Skip to content

10.3. Environment Variables

1. Generated Environment Matrix

Variable Service Default Description
AIRFLOW_SOURCE airflow disabled -
AIRFLOW_PORT airflow Host port for the Airflow Web UI + REST API (in-container 8080).
AIRFLOW_DB_USER airflow airflow -
AIRFLOW_DB_PASSWORD airflow Auto-generated by bootstrapper. Postgres role for the Airflow metadata DB.
AIRFLOW_FERNET_KEY airflow Auto-generated. Fernet key for encrypting Connection passwords.
AIRFLOW_SECRET_KEY airflow Auto-generated. AIRFLOW__API__SECRET_KEY — signs inter-process payloads (DagFileProcessor → scheduler RPC, deferrable triggers, multi-scheduler JWTs). Airflow 3.x; previously [webserver] secret_key + Flask sessions in 2.x.
AIRFLOW_JWT_SECRET airflow Auto-generated. AIRFLOW__API_AUTH__JWT_SECRET — signs Execution API JWTs (the /execution/ task-supervisor protocol + /api/v2/ auth-token exchange). Distinct from AIRFLOW_SECRET_KEY: when unset, webserver/scheduler/dag-processor each mint their own and cross-process JWT verification fails with 403 InvalidSignatureError (#850). Idempotent — never rotates on warm restart.
AIRFLOW_ADMIN_PASSWORD airflow Auto-generated. Admin login. Username is hardcoded 'admin'.
AIRFLOW_WEBSERVER_SCALE airflow -
AIRFLOW_SCHEDULER_SCALE airflow -
AIRFLOW_DAG_PROCESSOR_SCALE airflow Required in Airflow 3.x — the standalone DAG processor service parses DAG files into the metadata DB (the scheduler no longer does this in-process).
AIRFLOW_INIT_SCALE airflow -
AIRFLOW_WEBSERVER_MEMORY_LIMIT airflow 2g Container memory limit for airflow-webserver (deploy.resources.limits.memory). The api-server process is Python + Flask/FAB; 2 g is comfortable on a 32 GB host and prevents runaway memory from large DAG list pages.
AIRFLOW_WEBSERVER_CPU_LIMIT airflow 1.0 Container CPU limit for airflow-webserver (deploy.resources.limits.cpus). 1.0 core is ample for the API/UI server under typical load.
AIRFLOW_SCHEDULER_MEMORY_LIMIT airflow 2g Container memory limit for airflow-scheduler (deploy.resources.limits.memory). The LocalExecutor scheduler forks task processes in-process; 2 g caps runaway task forking.
AIRFLOW_SCHEDULER_CPU_LIMIT airflow 1.0 Container CPU limit for airflow-scheduler (deploy.resources.limits.cpus). 1.0 core is sufficient for LocalExecutor task scheduling on a dev/staging host.
AIRFLOW_DAG_PROCESSOR_MEMORY_LIMIT airflow 2g Container memory limit for airflow-dag-processor (deploy.resources.limits.memory). DAG parsing is Python-heavy but short-lived per cycle; 2 g prevents unbounded growth from parsing pathological DAG files.
AIRFLOW_DAG_PROCESSOR_CPU_LIMIT airflow 1.0 Container CPU limit for airflow-dag-processor (deploy.resources.limits.cpus). 1.0 core covers the periodic DAG file parsing cycle.
ASSET_BAKER_SOURCE asset-baker disabled Deployment mode for the Blender HP→LP bake worker. container-cpu runs deterministic Cycles-CPU bakes (GPU-optional, deferred).
ASSET_BAKER_PORT asset-baker Host port for the asset-baker API (in-container listen port is 8096).
ASSET_BAKER_SCALE asset-baker -
ASSET_BAKER_ENDPOINT asset-baker In-network URL for the asset-baker API.
ASSET_BAKER_API_TOKEN asset-baker Auto-generated bearer token required by all Asset Baker data and processing routes; /health remains unauthenticated.
ASSET_BAKER_ALLOWED_INPUT_BUCKETS asset-baker Optional comma- or space-separated reference-route bucket allowlist; blank follows MINIO_BUCKET_ASSET_INPUTS.
ASSET_BAKER_BLENDER_VERSION asset-baker 4.3.2 Pinned headless Blender version (>= 4.3) downloaded into the asset-baker image. Blender bundles its own Python + numpy for the bake script.
ASSET_BAKER_BLENDER_SHA256 asset-baker 4da1c956673c0485e63054e563ee69198cc8f80d8157dd7592dffc8a6a5592e6 SHA-256 checksum verified before extracting the pinned Blender archive. Update it with ASSET_BAKER_BLENDER_VERSION from Blender's published checksum file.
ASSET_BAKER_ARTIFACT_DIR asset-baker /data/artifacts Local artifact cache used when MinIO upload is disabled or for direct downloads.
ASSET_BAKER_MINIO_ENABLED asset-baker True When true, baked LP GLBs + textures are written to MinIO using content-addressed keys.
ASSET_BAKER_MINIO_BUCKET asset-baker asset-baker MinIO bucket for baked LP GLB + texture outputs.
ASSET_BAKER_MINIO_ENDPOINT asset-baker In-network MinIO S3 API endpoint used by the worker.
ASSET_BAKER_MINIO_ACCESS_KEY asset-baker Optional MinIO access key override. Empty uses the generated asset-baker scoped MinIO account.
ASSET_BAKER_MINIO_SECRET_KEY asset-baker Optional MinIO secret key override. Empty uses the generated asset-baker scoped MinIO account.
ASSET_BAKER_TARGET_TRIS asset-baker 39000 Default low-poly triangle budget the decimate stage targets (overridable per request).
ASSET_BAKER_TEX_SIZE asset-baker 2048 Default baked BaseColor/Normal texture resolution (square). 2k measured 30–200 s/asset on CPU; overridable per request.
ASSET_BAKER_CANONICAL_SIZE asset-baker 4.0 Canonical max-dimension (units) each mesh is scaled to before remesh so the relative voxel/ray heuristics are stable regardless of the raw GLB import scale.
ASSET_BAKER_BRIGHTNESS_MIN asset-baker 0.05 Mean-brightness QA gate: a baked BaseColor whose mean < this is a silently-failed (black) bake and is refused with a non-zero result.
ASSET_BAKER_TIMEOUT_SECONDS asset-baker 600 Hard wall-clock ceiling for a single bake subprocess; exceeded bakes are killed and reported as timeout.
ASSET_BAKER_MAX_UPLOAD_MB asset-baker 200 Maximum accepted GLB input size (MiB). Larger uploads/refs are rejected before a Blender process is spawned.
ASSET_BAKER_CONCURRENCY asset-baker 1 Maximum concurrent bake subprocesses. Default 1 — a single Cycles bake saturates CPU and concurrent bakes are net-negative.
