:0\|[1-9][0-9]*)\\.(?:0\|[1-9][0-9]*)\\.(?:0\|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?\|[a-f0-9]{40})$"` |
### `route`
| Key | Type | Default | Required in object | Constraints |
| ------------------ | ----- | ------- | ------------------ | -------------------------- |
| `route.parentRefs` | array | `[]` | yes | `minItems: 1. maxItems: 4` |
### `sandbox`
| Key | Type | Default | Required in object | Constraints |
| --------------------------------------------------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `sandbox.budget.cpu` | string | `supplied by release or operator` | | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.budget.memory` | string | `supplied by release or operator` | | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.controller.enabled` | boolean | `false` | yes | — |
| `sandbox.controller.image` | string | `"registry.k8s.io/agent-sandbox/agent-sandbox-controller:v1.0.10@sha256:594f4853913bca2b336d0267fe0978445f1aaa5837ed23797e48e745c8d6b610"` | yes | The controller image of k3s-agent-sandbox.yaml, by digest. A chart test keeps the two equal.
`pattern: "^registry\\.k8s\\.io/agent-sandbox/agent-sandbox-controller:[^@]+@sha256:[a-f0-9]{64}$"` |
| `sandbox.controller.resources.limits.cpu` | string | `"1"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.controller.resources.limits.ephemeral-storage` | string | `"128Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.controller.resources.limits.memory` | string | `"256Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.controller.resources.requests.cpu` | string | `"10m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.controller.resources.requests.ephemeral-storage` | string | `"64Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.controller.resources.requests.memory` | string | `"64Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.conversationTurns` | string or integer | `8` | yes | Concurrent conversation turns: auto derives the largest count within sandbox.budget; an explicit count is checked when a budget is set.
`oneOf: [{"const":"auto"},{"type":"integer","minimum":0,"maximum":2147483647}]` |
| `sandbox.enabled` | boolean | `false` | yes | — |
| `sandbox.gateway.maxConnections` | integer | `4096` | yes | Connections that the sandbox gateway holds open at most.
`minimum: 1` |
| `sandbox.namespace` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?)?$"` |
| `sandbox.quota.enabled` | boolean | `true` | yes | — |
| `sandbox.reviewMemory` | string | `"3840Mi"` | yes | Memory for review Pods, in whole Mi or Gi, parsed by chart memory conversion and Kubernetes Quantity. Concurrent reviews are this over one review Pod request and its RuntimeClass overhead.
`pattern: "^[1-9][0-9]*(?:Mi\|Gi)$"` |
| `sandbox.runtime.nodeSelector` | object | `{}` | yes | `additionalProperties: {"type":"string","maxLength":63}` |
| `sandbox.runtime.tolerations` | array | `[]` | yes | — |
| `sandbox.templates.conversation.resources.limits.cpu` | string | `"2"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.conversation.resources.limits.ephemeral-storage` | string | `"2Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.conversation.resources.limits.memory` | string | `"1Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.conversation.resources.requests.cpu` | string | `"100m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.conversation.resources.requests.ephemeral-storage` | string | `"256Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.conversation.resources.requests.memory` | string | `"384Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.podOverhead.cpuMillis` | integer | `0` | yes | Whole millicores, read as an integer by chart arithmetic. 1000 millicores is one CPU.
`minimum: 0` |
| `sandbox.templates.podOverhead.memoryMi` | integer | `0` | yes | Whole mebibytes, read as an integer by chart arithmetic. One mebibyte is 1048576 bytes.
`minimum: 0` |
| `sandbox.templates.review.resources.limits.cpu` | string | `"2"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.review.resources.limits.ephemeral-storage` | string | `"4Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.review.resources.limits.memory` | string | `"2Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.review.resources.requests.cpu` | string | `"100m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.review.resources.requests.ephemeral-storage` | string | `"1Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.review.resources.requests.memory` | string | `"512Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `sandbox.templates.runtimeClassName` | string | `""` | yes | — |
### `secret`
| Key | Type | Default | Required in object | Constraints |
| ------------- | ------ | ------- | ------------------ | ----------------------------------------------------- |
| `secret.name` | string | `""` | yes | `pattern: "^[a-z0-9](?:[-a-z0-9.]{0,251}[a-z0-9])?$"` |
### `server`
| Key | Type | Default | Required in object | Constraints |
| --------------------------------------------- | ----------------- | --------- | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `server.databasePool.maximumPoolSize` | integer or string | `"auto"` | yes | `oneOf: [{"type":"integer","minimum":1,"maximum":400},{"const":"auto"}]` |
| `server.databasePool.minimumIdle` | integer | `5` | yes | `minimum: 0. maximum: 400` |
| `server.drainTimeoutSeconds` | integer | `1800` | yes | Whole seconds. The chart emits a Spring Boot Duration for the server's drain and an integer Kubernetes termination grace period.
`minimum: 0. maximum: 86400` |
| `server.gitCache.sizeLimit` | string | `"70Gi"` | yes | This role's Git cache volume, in whole Mi or Gi. Kubernetes reads this quantity as written. The chart converts it to bytes for the application's eviction threshold. Above 80 % of the limit, the role deletes the Git mirrors that it used least recently.
`pattern: "^[1-9][0-9]*(?:Mi\|Gi)$"` |
| `server.inboxClaimers` | integer | `8` | yes | `minimum: 0` |
| `server.replicas` | integer | `2` | yes | `minimum: 0` |
| `server.resources.limits.cpu` | string | `"4"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `server.resources.limits.ephemeral-storage` | string | `"72Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `server.resources.limits.memory` | string | `"3Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `server.resources.requests.cpu` | string | `"500m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `server.resources.requests.ephemeral-storage` | string | `"512Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `server.resources.requests.memory` | string | `"3Gi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
### `top-level`
| Key | Type | Default | Required in object | Constraints |
| ----------------------- | ------ | ------------------------------------------------------------ | ------------------ | ------------------------------------------------------------------------------------------------------------------- |
| `deploymentEnvironment` | string | `"local"` | | `pattern: "^[a-z0-9._-]{1,64}$"` |
| `global` | object | `supplied by release or operator` | | — |
| `host` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?\\.)+[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$"` |
| `priorityClasses` | object | `{"create":true,"roles":"","conversations":"","reviews":""}` | | Create the three PriorityClasses, or name three that exist: the roles' above the conversations' above the reviews'. |
| `trustedProxies` | string | `""` | yes | — |
### `webapp`
| Key | Type | Default | Required in object | Constraints |
| --------------------------------------------- | ------- | --------- | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `webapp.legalOverrides` | string | `""` | yes | `pattern: "^(?:[a-z0-9](?:[-a-z0-9.]{0,251}[a-z0-9])?)?$"` |
| `webapp.replicas` | integer | `1` | yes | `minimum: 1. maximum: 5` |
| `webapp.resources.limits.cpu` | string | `"500m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `webapp.resources.limits.ephemeral-storage` | string | `"256Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `webapp.resources.limits.memory` | string | `"256Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `webapp.resources.requests.cpu` | string | `"50m"` | yes | Positive CPU as a Kubernetes Quantity. 1000m is one CPU.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `webapp.resources.requests.ephemeral-storage` | string | `"64Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `webapp.resources.requests.memory` | string | `"64Mi"` | yes | Positive memory or storage as a Kubernetes Quantity, such as Mi or Gi.
`pattern: "^(?:[1-9][0-9]*(?:\\.[0-9]+)?\|0\\.[0-9]*[1-9][0-9]*)(?:m\|k\|M\|G\|T\|P\|E\|Ki\|Mi\|Gi\|Ti\|Pi\|Ei)?$"` |
| `webapp.securityContact` | string | `""` | yes | `pattern: "^(?:(?:mailto:\|https://\|tel:)\\S+)?$"` |
### `workspaceSubdomains`
| Key | Type | Default | Required in object | Constraints |
| ----------------------------- | ------- | ------- | ------------------ | ----------- |
| `workspaceSubdomains.enabled` | boolean | `false` | yes | — |
## Application environment
The chart sets these variables on the listed workload containers. Use Helm values and Secret keys for configurable inputs. The chart fixes role flags, profiles, and runtime connections internally. A host `.env` file does not configure a Pod.
Defaults below come from the application YAML. They are not the deployed values. [Configuration readiness](/next/admin/configuration-readiness.md) reports incomplete instance configuration.
### `hephaestus.agent`
| Variable | Setting | Application default | Containers | Description |
| -------------------------------------------------- | -------------------------------------------------- | ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `AGENT_ENABLED` | `hephaestus.agent.enabled` | `default: false` | `server` | Turns on agent jobs, which run practice reviews, on this server. |
| `HEPHAESTUS_AGENT_DRAIN_TIMEOUT` | `hephaestus.agent.drain-timeout` | | `server` | How long shutdown waits for leased review runs, with the gateway still available. |
| `HEPHAESTUS_AGENT_IMAGE_REFERENCE` | `hephaestus.agent.image.reference` | | `server` | Image reference used by Pi practice sandboxes and the Hephaestus container. Production must be digest-pinned (registry/path\@sha256:<64 lowercase hex>). |
| `HEPHAESTUS_AGENT_IMAGE_REQUIRE_DIGEST` | `hephaestus.agent.image.require-digest` | | `server` | Refuses startup unless the agent image reference is pinned by digest. |
| `HEPHAESTUS_AGENT_SANDBOX_GATEWAY_URL` | `hephaestus.agent.sandbox.gateway-url` | | `server` | The gateway address that a claim passes to its sandbox, such as `http://10.43.0.12:8081`. The server resolves the host to an address when it creates a claim, so the sandbox needs no DNS. Empty where this process creates no claim. |
| `HEPHAESTUS_AGENT_SANDBOX_WARM_POOLS_CONVERSATION` | `hephaestus.agent.sandbox.warm-pools.conversation` | | `server` | The warm pool that a conversation's sandbox is claimed from. |
| `HEPHAESTUS_AGENT_SANDBOX_WARM_POOLS_REVIEW` | `hephaestus.agent.sandbox.warm-pools.review` | | `server` | The warm pool that a review's sandbox is claimed from. |