ASSET_WORKER_SOURCE asset-worker disabled Deployment mode for the glTF post-processing worker.
ASSET_WORKER_PORT asset-worker Host port for the asset-worker API (in-container listen port is 8095).
ASSET_WORKER_SCALE asset-worker -
ASSET_WORKER_ENDPOINT asset-worker In-network URL for the asset-worker API.
ASSET_WORKER_API_TOKEN asset-worker Auto-generated bearer token required by all Asset Worker data and processing routes; /health remains unauthenticated.
ASSET_WORKER_ALLOWED_INPUT_BUCKETS asset-worker Optional comma- or space-separated reference-route bucket allowlist; blank follows MINIO_BUCKET_ASSET_INPUTS.
ASSET_WORKER_GLTF_TRANSFORM_VERSION asset-worker 4.4.1 Pinned @gltf-transform/cli version installed in the asset-worker image.
ASSET_WORKER_MAX_UPLOAD_MB asset-worker 200 Maximum GLB upload or MinIO reference size in MiB. Input is streamed and rejected before transformation when this limit is exceeded.
ASSET_WORKER_TIMEOUT_SECONDS asset-worker 300 Per-command timeout for gltf-transform inspect, validate, and optimize subprocesses.
ASSET_WORKER_CONCURRENCY asset-worker 1 Maximum concurrent glTF mutation requests; saturated workers reject new work with HTTP 429 before request-body parsing or object-store fetch.
ASSET_WORKER_ARTIFACT_DIR asset-worker /data/artifacts Local artifact cache used when MinIO upload is disabled or for direct downloads.
ASSET_WORKER_MINIO_ENABLED asset-worker True When true, optimized GLBs are written to MinIO using content-addressed keys.
ASSET_WORKER_MINIO_BUCKET asset-worker asset-worker MinIO bucket for optimized GLB outputs.
ASSET_WORKER_MINIO_ENDPOINT asset-worker In-network MinIO S3 API endpoint used by the worker.
ASSET_WORKER_MINIO_ACCESS_KEY asset-worker Optional MinIO access key override. Empty uses the generated asset-worker scoped MinIO account.
ASSET_WORKER_MINIO_SECRET_KEY asset-worker Optional MinIO secret key override. Empty uses the generated asset-worker scoped MinIO account.
BACKEND_SOURCE backend container Adaptive core service; always container. Single-option.
BACKEND_PORT backend -
BACKEND_SCALE backend Always 1 (BACKEND_SOURCE is single-valued).
MAX_UPLOAD_BYTES backend 104857600 Maximum accepted /storage/upload body size in bytes before the backend returns 413.
COMFYUI_MAX_IMAGE_BYTES backend 20971520 Maximum generated-image response bytes accepted from ComfyUI before the Backend aborts the download.
COMFYUI_COMPLETION_TIMEOUT_SECONDS backend 300 End-to-end deadline in seconds for synchronous ComfyUI generation and workflow requests. The Backend poller and bundled Open WebUI tool share this default.
RAG_INGESTION_MAX_FILE_BYTES backend 104857600 Maximum bytes loaded from any single mounted or MinIO RAG corpus file. Oversize files fail ingestion before unbounded allocation.
RAG_INGESTION_MAX_CORPUS_BYTES backend 1073741824 Maximum aggregate bytes loaded by one RAG corpus discovery pass across mounted or MinIO files.
RAG_INGESTION_MAX_FILES backend 10000 Maximum number of files accepted in one mounted or MinIO RAG corpus discovery pass.
RAG_INGESTION_CORPUS_ROOT backend /app/corpus Container path under which operator-provided read-only RAG corpus mounts are resolved. Mount the same path into Backend and Celery worker when asynchronous ingestion is enabled.
RAG_INGESTION_EXECUTION_LEASE_SECONDS backend 30 Renewable execution-ownership lease for RAG ingestion workers. Must be an integer from 10 through 300; duplicate deliveries retry until the active owner completes or its lease expires.
RESEARCH_SESSION_LEASE_SECONDS backend 300 Maximum age in seconds for pending research work or a running session heartbeat before the Backend atomically marks the abandoned session failed.
RESEARCH_MAX_CONCURRENT backend 4 Maximum research sessions admitted concurrently per Backend process. Excess start requests fail before database work with HTTP 429.
BACKEND_PG_POOL_MIN backend 1 Minimum connections kept warm in the Backend's shared asyncpg pool (#804). Short-lived DB ops draw from this pool instead of paying a fresh connect handshake each time; long-hold paths (memory vector-reconcile) keep dedicated connections.
BACKEND_PG_POOL_MAX backend 10 Maximum connections the Backend's shared asyncpg pool (#804) opens per database URL. Concurrent short-lived DB ops beyond this queue for a free slot rather than over-subscribing Postgres.
BACKEND_STORAGE_ALLOWED_BUCKETS backend default Comma-separated Supabase Storage bucket allowlist accepted by /storage/upload.
BACKEND_MEDIA_INPUT_BUCKET backend default Atlas storage bucket the media gateway hosts image_to_3d inputs in when a provider (e.g. Tripo) rejects data-URI inputs. Objects are written under the media-inputs/ prefix.
BACKEND_MEDIA_INPUT_PUBLIC_BASE_URL backend Optional public base URL for hosted media inputs. When set, hosted image_to_3d input URLs are formed as // so the provider's cloud can fetch them through a reachable ingress; empty falls back to the storage client's public URL.
MEDIA_REQUEST_MAX_BYTES backend 41943040 Maximum POST /media/generate request body size in bytes. Oversized declared and streamed bodies are rejected with HTTP 413 before route parsing.
MEDIA_INPUT_MAX_BYTES backend 26214400 Maximum decoded image data-URI size in bytes, including conditioned output. Oversized base64 payloads are rejected before decoding.
MEDIA_INPUT_MAX_PIXELS backend 40000000 Maximum decoded or conditioned image pixel count. Dimensions are checked before full Pillow conversion to bound decompression and canvas memory.
MEDIA_BUDGET_ENABLED backend False Enables media spend accounting + budget enforcement (#342). When off, ordinary operations record no spend rows and enforce no caps; ambiguous FAL submissions still create a recovery row.
MEDIA_BUDGET_STORE backend postgres Ledger/recovery store: 'postgres' (durable, media_spend_ledger table) or 'memory' (process-local, non-durable — testing/ephemeral). Ambiguous FAL submissions use it for recovery even when budget enforcement is disabled.
MEDIA_BUDGET_CURRENCY backend USD Currency label recorded on media spend ledger rows.
MEDIA_BUDGET_DEFAULT_USD backend Default per-consumer/project spend cap in USD. Empty = no default cap (ledger records without hard-stop). Per-consumer overrides go in MEDIA_BUDGET_CONSUMER_CAPS.