| `HEPHAESTUS_MENTOR_TURN_CAPACITY` | `hephaestus.agent.capacity.turns` | `default: (empty)` | `server` | How many conversation turns run at once in the installation; zero stops new turns, and unset runs as many as are asked. The claim leases no turn beyond it, so a question waits for a free Heph instead. |
### `hephaestus.auth`
| Variable | Setting | Application default | Containers | Description |
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `GITHUB_OAUTH_CLIENT_ID` | `hephaestus.auth.login-providers.github.client-id` | `default: (empty)` | `server` | Client ID of the GitHub OAuth App for sign-in. Set it with its client secret: a provider with only one of the two is not seeded. It seeds the github login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
| `GITHUB_OAUTH_CLIENT_SECRET` | `hephaestus.auth.login-providers.github.client-secret` | `default: (empty)` | `server` | Client secret of the GitHub OAuth App for sign-in. Set it with its client ID. It seeds the github login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
| `GITLAB_OAUTH_BASE_URL` | `hephaestus.auth.login-providers.gitlab.base-url` | `default: https://gitlab.com` | `server` | Origin of the GitLab instance for sign-in, such as . It seeds the gitlab login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
| `GITLAB_OAUTH_CLIENT_ID` | `hephaestus.auth.login-providers.gitlab.client-id` | `default: (empty)` | `server` | Client ID of the GitLab OAuth application for sign-in. Set it with its client secret: a provider with only one of the two is not seeded. It seeds the gitlab login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
| `GITLAB_OAUTH_CLIENT_SECRET` | `hephaestus.auth.login-providers.gitlab.client-secret` | `default: (empty)` | `server` | Client secret of the GitLab OAuth application for sign-in. Set it with its client ID. It seeds the gitlab login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
| `GITLAB_OAUTH_DISPLAY_NAME` | `hephaestus.auth.login-providers.gitlab.display-name` | `default: GitLab` | `server` | Label of the GitLab button on the sign-in or account-linking page. It seeds the gitlab login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
| `HEPHAESTUS_AUTH_ASSURANCE_ENFORCED` | `hephaestus.auth.assurance-enforced` | `default: true` | `server` | Requires passkey verification and a recent sign-in for protected admin actions. Turn it off only on an isolated test instance. |
| `HEPHAESTUS_AUTH_BOOTSTRAP_ADMINS` | `hephaestus.auth.bootstrap-admins` | | `server` | Identities that become instance admins when they sign in, as `provider:@username` or `provider:subject`. Use the subject where a username can be claimed again. Email addresses are never matched. |
| `HEPHAESTUS_AUTH_BOOTSTRAP_TOKEN` | `hephaestus.auth.bootstrap-token` | | `server` | Optional token, controlled by the deployment, that recovers an instance without an active admin. A blank value turns off the recovery endpoint. |
| `HEPHAESTUS_AUTH_BROWSER_EXTENSION_IDS` | `hephaestus.auth.browser-extension-ids` | `default: (empty)` | `server` | Chrome extension IDs that may sign in as installed clients. Each ID gets exactly one callback and one CORS origin. |
| `HEPHAESTUS_AUTH_ISSUER` | `hephaestus.auth.issuer` | `default: http://localhost:${SERVER_PORT}; prod: http://localhost:${SERVER_PORT}` | `server` | Canonical `iss` claim. Its origin is also the public origin of the API and of the webhook receivers that GitLab and Outline registrations name. |
| `HEPHAESTUS_AUTH_PASSKEYS_ADMIN_MAX_AGE` | `hephaestus.auth.passkeys.admin-max-age` | `default: 6h` | `server` | How long one passkey verification opens admin work that a passkey protects. After it, the admin verifies a passkey again; the session itself continues. Sensitive actions keep the shorter `hephaestus.auth.step-up-max-age`. |
| `HEPHAESTUS_AUTH_PASSKEYS_ALLOWED_ORIGINS` | `hephaestus.auth.passkeys.allowed-origins` | `default: http://localhost:${WEBAPP_PORT}; prod: (empty)` | `server` | Browser origins that may register and use passkeys, as a comma-separated list. Each must be an HTTPS origin on the RP ID or one of its subdomains. When it is empty, the origin of the auth issuer is used. |
| `HEPHAESTUS_AUTH_PASSKEYS_INSTANCE_ADMIN_REQUIRED` | `hephaestus.auth.passkeys.instance-admin-required` | `default: false; prod: true` | `server` | Requires a verified passkey sign-in from every instance admin. Workspace and account settings cannot turn this off. |
| `HEPHAESTUS_AUTH_PASSKEYS_RP_ID` | `hephaestus.auth.passkeys.rp-id` | `default: (empty); prod: (empty)` | `server` | WebAuthn relying party ID, the domain that passkeys are bound to. When it is empty, the host of the auth issuer is used. Passkeys registered under one RP ID do not work under another. |
| `HEPHAESTUS_AUTH_PASSKEYS_WORKSPACE_ADMIN_REQUIRED` | `hephaestus.auth.passkeys.workspace-admin-required` | `default: false; prod: false` | `server` | Requires a verified passkey sign-in for workspace administration in every workspace. A workspace cannot turn this off. |
| `HEPHAESTUS_AUTH_STATE_COOKIE_KEY` | `hephaestus.auth.state-cookie-key` | `default: (empty); prod: (empty)` | `server` | Base64-encoded 32-byte AES key that seals the OAuth state and sign-in intent cookies. Required outside development. |
| `HEPHAESTUS_INTEGRATION_SLACK_CLIENT_ID` | `hephaestus.auth.login-providers.slack.client-id`
`hephaestus.integration.slack.client-id` | `default: (empty)` | `server` | Use the Slack app's client ID to link a Slack account. It falls back to the Slack workspace-install credentials. Set it with its client secret: a provider with only one of the two is not seeded. It seeds the slack login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. Use the Slack app's client ID to connect workspaces to Slack. |
| `HEPHAESTUS_INTEGRATION_SLACK_CLIENT_SECRET` | `hephaestus.auth.login-providers.slack.client-secret`
`hephaestus.integration.slack.client-secret` | `default: (empty)` | `server` | Use the Slack app's client secret to link a Slack account. It falls back to the Slack workspace-install credentials. Set it with its client ID. It seeds the slack login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. Use the Slack app's client secret to connect workspaces to Slack. |
| `OUTLINE_OAUTH_BASE_URL` | `hephaestus.auth.login-providers.outline.base-url` | `default: (empty)` | `server` | Origin of the Outline instance for account linking, such as . Required when the client ID is set. It seeds the outline login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
| `OUTLINE_OAUTH_CLIENT_ID` | `hephaestus.auth.login-providers.outline.client-id` | `default: (empty)` | `server` | Client ID of the Outline OAuth application for linking an Outline account. Set it with its client secret: a provider with only one of the two is not seeded. It seeds the outline login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
| `OUTLINE_OAUTH_CLIENT_SECRET` | `hephaestus.auth.login-providers.outline.client-secret` | `default: (empty)` | `server` | Client secret of the Outline OAuth application for linking an Outline account. Set it with its client ID. It seeds the outline login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
| `OUTLINE_OAUTH_DISPLAY_NAME` | `hephaestus.auth.login-providers.outline.display-name` | `default: Outline` | `server` | Label of the Outline button on the sign-in or account-linking page. It seeds the outline login provider at startup only when that provider does not exist yet. Later changes go through Instance administration, Login providers. |
### `hephaestus.commit-identity-resolution`
| Variable | Setting | Application default | Containers | Description |
| ----------------------------------------------- | ----------------------------------------------- | ------------------- | ---------- | --------------------- |
| `HEPHAESTUS_COMMIT_IDENTITY_RESOLUTION_ENABLED` | `hephaestus.commit-identity-resolution.enabled` | `default: true` | `server` | Whether the job runs. |
### `hephaestus.consent`
| Variable | Setting | Application default | Containers | Description |
| ---------------------------------- | ------------------------------------------ | ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `HEPHAESTUS_RESEARCH_ORGANIZATION` | `hephaestus.consent.research-organization` | `default: (empty)` | `server` | Name of the organization that runs a research study on this instance. When it is set, first-login setup and account settings ask users for research consent. At most 255 characters. |
### `hephaestus.contributors`
| Variable | Setting | Application default | Containers | Description |
| --------------- | ------------------------------------------- | ------------------- | ---------- | ---------------------------------------------------------------------------------------------------------- |
| `GH_AUTH_TOKEN` | `hephaestus.contributors.github.auth-token` | `default: (empty)` | `server` | Use a personal access token or fine-grained token to read this application's contributor list from GitHub. |
### `hephaestus.email`
| Variable | Setting | Application default | Containers | Description |
| ---------------------------- | ---------------------------- | --------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `HEPHAESTUS_EMAIL_FROM` | `hephaestus.email.from` | `default: (empty)` | `server` | The sender address in the envelope and the header. Required when `spring.mail.host` is set. The relay must be allowed to send for its domain through SPF and DKIM. |
| `HEPHAESTUS_EMAIL_FROM_NAME` | `hephaestus.email.from-name` | `default: Hephaestus` | `server` | The display name shown next to `from`. |
| `HEPHAESTUS_EMAIL_REPLY_TO` | `hephaestus.email.reply-to` | `default: (empty)` | `server` | The address that receives human replies. When it is blank, replies go to the sender address. |
### `hephaestus.fabric`
| Variable | Setting | Application default | Containers | Description |
| ------------------------ | ------------------------ | -------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `HEPHAESTUS_FABRIC_ROOT` | `hephaestus.fabric.root` | `default: /data/git-repos` | `server` | Local directory for the bare Git mirrors and the evidence folders of running reviews. The process must be able to write to it. Its contents are not durable application state. |
### `hephaestus.features`
| Variable | Setting | Application default | Containers | Description |
| ------------------------- | --------------------------------------------------- | ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `BROWSER_FAULT_REPORTS` | `hephaestus.features.flags.browser-fault-reports` | `default: false` | `server` | Lets the browser of each reader, signed in or not, report the failures that it met to the server's logs and metrics. In the EU, turning it on can require consent or a documented legal basis. |