MEDIA_BUDGET_CONSUMER_CAPS backend Optional JSON map of per-scope caps, keyed by 'consumer' or 'consumer:project', e.g. {"rag-showcase":25,"rag-showcase:demo":5}. Overrides MEDIA_BUDGET_DEFAULT_USD for matching scopes.
MEDIA_DISABLED_PROVIDERS backend Comma-separated media providers to kill-switch off (e.g. 'fal'). A disabled provider hard-stops its own submissions without downing the gateway or other providers.
MEDIA_BUDGET_ALLOW_UNKNOWN_COST backend False When false (default), a budgeted submission for a model with no known cost is rejected rather than billed an unknown amount (never silently $0). Set true to allow unknown-cost submissions under a cap.
MEDIA_BUDGET_RETENTION_DAYS backend Optional retention window in days for media spend ledger rows; empty keeps rows indefinitely (no pruning). When set, an hourly background sweep prunes rows older than the window.
MEDIA_OPERATION_TTL_SECONDS backend 604800 Redis retention in seconds for hosted media operation state. The default keeps terminal results available for seven days across Backend replicas and restarts.
BACKEND_CORS_ORIGINS backend * Comma-separated browser origins accepted by the backend CORS middleware. Default preserves local-development permissiveness.
BACKEND_CORS_ALLOW_ORIGIN_REGEX backend Optional regex accepted by the backend CORS middleware for wildcard subdomain policies.
BACKEND_DEV_RELOAD backend False Opt-in uvicorn --reload for live development (#679). Disabled by default so the production/consumer image runs a stable process: with backend_plugins bind-mounted, host-side git churn in the plugin tree would otherwise restart or crash-loop the backend. The plugin seam installs at boot, so recreate the backend to apply plugin changes.
BACKEND_KONG_AUTH backend disabled Default gateway authentication mode for the api.localhost backend route: disabled (default local-dev behavior) or key-auth (requires apikey header). A backend plugin's plugin.yml auth: open/key-auth overrides this per route prefix (#402).
BACKEND_KONG_API_KEY backend Auto-generated key accepted by Kong when BACKEND_KONG_AUTH=key-auth. Send as apikey: <value>.
BACKEND_IDENTITY_AUTH backend required Application identity boundary for backend routes: required (default) accepts Supabase user JWTs or the trusted internal-service token; disabled is an explicit emergency rollback mode.
BACKEND_INTERNAL_API_TOKEN backend Auto-generated full-operator bearer token. Reserve for trusted administration; first-party services use narrower caller tokens.
BACKEND_N8N_API_TOKEN backend Auto-generated n8n bearer accepted only by the research, memory-automation, legacy ComfyUI, and storage-upload routes used by bundled workflows.
BACKEND_NOTEBOOK_API_TOKEN backend Auto-generated bearer token exposed to JupyterHub and accepted only by stateless backend document extraction, chunking, and RAG evaluation routes.
BACKEND_OPEN_WEBUI_API_TOKEN backend Auto-generated Open WebUI bearer accepted only by memory and legacy ComfyUI routes used by bundled server-side tools and functions.
BACKEND_PLUGINS_PIP_TIMEOUT_SECONDS backend 300 Timeout in seconds for pip install of backend plugin requirements (plugin_seam) at startup. The install runs at backend import time, so an unbounded hang would block startup; raise for slow networks.
BACKEND_PLUGINS_SITE_DIR backend /tmp/atlas-plugins-site Writable directory the plugin seam pip-installs plugin requirements into (pip --target) and prepends to sys.path before plugin imports (#559). The image runs as appuser with root-owned site-packages, so untargeted installs fail with EACCES even though appuser has a writable home/cache for runtime dependencies. Must be creatable by the backend user; falls back to untargeted pip install when it cannot be created.
LANGMEM_ENABLED backend True -
LANGMEM_MEMORY_NAMESPACE backend default -
LANGMEM_AUTO_CONSOLIDATE backend True Reserved — not yet honored. Memory consolidation currently runs only on demand via POST /memory/consolidate; there is no background scheduler, so changing this value has no effect today.
LANGMEM_CONSOLIDATION_INTERVAL backend 86400 Reserved — not yet honored (see LANGMEM_AUTO_CONSOLIDATE). Interval in seconds a future auto-consolidation scheduler would use.
LANGMEM_MAX_FACTS_PER_USER backend 1000 -
LANGMEM_EXTRACTION_MODEL backend LiteLLM model id (empty = highest-priority active content model resolved by model_resolver from YAML catalogs + env).
LANGMEM_EMBEDDING_MODEL backend -
GRAPHITI_ENABLED backend False Disabled-by-default backend-only Graphiti temporal graph memory experiment. Does not expose Graphiti to agents or run a Graphiti service.
GRAPHITI_GROUP_ID_PREFIX backend atlas Prefix for backend Graphiti group_id values. Final shape: atlas::backend::user:.
GRAPHITI_DEFAULT_NAMESPACE backend langmem Default backend Graphiti namespace segment used when projecting selected LangMem facts/events.
GRAPHITI_LLM_MODEL backend Optional LiteLLM model id for Graphiti extraction. Empty falls back to LANGMEM_EXTRACTION_MODEL, then LITELLM_DEFAULT_MODEL.
GRAPHITI_EMBEDDING_MODEL backend Optional LiteLLM embedding model id for Graphiti. Empty falls back to LANGMEM_EMBEDDING_MODEL, then LITELLM_EMBEDDING_MODEL.
GRAPHITI_EXPOSE_TO_AGENTS backend False Must remain false for this backend-only evaluation; Hermes/OpenClaw exposure and Graphiti MCP are deferred.
RAGAS_EVALUATOR_MODEL backend Optional LiteLLM model id for Backend Ragas evaluation. Empty falls back to LITELLM_DEFAULT_MODEL.
RAGAS_EMBEDDINGS_MODEL backend Optional LiteLLM embedding model id for Backend Ragas answer-relevancy evaluation. Empty falls back to LITELLM_EMBEDDING_MODEL.
RAY_JOB_API_TOKEN backend Auto-generated bearer token required by every /api/ray/* route. Send as Authorization: Bearer .
LIGHTRAG_RERANK_ADAPTER_ENABLED backend false Opt-in for the backend LightRAG rerank adapter route (POST /lightrag/rerank, #415). When true AND TEI_RERANKER_SOURCE is enabled, the bootstrapper wires LightRAG's rerank binding to the adapter and consumer query profiles may set enable_rerank=true. Default false keeps direct LightRAG->TEI rerank disabled (payload shapes are incompatible).
LIGHTRAG_RERANK_ADAPTER_TOKEN backend Auto-generated bearer token guarding the /lightrag/rerank adapter route. Handed to LightRAG as RERANK_BINDING_API_KEY so the two share one secret. Send as Authorization: Bearer <value>.
LIGHTRAG_RERANK_ADAPTER_TIMEOUT_SECONDS backend 30 Finite per-request timeout in seconds for /lightrag/rerank calls to TEI. Must be greater than 0 and no greater than 3600; invalid values fail Backend startup.
BACKUP_SOURCE backup disabled Deployment mode: container (enable the runner) or disabled (default).
BACKUP_BUCKET backup atlas-backups Target bucket for backups.
BACKUP_S3_ALIAS_URL backup http://minio:9000 S3 endpoint. Default = on-box MinIO; set to an external S3 URL for offsite.
BACKUP_COMMAND_TIMEOUT_SECONDS backup 900 Positive per-command deadline in seconds for package install, database, archive, and S3 operations.
BACKUP_SCALE backup 0 (never long-running); the runner is invoked on demand via docker compose run.
BLENDER_MCP_SOURCE blender-mcp disabled Host-installed Blender MCP bridge source. Disabled by default because Blender MCP can execute generated Python code inside Blender.
BLENDER_MCP_HOST blender-mcp localhost Host where the Blender MCP add-on socket is listening.
BLENDER_MCP_LOCALHOST_PORT blender-mcp 9876 Host port for the Blender MCP add-on socket. This is a host-tool port hint, not a Kong or container port.
BLENDER_MCP_ENDPOINT blender-mcp Resolved endpoint hint for MCP clients when BLENDER_MCP_SOURCE is a host source (localhost / managed-localhost).
BLENDER_MCP_STATE_DIR blender-mcp ~/.atlas/blender-mcp State dir for the managed-localhost source (#759): pinned add-on, generated headless launcher, pid/log files. Removed by ./start.sh blender-mcp remove.
BLENDER_MCP_BIND blender-mcp 127.0.0.1 Bind address for the managed headless bridge. Loopback-only by default — execute_code runs arbitrary Python inside Blender; any other value is refused unless BLENDER_MCP_ALLOW_REMOTE=true.
BLENDER_MCP_ALLOW_REMOTE blender-mcp False Explicit second opt-in required to bind the managed bridge beyond loopback. Leave false unless you own the network boundary.
BLENDER_MCP_BLENDER_PATH blender-mcp Explicit Blender binary for the managed source. Empty = auto-detect (/Applications/Blender.app on macOS, blender on PATH elsewhere). Atlas manages the MCP bridge, not the Blender application — install Blender yourself.
BLENDER_MCP_ADDON_REF blender-mcp 6641189231caf3752302ae20591bc87fda85fc4e Pinned ahujasid/blender-mcp ref whose addon.py the managed source provisions. Move together with BLENDER_MCP_ADDON_SHA256.
BLENDER_MCP_ADDON_SHA256 blender-mcp bba60831f5f89a74deda0294b131668a086cf46eb35a6a01abbd0d21d9e92630 sha256 of the pinned addon.py; the manager refuses to install a mismatching download (it will later execute arbitrary Python).
BLENDER_MCP_ADDON_FILE blender-mcp Escape hatch: use a local add-on file instead of the pinned download (no sha verification; preflight warns).
CELERY_SOURCE celery disabled Deployment mode: container (backend worker + Flower) or disabled.
CELERY_WORKER_SCALE celery -
FLOWER_SCALE celery -
FLOWER_PORT celery Host port for Flower (in-container 5555).
CELERY_BROKER_URL celery Redis broker URL; Atlas uses Redis database 4 for Celery.
CELERY_RESULT_BACKEND celery Redis result backend URL; Atlas uses Redis database 4 for Celery task state.
CELERY_QUEUE celery atlas Default Celery queue consumed by the Atlas backend worker.
CELERY_WORKER_CONCURRENCY celery 2 Positive worker process concurrency for backend async jobs. Invalid values fail Backend and worker startup.
CELERY_WORKER_PREFETCH_MULTIPLIER celery 1 Positive prefetch multiplier. The default reduces head-of-line blocking for long tasks; invalid values fail startup.
CELERY_TASK_TIME_LIMIT_SECONDS celery 900 Positive hard per-task limit. Must exceed the soft limit and remain below the broker visibility timeout.
CELERY_TASK_SOFT_TIME_LIMIT_SECONDS celery 840 Positive soft per-task limit. Must be strictly less than the hard limit.
CELERY_BROKER_VISIBILITY_TIMEOUT_SECONDS celery 3600 Positive Redis broker visibility timeout. Must be strictly greater than the task hard limit.
CHATTERBOX_PORT chatterbox Host port for the Chatterbox container (in-container listen port is 4123).
CHATTERBOX_LOCALHOST_PORT chatterbox 63044 Host port for the chatterbox-localhost source variant. URL is derived at compose-render time as http://host.docker.internal:63044.
CHATTERBOX_SCALE chatterbox Computed by bootstrapper/services/service_config.py::_generate_tts_provider_config — set to 1 when TTS_PROVIDER_SOURCE=chatterbox-container-gpu.
CLOUD_OPENAI_SOURCE cloud-providers disabled Options: enabled, disabled.
OPENAI_API_KEY cloud-providers OpenAI API key used by LiteLLM when CLOUD_OPENAI_SOURCE=enabled.
OPENAI_USER_MODELS cloud-providers Comma-separated OpenAI model names the wizard activated.
CLOUD_ANTHROPIC_SOURCE cloud-providers disabled Options: enabled, disabled.
ANTHROPIC_API_KEY cloud-providers Anthropic API key used by LiteLLM when CLOUD_ANTHROPIC_SOURCE=enabled.
ANTHROPIC_USER_MODELS cloud-providers Comma-separated Anthropic model names the wizard activated.
CLOUD_OPENROUTER_SOURCE cloud-providers disabled Options: enabled, disabled.
OPENROUTER_API_KEY cloud-providers OpenRouter API key used by LiteLLM when CLOUD_OPENROUTER_SOURCE=enabled.
OPENROUTER_USER_MODELS cloud-providers Comma-separated OpenRouter model names the wizard activated.
LITELLM_OPENAI_ENABLED cloud-providers Derived from CLOUD_OPENAI_SOURCE.
LITELLM_ANTHROPIC_ENABLED cloud-providers Derived from CLOUD_ANTHROPIC_SOURCE.
LITELLM_OPENROUTER_ENABLED cloud-providers Derived from CLOUD_OPENROUTER_SOURCE.
LITELLM_ENABLED_PROVIDERS cloud-providers Comma-separated lowercase list of enabled cloud providers.
CLOUDFLARED_SOURCE cloudflared disabled Deployment mode: container (run the tunnel) or disabled (default).
CLOUDFLARE_TUNNEL_TOKEN cloudflared Cloudflare named-tunnel token (Zero Trust > Networks > Tunnels). When CLOUDFLARED_SOURCE=container this must be set or the daemon exits. The tunnel's public hostname is configured in the Cloudflare dashboard to point at http://kong-api-gateway:8000.
CLOUDFLARED_SCALE cloudflared Set to 1 when CLOUDFLARED_SOURCE=container, 0 when disabled.