| `PAGE_EXPERIENCE_METRICS` | `hephaestus.features.flags.page-experience-metrics` | `default: false` | `server` | Lets the browser of a signed-in reader measure how fast each visit loads and responds and report it to the page experience metrics. In the EU, turning it on can require consent or a documented legal basis. |
### `hephaestus.feedback-retention`
| Variable | Setting | Application default | Containers | Description |
| ------------------------------- | ------------------------------- | ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `HEPHAESTUS_FEEDBACK_RETENTION` | `hephaestus.feedback-retention` | `default: P400D` | `server` | The age at which conversation entries, feedback and practice results are erased. An entry counts from when it was written, feedback from its delivery or its creation when never delivered, and a result from when it was recorded, once no kept feedback cites it. |
### `hephaestus.git`
| Variable | Setting | Application default | Containers | Description |
| ---------------------- | -------------------------------- | ---------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `GIT_CHECKOUT_ENABLED` | `hephaestus.git.enabled` | `default: false` | `server` | Keeps local Git mirrors of monitored repositories, which practice reviews read code from. Turn it on wherever agent jobs run. Without it, the practice review health check reports out of service. |
| `GIT_MAX_CACHE_BYTES` | `hephaestus.git.max-cache-bytes` | `default: 10737418240` | `server` | The most disk that Git mirrors, review checkouts and staged archives may use on this process's volume. Set it to the size of that volume. Above 80 % of it, Hephaestus deletes the mirrors it used least recently. A deleted mirror costs one full fetch at its next capture. |
### `hephaestus.host-url`
| Variable | Setting | Application default | Containers | Description |
| ---------------------- | -------------------------------------------------------------------------------------------- | ----------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `APPLICATION_HOST_URL` | `hephaestus.host-url`
`hephaestus.cors.allowed-origins[0]`
`hephaestus.webapp.url` | `default: http://localhost:4200; prod: (empty)` | `server` | Set the public URL of this Hephaestus instance. Browsers at these origins can make cross-origin requests to this instance. Set the webapp's base URL for generated links. |
### `hephaestus.integration`
| Variable | Setting | Application default | Containers | Description |
| ------------------------------------------------ | ---------------------------------------------------- | ------------------------------------------------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `GH_APP_CLIENT_ID` | `hephaestus.integration.github.app.client-id` | `default: (empty)` | `server` | The App's client ID, which exchanges the code GitHub returns when an installation requests user authorization. |
| `GH_APP_CLIENT_SECRET` | `hephaestus.integration.github.app.client-secret` | `default: (empty)` | `server` | The client secret of the GitHub App. Set it together with the client ID. |
| `GH_APP_ID` | `hephaestus.integration.github.app.id` | `default: 0; prod: 0` | `server` | ID of the GitHub App. The value 0 turns GitHub App mode off. Must not be negative. |
| `GH_APP_INSTALLATION_URL` | `hephaestus.integration.github.app.installation-url` | `default: (empty)` | `server` | URL where users install the GitHub App, such as . |
| `GH_APP_PRIVATE_KEY` | `hephaestus.integration.github.app.private-key` | `default: (empty); prod: (empty)` | `server` | PEM-encoded private key of the GitHub App, as an inline value. |
| `GITLAB_DEFAULT_SERVER_URL` | `hephaestus.integration.gitlab.default-server-url` | `default: ${hephaestus.auth.login-providers.gitlab.base-url}` | `server`, `migration` | The GitLab server URL for a workspace that names no server of its own. |
| `GITLAB_ENABLED` | `hephaestus.integration.gitlab.enabled` | `default: false` | `server` | Turns on the GitLab integration, which syncs GitLab groups and projects and delivers feedback on merge requests. |
| `HEPHAESTUS_INTEGRATION_CONSUMER_CLAIMERS` | `hephaestus.integration.consumer.claimers` | | `server` | How many events one server handles at once, each of another scope. 0 claims none. |
| `HEPHAESTUS_INTEGRATION_OUTLINE_ALLOWED_ORIGINS` | `hephaestus.integration.outline.allowed-origins` | `default: (empty)` | `server` | Outline origins that workspace connections and Outline sign-in may use, as a comma-separated list such as . Each must be an HTTPS origin without a path. Hephaestus refuses every Outline address that is not listed. |
| `HEPHAESTUS_INTEGRATION_OUTLINE_ENABLED` | `hephaestus.integration.outline.enabled` | `default: false` | `server` | Turns on the Outline integration, which lets workspaces connect Outline and syncs its documents. Each workspace admin still connects their workspace separately. |
| `HEPHAESTUS_INTEGRATION_SLACK_ENABLED` | `hephaestus.integration.slack.enabled` | `default: false` | `server` | Master toggle for the Slack integration (OAuth install, lifecycle listeners, outbound messaging). |
| `HEPHAESTUS_INTEGRATION_SLACK_SIGNING_SECRET` | `hephaestus.integration.slack.signing-secret` | `default: (empty)` | `server` | Signing secret of the Slack app, which verifies inbound Events API and interactivity requests. Required when the Slack integration is on, or the server does not start. |