COMFYUI_SOURCE comfyui container-cpu -
COMFYUI_INIT_SOURCE comfyui container -
COMFYUI_PORT comfyui -
COMFYUI_LOCALHOST_PORT comfyui 8000 Host port for the localhost source variant. URL is derived at compose-render time as http://host.docker.internal:8000.
COMFYUI_MPS_LOCALHOST_PORT comfyui 8188 Fixed host port the Atlas-managed Apple-Silicon/MPS ComfyUI listens on (source=managed-localhost-mps). Containers reach it as http://host.docker.internal:8188. Named with the LOCALHOST host-port convention so the topology slot allocator leaves the fixed default intact.
COMFYUI_MPS_REF comfyui v0.27.0 Pinned upstream ComfyUI git ref the managed MPS host process checks out (mirrors COMFYUI_REF for the container path). A release tag or full commit SHA.
COMFYUI_MPS_STATE_DIR comfyui ~/.atlas/comfyui-mps Atlas-owned host state directory for the managed MPS ComfyUI: the pinned checkout, its venv, and the pid/log/status files. Never a container volume.
COMFYUI_MPS_MODELS_PATH comfyui ~/Documents/ComfyUI/models Existing host models directory the managed MPS process reuses (via extra_model_paths) so no weights are duplicated. Shared with COMFYUI_LOCAL_MODELS_PATH by default. Also the provisioning destination under managed-localhost-mps: the host provisioner (#754) downloads declared COMFYUI_USER_MODELS here at start — not just a reuse path.
COMFYUI_MPS_MIN_MEMORY_GB comfyui 16 Minimum unified-memory headroom (GiB) the managed MPS preflight requires before launching ComfyUI; below this the preflight warns.
COMFYUI_MPS_TORCH_PIN comfyui torch==2.11.0 torchvision==0.26.0 torchaudio==2.11.0 Pinned Torch/vision/audio pip spec the managed MPS install applies, so fresh installs are reproducible against the same COMFYUI_MPS_REF instead of pulling whatever Torch is newest that day. Space-separated pip requirement specifiers; bump alongside COMFYUI_MPS_REF. macOS/arm64 torch wheels carry Metal/MPS.
COMFYUI_MPS_LISTEN comfyui 127.0.0.1 Bind address the managed MPS ComfyUI host process listens on. Default 127.0.0.1 (loopback) works on Docker Desktop/macOS where host.docker.internal forwards to host loopback. On Linux container engines, host.docker.internal maps via host-gateway to a bridge address that cannot reach a loopback listener — set 0.0.0.0 there so containers can reach the host process. Local health/port probes stay on 127.0.0.1 regardless.
COMFYUI_BASE_URL comfyui http://comfyui:18188 In-container default. Runtime value is COMFYUI_ENDPOINT computed by hook.
COMFYUI_KONG_URL comfyui http://kong-api-gateway:8000/comfyui -
COMFYUI_ARGS comfyui --listen -
COMFYUI_AUTO_UPDATE comfyui True AI-Dock startup update flag. Atlas keeps this true so COMFYUI_REF pins the upstream ComfyUI core even when the base image tag lags.
COMFYUI_REF comfyui v0.27.0 Pinned upstream ComfyUI git ref passed to AI-Dock. Use a release tag or full commit SHA when deliberately changing the ComfyUI core.
COMFYUI_PLATFORM comfyui linux/amd64 -
COMFYUI_UPLOAD_TO_SUPABASE comfyui True Reserved/inert flag. No consumer exists in the stock ai-dock image, Atlas provisioning, or the backend, so ComfyUI does NOT currently upload its outputs to Supabase; kept as a placeholder for a future output-upload custom node.
COMFYUI_STORAGE_BUCKET comfyui comfyui-images Reserved bucket name for the (currently inert) COMFYUI_UPLOAD_TO_SUPABASE placeholder; unused until an output-upload node is wired.
COMFYUI_MODELS_PATH comfyui /opt/ComfyUI/models -
COMFYUI_LOCAL_MODELS_PATH comfyui ~/Documents/ComfyUI/models -
COMFYUI_USER_MODELS comfyui Comma-separated catalog model names the user picked in the wizard (or via --comfyui-models). Read by services/comfyui/init/scripts/download_models.sh; and by the managed-MPS host provisioner (#754), which downloads the same resolved set into COMFYUI_MPS_MODELS_PATH.
COMFYUI_CUSTOM_MODELS_FILE comfyui /custom-models.yaml Path to the ComfyUI custom-models sidecar YAML (user-authored models not in the curated catalog). Read by comfyui_resolver when generating the download manifest, and by the wizard's model picker.
COMFYUI_CUSTOM_NODES_FILE comfyui /custom-nodes.yaml Path (os.pathsep-joined list) to pinned ComfyUI custom-node allowlist files. The Atlas-shipped services/comfyui/custom-nodes.yaml is always present; consumer manifests (custom_nodes.comfyui in atlas.consumer.yml) append. Consumer-declared nodes are active unconditionally (not model-gated). The bootstrapper maps selected models' requires_custom_node values through this list before writing active-custom-nodes.tsv.
COMFYUI_INIT_SCALE comfyui -
COMFYUI_SCALE comfyui -
COMFYUI_ENDPOINT comfyui Resolved per COMFYUI_SOURCE. Consumed by backend, open-webui, n8n, jupyterhub, and downstream overlays. Consumer pattern: MY_URL: ${MY_URL:-${COMFYUI_ENDPOINT:-http://comfyui:18188}}
COMFYUI_DEPLOY_RESOURCES comfyui ~ -
COMFYUI_MEMORY_LIMIT comfyui 40g Hard container-memory ceiling for ComfyUI (deploy.resources.limits.memory). The limit does not reserve memory; 40 g permits large multi-file bundles such as Krea 2 while smaller workloads consume only what they need.
COMFYUI_CPU_LIMIT comfyui 2.0 Container CPU limit for the comfyui container (deploy.resources.limits.cpus). 2.0 cores keeps CPU-mode inference from monopolising the host; GPU mode is GPU-bound so the CPU cap is irrelevant in practice.
CRAWL4AI_SOURCE crawl4ai disabled -
CRAWL4AI_PORT crawl4ai -
CRAWL4AI_API_TOKEN crawl4ai Bearer token required by Crawl4AI's Docker API; auto-generated by the bootstrapper.
CRAWL4AI_TIMEOUT_SECONDS crawl4ai 30 Local Deep Researcher timeout for Crawl4AI extraction calls.
CRAWL4AI_MAX_CHARS crawl4ai 60000 Maximum markdown characters Local Deep Researcher keeps from each Crawl4AI result.
CRAWL4AI_ALLOW_INTERNAL_URLS crawl4ai False Keep false unless deliberately crawling private/internal URLs from inside the Atlas network.
CRAWL4AI_SCALE crawl4ai -
CRAWL4AI_ENDPOINT crawl4ai -
DOC_PROCESSOR_SOURCE docling disabled -
DOC_PROCESSOR_PORT docling -
DOCLING_GPU_DEVICE docling cuda -
DOCLING_OUTPUT_FORMAT docling markdown -
DOCLING_USE_OCR docling auto -
DOCLING_TABLE_MODE docling accurate -
DOCLING_MAX_FILE_SIZE docling 52428800 Positive maximum upload bytes for Docling GPU, localhost, and adapter APIs. Request bodies are capped before multipart parsing with 1 MiB framing overhead; invalid values fail startup and oversized requests return 413.
DOCLING_UPLOAD_TIMEOUT_SECONDS docling 120 Total seconds (1-3600) allowed to receive one Docling or adapter upload body before a 408 response releases admission capacity.
DOCLING_CONCURRENCY docling 1 Maximum concurrent Docling conversions per provider process. Default 1 prevents duplicate model loads and GPU memory contention.
DOCLING_API_TOKEN docling Auto-generated bearer credential required by Docling routes except /health.
DOCLING_AUTH_MODE docling required Provider authentication mode: required (default) or disabled for an explicit emergency/local rollback.
DOCLING_CORS_ORIGINS docling Optional comma-separated browser origin allowlist. Empty disables CORS; wildcard is invalid while authentication is required.
DOCLING_INFERENCE_TIMEOUT_SECONDS docling 900 Finite conversion and lazy-load deadline in seconds (1-3600). A timeout returns 504 and then exits the provider process for restart.
DOCLING_LOCALHOST_BIND_HOST docling 127.0.0.1 Native Docling listen address. Set another interface explicitly only when remote access is intended.
DOCLING_ADAPTER_MAX_JOBS docling 2 Maximum outstanding LightRAG adapter jobs, reserved before multipart parsing.
DOCLING_ADAPTER_RESULT_TTL_SECONDS docling 900 Seconds a completed LightRAG adapter result may remain before its artifact and job slot are removed.
DOCLING_ADAPTER_MAX_RESULT_BYTES docling 104857600 Maximum ZIP result bytes streamed from Docling to adapter storage before the job fails safely.
DOCLING_ADAPTER_UPSTREAM_MAX_ATTEMPTS docling 3 Total bounded Docling request attempts when the provider returns HTTP 429.
DOCLING_ADAPTER_DOWNLOAD_TIMEOUT_SECONDS docling 300 Positive maximum seconds for one result transmission; expiry deletes the artifact and releases its adapter slot.
DOCLING_ADAPTER_TMPFS_SIZE docling 512m Bounded adapter temporary-storage mount. Size must cover MAX_JOBS times the larger of upload-plus-request-body (upload plus 1 MiB multipart overhead) or upload-plus-result limits, plus at least 64 MiB staging headroom; startup fails when actual capacity is smaller.
DOCLING_ADAPTER_SCALE docling Derived adapter replica count; one only when both LightRAG and Docling are enabled.
DOCLING_ADAPTER_UPSTREAM_ENDPOINT docling Authenticated internal bundle route selected for the adapter; never exposed to LightRAG.
DOCLING_ENABLE_FORMULAS docling True -
DOCLING_ENABLE_CODE_BLOCKS docling True -
DOCLING_CHUNK_SIZE docling 512 -
DOCLING_CHUNK_OVERLAP docling 50 -
DOCLING_GPU_SCALE docling -
DOCLING_ENDPOINT docling -
DOCLING_LOCALHOST_PORT docling 18159 Host port for the localhost source variant. URL is derived at compose-render time as http://host.docker.internal:18159.
FAL_SOURCE fal disabled Enables fal.ai as the backend provider for simple media generation routes.
FAL_API_KEY fal fal.ai API key. Required only when FAL_SOURCE=enabled. The backend also exposes it to fal-client as FAL_KEY.
FAL_MODEL fal fal-ai/flux/dev Default fal.ai model endpoint used by the media gateway for text-to-image generation.
FAL_IMAGE_TO_3D_MODEL fal fal-ai/trellis Default fal.ai endpoint id for the media gateway's image_to_3d modality. Must resolve to a verified registry entry (Hunyuan3D / TRELLIS / Tripo / Rodin); TRELLIS is the MIT-licensed default.
FAL_MODEL_LICENSE fal fal/provider-terms License or terms marker returned in normalized media operation responses when provider-specific model licensing is not more specific.
FAL_TIMEOUT_SECONDS fal 120 Finite Backend timeout budget for FAL media submit/poll operations and the compatibility route. Must be greater than zero and at most 3600 seconds.
FAL_OUTPUT_FORMAT fal jpeg Requested output format for compatible fal.ai image models: jpeg or png.
FAL_ENABLE_SAFETY_CHECKER fal True Whether to request the provider-side safety checker for compatible fal.ai image models.
PROJECT_NAME globals atlas Docker Compose project name — the container/volume/network prefix (-…) and docker compose -p namespace. start.sh AND stop.sh read it from here, so stop tears down exactly what start launched. Override with ./start.sh --project <name> (also -p; persists back here) or by editing this value. Set a unique name when running Atlas as a submodule so you don't collide with a base Atlas stack.
BASE_PORT globals 63000 Base port. Every service's *_PORT derives from this + a fixed offset.
HOST_BIND_IP globals Host interface prefix for ALL published service ports. Empty (default) => Docker binds 0.0.0.0 (dev). --profile prod sets this to "127.0.0.1:" so service ports are reachable only from the host (the public edge — Cloudflare Tunnel or Caddy — reaches Kong locally). Must include the trailing colon when set, e.g. "127.0.0.1:".
HOST_GATEWAY_IP globals host-gateway Bootstrapper computes this at runtime based on the runtime (Docker: "host-gateway"; Podman: literal gateway IP). If you copy this file to .env manually without running ./start.sh, set this to "host-gateway" on Linux/macOS Docker, or the real bridge IP on rootless setups.
BRAND_NAME globals Atlas -
BRAND_TAGLINE globals A self-hosted, source-configurable, multi-disciplinary engineering platform — gen-AI, ML, and data. -
BRAND_VERSION globals 0.1.0 -
BRAND_AUTHOR globals Kaveh Razavi -
BRAND_AUTHOR_EMAIL globals kaveh.razavi@gmail.com -
BRAND_LICENSE globals Apache License 2.0 -
BRAND_REPO_URL globals https://github.com/thekaveh/atlas -
BRAND_LOGO_FILE globals Optional path to a custom block-art logo that overrides the built-in ATLAS lockup in the wizard + --no-tui banner (the BRAND_* rebranding contract). File format: the wide-lockup rows, an optional '---' line on its own, then the narrow (compact) fallback rows used on terminals too small for the wide one. Keep it 6 rows tall. Empty = built-in ATLAS. Format + example: docs/quick-start/interactive-setup-wizard.md (Brand Customization).