### `hephaestus.llm`
| Variable | Setting | Application default | Containers | Description |
| ------------------------------------------------ | ------------------------------------------------ | ------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `HEPHAESTUS_LLM_DISPLAY_CURRENCY` | `hephaestus.llm.display-currency` | `default: (empty)` | `server` | Code of the second currency in which spend in USD is also shown. Empty shows USD only. |
| `HEPHAESTUS_LLM_EGRESS_PRIVATE_HOSTS` | `hephaestus.llm.egress.private-hosts` | `default: (empty)` | `server` | Model endpoints on private networks that provider base URLs may use, as host names, IP addresses or CIDR ranges. A host name entry lets that name resolve to a private address. A range admits every host name that resolves into it. Only private addresses qualify: loopback, link-local and the known cloud metadata ranges stay blocked. A range wider than /16 (IPv4) or /48 (IPv6), outside the private ranges, or covering this server's own address stops startup. Empty allows public hosts only. |
| `HEPHAESTUS_LLM_EGRESS_PRIVATE_HOSTS_ALLOW_HTTP` | `hephaestus.llm.egress.private-hosts-allow-http` | `default: false` | `server` | Accepts `http://` base URLs whose host is in `private-hosts`. Every other host still needs HTTPS. |
| `HEPHAESTUS_LLM_USAGE_RETENTION` | `hephaestus.llm.usage.retention` | `default: P400D` | `server` | Age from `occurred_at` at which a ledger row is deleted. Operator-tunable because the ledger is accounting data: a commercial or tax retention obligation can run years beyond the default, and the deletion is irreversible. |
### `hephaestus.public-activity`
| Variable | Setting | Application default | Containers | Description |
| ---------------------------------------------------------- | ---------------------------------------------------------- | ------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `HEPHAESTUS_PUBLIC_ACTIVITY_ENABLED` | `hephaestus.public-activity.enabled` | | `server` | Allows public activity pages on this instance until an instance admin changes the switch in the admin console. Each workspace must also opt in. |
| `HEPHAESTUS_PUBLIC_ACTIVITY_REPOSITORY_VISIBILITY_MAX_AGE` | `hephaestus.public-activity.repository-visibility-max-age` | | `server` | How recently a sync must have confirmed that a repository is public for its work to appear on public activity pages. Must be positive. Accepts 48h, 2d, PT48H. |
### `hephaestus.release`
| Variable | Setting | Application default | Containers | Description |
| ------------------------------------- | ---------------------------------- | ------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `DEPLOYMENT_ENVIRONMENT` | `hephaestus.release.environment` | `default: local` | `server`, `migration` | The name of this deployment, such as `production`. The webapp, log lines and traces use the same name. |
| `HEPHAESTUS_IMAGE_APPLICATION_SERVER` | `hephaestus.release.image` | `default: (empty)` | `server` | The digest reference of the image that this container started from. It is empty outside a deployment from a release lock. |
| `HEPHAESTUS_RELEASE_CHECK_ENABLED` | `hephaestus.release.check-enabled` | `default: true` | `server` | Whether the server role may ask GitHub for the newest published release. |
| `HEPHAESTUS_RELEASE_COMMIT` | `hephaestus.release.commit` | `default: (empty)` | `server`, `migration` | The source commit that the release lock names. It is empty outside a deployment from a release lock. |
### `hephaestus.sandbox`
| Variable | Setting | Application default | Containers | Description |
| ----------------------------------------- | ---------------------------------------------- | ------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `HEPHAESTUS_SANDBOX_KUBERNETES_NAMESPACE` | `hephaestus.sandbox.kubernetes.namespace` | `default: (empty)` | `server` | The dedicated Kubernetes namespace for this release's sandbox claims, Pods and warm pools. |
| `SANDBOX_API_MAX_CONNECTIONS` | `hephaestus.sandbox.gateway.max-connections` | `default: 4096` | `server` | Most connections that the sandbox gateway holds open at once. Up to 100 further connections wait in the operating system's queue, and the rest fail. A review at its most calls in flight holds 170, and a normal review about 54 (estimated). |
| `SANDBOX_API_PORT` | `hephaestus.sandbox.gateway.port` | `default: 8081` | `server` | Port of the extra server connector that serves the sandbox gateway. The gateway API answers only on this port. The value 0 binds a free port at start. |
| `SANDBOX_MAX_CONCURRENT` | `hephaestus.sandbox.max-concurrent-containers` | `default: 5` | `server` | The most review sandboxes this server runs at once. |
### `hephaestus.scm`
| Variable | Setting | Application default | Containers | Description |
| ------------------------------------- | ------------------------------------- | ------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `HEPHAESTUS_SCM_EGRESS_PRIVATE_HOSTS` | `hephaestus.scm.egress.private-hosts` | `default: (empty)` | `server` | Host names, IP addresses or CIDR ranges of a Git provider on a private network. Only private addresses qualify: loopback, link-local and the known cloud metadata ranges stay blocked. A range wider than /16 (IPv4) or /48 (IPv6), outside the private ranges, or covering this server's own address stops startup. Empty allows public hosts only. |
### `hephaestus.security`
| Variable | Setting | Application default | Containers | Description |
| ------------------------------------------------------------- | ------------------------------------------------------------- | ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `HEPHAESTUS_SECURITY_CREDENTIAL_ENCRYPTION_KEY` | `hephaestus.security.credential-encryption-key` | | `server` | Active key that encrypts the stored credentials of integration connections. Exactly 32 bytes, so 32 ASCII characters. Required in production. |
| `HEPHAESTUS_SECURITY_CREDENTIAL_ENCRYPTION_KEY_VERSION` | `hephaestus.security.credential-encryption-key-version` | | `server` | Positive version number stored with each credential that the active credential key encrypts. Must differ from prior-credential-encryption-key-version. |
| `HEPHAESTUS_SECURITY_CREDENTIAL_ROTATION_ENABLED` | `hephaestus.security.credential-rotation-enabled` | | `server` | Re-encrypts stored credentials with the active credential key in batches on the server role. Requires both the active and the prior credential key. |
| `HEPHAESTUS_SECURITY_ENCRYPTION_KEY` | `hephaestus.security.encryption-key` | | `server` | Key that encrypts sensitive values at rest, such as login provider secrets, LLM connection keys and JWT signing keys. Exactly 32 bytes, so 32 ASCII characters. Required in production. |
| `HEPHAESTUS_SECURITY_PRIOR_CREDENTIAL_ENCRYPTION_KEY` | `hephaestus.security.prior-credential-encryption-key` | | `server` | Previous credential key, still used to decrypt credentials stored under its version during a key rotation. Exactly 32 bytes. Set it together with prior-credential-encryption-key-version. |
| `HEPHAESTUS_SECURITY_PRIOR_CREDENTIAL_ENCRYPTION_KEY_VERSION` | `hephaestus.security.prior-credential-encryption-key-version` | | `server` | Version number of the previous credential key. Set it together with prior-credential-encryption-key. |
### `hephaestus.sync`
| Variable | Setting | Application default | Containers | Description |
| ----------------------- | ---------------------------------- | ------------------- | ---------- | ---------------------------------------------------------------------- |
| `SYNC_COOLDOWN_MINUTES` | `hephaestus.sync.cooldown-minutes` | `prod: 60` | `server` | Minimum minutes between consecutive sync operations. |
| `SYNC_CRON` | `hephaestus.sync.cron` | `prod: 0 0 * * * *` | `server` | Cron expression for scheduled sync execution. |
| `SYNC_RUN_ON_STARTUP` | `hephaestus.sync.run-on-startup` | `prod: true` | `server` | Whether to trigger a sync run immediately when the application starts. |
| `SYNC_TIMEFRAME_DAYS` | `hephaestus.sync.timeframe-days` | `prod: 7` | `server` | Number of days to look back when synchronizing pull requests. |
### `hephaestus.webhook`
| Variable | Setting | Application default | Containers | Description |
| --------------------------------- | -------------------------------------------- | ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `WEBHOOK_ROUTING_PREVIOUS_SECRET` | `hephaestus.webhook.routing.previous-secret` | `default: (empty)` | `server` | Previous routing key that the receiver still accepts during a rotation. Keep it until every hook signed with it is replaced. Requires routing.secret and must differ from it. |
| `WEBHOOK_ROUTING_SECRET` | `hephaestus.webhook.routing.secret` | `default: (empty)` | `server` | Key that signs the webhook token of each GitLab connection and derives the signing secret of each Outline subscription. At least 32 characters, and must differ from the webhook secret. GitLab and Outline webhook registration is skipped when it is unset. |
| `WEBHOOK_SECRET` | `hephaestus.webhook.secret` | `default: (empty)` | `server` | Shared secret that verifies GitHub webhook signatures. The server requires at least 32 printable ASCII characters without spaces, also on an instance without GitHub. Must differ from both routing secrets. |
### `hephaestus.workspace`
| Variable | Setting | Application default | Containers | Description |
| --------------------------------------------- | --------------------------------------------- | --------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `HEPHAESTUS_WORKSPACE_CREATIONPOLICY` | `hephaestus.workspace.creation-policy` | `default: ADMIN_ONLY` | `server` | Who creates workspaces. Under `ADMIN_ONLY`, instance admins create them, and a GitHub App installation waits until an instance admin adopts it. Under `SELF_SERVICE`, every signed-in user can create one, and each GitHub App installation creates its own. |
| `HEPHAESTUS_WORKSPACE_SUBDOMAINS_BASE_DOMAIN` | `hephaestus.workspace.subdomains.base-domain` | `default: (empty)` | `server` | Domain under which each workspace gets its subdomain, such as hephaestus.build. Lowercase ASCII without a scheme, port or path, at most 189 characters. Required when subdomains are enabled. |
| `HEPHAESTUS_WORKSPACE_SUBDOMAINS_ENABLED` | `hephaestus.workspace.subdomains.enabled` | `default: false` | `server` | Gives each workspace its own subdomain address on the base domain. Authentication and the API stay on the apex domain. Prepare DNS, TLS and OAuth callbacks before you turn it on. |
### `management.opentelemetry`
| Variable | Setting | Application default | Containers | Description |
| ----------------------- | ------------------------------------------------------- | ------------------------------------------ | ---------- | ------------------------------------- |