COMPOSE_PROFILES globals Docker Compose profile activation list. Rebuilt from scratch on every ./start.sh run from the active STT/TTS/doc-processor sources (speaches-cpu/-gpu, parakeet-gpu, chatterbox-gpu, docling-gpu/doc-gpu). Do not edit by hand — the bootstrapper owns this value.
NVIDIA_VISIBLE_DEVICES globals all Host-side GPU visibility. Forwarded into every NVIDIA-runtime container.
PROD_ENV_CPUS globals 2 Default container CPU cap (cores). Per-service overrides below.
PROD_ENV_MEM_LIMIT globals 8g -
PROD_ENV_BACKEND_CPUS globals 1 -
PROD_ENV_BACKEND_MEM_LIMIT globals 2g -
PROD_ENV_N8N_CPUS globals 1 -
PROD_ENV_N8N_MEM_LIMIT globals 2g -
PROD_ENV_COMFYUI_CPUS globals 2 -
PROD_ENV_COMFYUI_MEM_LIMIT globals 4g -
LOG_MAX_SIZE globals 10m Per-container json-file log max size (Docker logging option).
LOG_MAX_FILE globals 3 Per-container json-file log file count (Docker logging option).
BOOTSTRAPPER_PORT_LAYOUT_VERSION globals 3 Sentinel updated by bootstrapper/services/migrations. Missing or PORT, v3 COMFYUI model-set). Fresh .env files are already v3-shaped.
GRAFANA_SOURCE grafana disabled -
GRAFANA_PORT grafana Host port for Grafana's HTTP server (in-container 3000).
GRAFANA_ADMIN_USERNAME grafana admin Grafana admin login. Override in .env if needed.
GRAFANA_ADMIN_PASSWORD grafana Auto-generated on first bootstrap by generate_grafana_admin_password() (mirrors LiteLLM UI_PASSWORD pattern). Persisted to .env; users can rotate by editing .env and restarting.
GRAFANA_ENDPOINT grafana -
GRAFANA_SCALE grafana -
HERMES_SOURCE hermes container -
HERMES_API_PORT hermes Host port for the Hermes Agent OpenAI-compatible API (in-container listen port is 8642).
HERMES_DASHBOARD_PORT hermes Host port for the Hermes Agent web dashboard (in-container listen port is 9119).
HERMES_MEMORY_LIMIT hermes 4g -
HERMES_CPU_LIMIT hermes 2.0 -
HERMES_API_KEY hermes Auto-generated by bootstrapper. Forwarded to LiteLLM via API_SERVER_KEY.
HERMES_DEFAULT_MODEL hermes Empty = hermes-init picks from LiteLLM /v1/models priority list.
HERMES_CONTEXT_LENGTH hermes 65536 -
HERMES_DASHBOARD_ENABLED hermes True -
HERMES_DASHBOARD_TUI hermes 1 Embed PTY-backed Chat tab in dashboard. 1 = on, 0 = read-only.
HERMES_DASHBOARD_INSECURE hermes True Allow the dashboard to bind to its non-loopback container address (0.0.0.0) without a Nous Portal OAuth provider. Required since the upstream image stopped implicitly inferring insecure mode from the bind host; without it the dashboard fails closed and s6 restart-loops it. Safe here: the dashboard binds inside the isolated backend-network and is only reachable via the localhost host-port + Kong. Set to false (and provide HERMES_DASHBOARD_OAUTH_CLIENT_ID) to enforce the OAuth auth gate instead.
HERMES_UID hermes 10000 Container user — match a host UID to read hermes-data from outside.
HERMES_GID hermes 10000 -
HERMES_LOCALHOST_PORT hermes 8642 Host port for the Hermes API in the localhost source variant. Consumed by HERMES_ENDPOINT (in-container clients call this). Defaults to Hermes' native API port.
HERMES_LOCALHOST_DASHBOARD_PORT hermes 9119 Host port for the Hermes web dashboard in the localhost source variant. The Kong route fronting hermes.localhost targets this. Defaults to Hermes' native dashboard port. The wizard's inline textbox edits HERMES_LOCALHOST_PORT (the API); override this via .env hand-edit if your host dashboard runs on a non-default port.
HERMES_INIT_SOURCE hermes container Auto-managed by hermes. Container/disabled.
HERMES_INIT_SCALE hermes -
HERMES_SCALE hermes -
HERMES_ENDPOINT hermes Resolved per HERMES_SOURCE. Consumed by n8n, jupyterhub, LiteLLM model_list; also env-pre-wired for backend + openclaw (not yet exercised).
TTS_INTERNAL_URL hermes -
STT_INTERNAL_URL hermes -
STT_INTERNAL_API_KEY hermes Parakeet bearer token for the rendered server-side STT block; non-secret compatibility placeholder for other enabled STT engines.
COMFYUI_INTERNAL_URL hermes -
SEARXNG_INTERNAL_URL hermes -
LIGHTRAG_INTERNAL_URL hermes -
ICEBERG_REST_SOURCE iceberg-rest disabled -
ICEBERG_REST_PORT iceberg-rest Host port for the Iceberg REST Catalog API (in-container 8181).
ICEBERG_DB_USER iceberg-rest iceberg -
ICEBERG_DB_PASSWORD iceberg-rest Auto-generated by bootstrapper. Postgres role for the Iceberg JDBC catalog DB.
ICEBERG_REST_POSTGRES_JDBC_VERSION iceberg-rest 42.7.12 PostgreSQL JDBC driver version layered into the local Iceberg REST image build.
ICEBERG_REST_POSTGRES_JDBC_SHA512 iceberg-rest 3759e7160591863e5100361298943df94488a6e4ee03936d20723638142fe8038c9a6a47fa8ee7e424f4ef09bb351edc89dfe2ae4acdfc0f92699a8b00196c5c SHA-512 digest required for the PostgreSQL JDBC driver selected above. Update both values together.
ICEBERG_REST_SCALE iceberg-rest -
ICEBERG_REST_INIT_SCALE iceberg-rest -
JENKINS_SOURCE jenkins disabled -
JENKINS_PORT jenkins Host port for the Jenkins Web UI (in-container 8080).
JENKINS_SCALE jenkins -
JENKINS_ADMIN_USER jenkins admin Jenkins admin login created by JCasC.
JENKINS_ADMIN_PASSWORD jenkins Auto-generated on first bootstrap by KeyGenerator.generate_jenkins_admin_password().
JENKINS_MEMORY_LIMIT jenkins 3g Container memory limit for Jenkins controller and local Maven builds.
JENKINS_CPU_LIMIT jenkins 2.0 Container CPU limit for Jenkins controller and local Maven builds.
JUPYTERHUB_SOURCE jupyterhub container -
JUPYTERHUB_PORT jupyterhub -
JUPYTERHUB_TOKEN jupyterhub Optional. Empty = generate on start.