| `TRACING_OTLP_ENDPOINT` | `management.opentelemetry.tracing.export.otlp.endpoint` | `default: http://localhost:4318/v1/traces` | `server` | URL to the OTel collector's HTTP API. |
### `management.server`
| Variable | Setting | Application default | Containers | Description |
| --------------------------- | --------------------------- | ------------------- | ---------- | -------------------------------------------------------------------------------------------------------- |
| `MANAGEMENT_SERVER_ADDRESS` | `management.server.address` | | `server` | Network address to which the management endpoints should bind. Requires a custom management.server.port. |
### `management.tracing`
| Variable | Setting | Application default | Containers | Description |
| ------------------------------ | ----------------------------------------- | ------------------- | ---------- | ----------------------------------------------------------------------- |
| `TRACING_OTLP_ENABLED` | `management.tracing.export.otlp.enabled` | `default: false` | `server` | Whether auto-configuration of tracing is enabled to export OTLP traces. |
| `TRACING_SAMPLING_PROBABILITY` | `management.tracing.sampling.probability` | `default: 0.0` | `server` | Probability in the range from 0.0 to 1.0 that a trace will be sampled. |
### `server.tomcat`
| Variable | Setting | Application default | Containers | Description |
| ---------------------------- | ----------------------------------------- | ------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------- |
| `HEPHAESTUS_TRUSTED_PROXIES` | `server.tomcat.remoteip.internal-proxies` | `prod: (empty)` | `server` | Internal proxies that are to be trusted. Can be set as a comma separate list of CIDR or as a regular expression. |
### `spring.application`
| Variable | Setting | Application default | Containers | Description |
| ------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `APP_VERSION` | `spring.application.version`
`logging.structured.ecs.service.version` | `default: 0.0.0-development; default: ${spring.application.version}` | `server`, `migration` | Version that the application reports in its logs, traces and release card. The deployment sets it from the release. Each log record names this version as its service version. |
### `spring.datasource`
| Variable | Setting | Application default | Containers | Description |
| -------------------------------------------- | -------------------------------------------- | ------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `DATABASE_PASSWORD` | `spring.datasource.password` | `prod: (empty)` | `server`, `migration` | Login password of the database. |
| `DATABASE_URL` | `spring.datasource.url` | `prod: (empty)` | `server`, `migration` | JDBC URL of the database. |
| `DATABASE_USERNAME` | `spring.datasource.username` | `prod: (empty)` | `server`, `migration` | Login username of the database. |
| `SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE` | `spring.datasource.hikari.maximum-pool-size` | | `server`, `migration` | Most PostgreSQL connections that one process holds in its pool. A server can hold two connections per running review. Keep the sum over all processes below the PostgreSQL connection limit. |
| `SPRING_DATASOURCE_HIKARI_MINIMUM_IDLE` | `spring.datasource.hikari.minimum-idle` | | `server`, `migration` | The minimum number of idle database connections that this process tries to keep in its pool. |
### `spring.mail`
| Variable | Setting | Application default | Containers | Description |
| ---------------------------------------------------- | ----------------------------------------------------- | ------------------- | ---------- | --------------------------------------------------- |
| `SPRING_MAIL_HOST` | `spring.mail.host` | `default: (empty)` | `server` | SMTP server host. For instance, 'smtp.example.com'. |
| `SPRING_MAIL_PASSWORD` | `spring.mail.password` | `default: (empty)` | `server` | Login password of the SMTP server. |
| `SPRING_MAIL_PORT` | `spring.mail.port` | `default: 587` | `server` | SMTP server port. |
| `SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH` | `spring.mail.properties[mail.smtp.auth]` | `default: true` | `server` | Additional JavaMail Session properties. |
| `SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE` | `spring.mail.properties[mail.smtp.ssl.enable]` | `default: false` | `server` | Additional JavaMail Session properties. |
| `SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE` | `spring.mail.properties[mail.smtp.starttls.enable]` | `default: true` | `server` | Additional JavaMail Session properties. |
| `SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_REQUIRED` | `spring.mail.properties[mail.smtp.starttls.required]` | `default: true` | `server` | Additional JavaMail Session properties. |
| `SPRING_MAIL_USERNAME` | `spring.mail.username` | `default: (empty)` | `server` | Login user of the SMTP server. |
### `spring.profiles`
| Variable | Setting | Application default | Containers | Description |
| ------------------------ | ------------------------ | ------------------- | --------------------- | ------------------------------------------------------------------------------------ |
| `SPRING_PROFILES_ACTIVE` | `spring.profiles.active` | | `server`, `migration` | Comma-separated list of active profiles. Can be overridden by a command line switch. |