JUPYTER_ALLOW_ORIGIN jupyterhub * Allowed browser origin for Jupyter Server websocket upgrades; keep '*' for local dev, narrow for shared deployments.
SPARK_REMOTE jupyterhub sc://spark-connect:15002 Spark Connect endpoint used by bundled notebooks; override for a remote or managed Spark Connect server.
MCP_SERVERS_URL jupyterhub Streamable HTTP URL for the Curated MCP Servers endpoint (http://mcp-servers:8000/mcp). Set by the bootstrapper when MCP_SERVERS_SOURCE is enabled; empty when disabled (#600).
JUPYTERHUB_SCALE jupyterhub -
KONG_API_GATEWAY_SOURCE kong container Single-option (container only).
KONG_HTTP_PORT kong -
KONG_HTTPS_PORT kong -
DASHBOARD_USERNAME kong kong_admin -
DASHBOARD_PASSWORD kong kong_password Auto-generated on first ./start.sh when left at the placeholder (rotate-when-absent, like MINIO_ROOT_PASSWORD). Gates the Kong-routed Studio dashboard via basic-auth.
LABEL_STUDIO_SOURCE label-studio disabled -
LABEL_STUDIO_PORT label-studio Host port for the Label Studio UI/API (in-container 8080).
LABEL_STUDIO_ENDPOINT label-studio In-network URL for Atlas services and notebooks.
LABEL_STUDIO_API_URL label-studio Notebook/backend API URL; empty when Label Studio is disabled.
LABEL_STUDIO_SCALE label-studio -
LABEL_STUDIO_INIT_SCALE label-studio -
LABEL_STUDIO_DB_NAME label-studio label_studio -
LABEL_STUDIO_DB_USER label-studio label_studio -
LABEL_STUDIO_DB_PASSWORD label-studio Auto-generated Postgres password for the dedicated Label Studio database role.
LABEL_STUDIO_USERNAME label-studio admin@atlas.local Initial Label Studio admin email passed to upstream USERNAME.
LABEL_STUDIO_PASSWORD label-studio Auto-generated initial Label Studio admin password.
LABEL_STUDIO_USER_TOKEN label-studio Auto-generated legacy API token for notebook/API smoke paths.
LABEL_STUDIO_SECRET_KEY label-studio Django SECRET_KEY used by the Label Studio container.
LANGFUSE_SOURCE langfuse disabled -
LANGFUSE_PORT langfuse Host port for the Langfuse web UI/API (in-container 3000).
LANGFUSE_ENDPOINT langfuse In-network URL used by LiteLLM when Langfuse tracing is enabled.
LANGFUSE_WEB_SCALE langfuse -
LANGFUSE_WORKER_SCALE langfuse -
LANGFUSE_CLICKHOUSE_SCALE langfuse -
LANGFUSE_INIT_SCALE langfuse -
LANGFUSE_DB_NAME langfuse langfuse -
LANGFUSE_SALT langfuse Auto-generated by the bootstrapper on first run.
LANGFUSE_ENCRYPTION_KEY langfuse 64 hex chars. Auto-generated by the bootstrapper on first run.
LANGFUSE_NEXTAUTH_SECRET langfuse Auto-generated by the bootstrapper on first run.
LANGFUSE_PUBLIC_KEY langfuse Initial Langfuse project public key used by LiteLLM tracing.
LANGFUSE_SECRET_KEY langfuse Initial Langfuse project secret key used by LiteLLM tracing.
LANGFUSE_INIT_ORG_ID langfuse atlas -
LANGFUSE_INIT_ORG_NAME langfuse Atlas -
LANGFUSE_INIT_PROJECT_ID langfuse atlas-default -
LANGFUSE_INIT_PROJECT_NAME langfuse Atlas Default -
LANGFUSE_INIT_USER_EMAIL langfuse admin@atlas.localhost -
LANGFUSE_INIT_USER_NAME langfuse Atlas Admin -
LANGFUSE_INIT_USER_PASSWORD langfuse Auto-generated by the bootstrapper on first run.
LANGFUSE_CLICKHOUSE_USER langfuse clickhouse -
LANGFUSE_CLICKHOUSE_PASSWORD langfuse Auto-generated by the bootstrapper on first run.
LIGHTRAG_SOURCE lightrag disabled -
LIGHTRAG_API_PORT lightrag Host port for LightRAG (in-container 9621).
LIGHTRAG_LOCALHOST_PORT lightrag 63068 Host port for the localhost source variant.
LIGHTRAG_API_KEY lightrag Auto-generated bearer key. Forwarded to LiteLLM as the model api_key.
LIGHTRAG_TOKEN_SECRET lightrag Auto-generated JWT signing key for LightRAG's /login endpoint. Without this, LightRAG falls back to a hardcoded default key (security risk).
LIGHTRAG_WORKERS lightrag 2 -
LIGHTRAG_MEMORY_LIMIT lightrag 6g -
LIGHTRAG_CPU_LIMIT lightrag 2.0 -
LIGHTRAG_LLM_BINDING lightrag openai -
LIGHTRAG_LLM_BINDING_HOST lightrag http://litellm:4000/v1 -
LIGHTRAG_LLM_MODEL lightrag Empty = lightrag-init resolves from LITELLM_DEFAULT_MODEL.
LIGHTRAG_EXTRACT_LLM_MODEL lightrag Optional LightRAG EXTRACT role model. Empty = inherit LLM_MODEL.
LIGHTRAG_KEYWORD_LLM_MODEL lightrag Optional LightRAG KEYWORD role model. Empty = inherit LLM_MODEL.
LIGHTRAG_QUERY_LLM_MODEL lightrag Optional LightRAG QUERY role model. Empty = inherit LLM_MODEL.
LIGHTRAG_EXTRACT_LLM_BINDING lightrag Optional EXTRACT role provider binding. Empty = inherit LLM_BINDING.
LIGHTRAG_KEYWORD_LLM_BINDING lightrag Optional KEYWORD role provider binding. Empty = inherit LLM_BINDING.
LIGHTRAG_QUERY_LLM_BINDING lightrag Optional QUERY role provider binding. Empty = inherit LLM_BINDING.
LIGHTRAG_EXTRACT_LLM_BINDING_HOST lightrag Optional EXTRACT role provider endpoint. Empty = inherit LLM_BINDING_HOST.
LIGHTRAG_KEYWORD_LLM_BINDING_HOST lightrag Optional KEYWORD role provider endpoint. Empty = inherit LLM_BINDING_HOST.
LIGHTRAG_QUERY_LLM_BINDING_HOST lightrag Optional QUERY role provider endpoint. Empty = inherit LLM_BINDING_HOST.
LIGHTRAG_EXTRACT_LLM_BINDING_API_KEY lightrag Optional EXTRACT role provider API key. Empty = inherit LLM_BINDING_API_KEY for same-provider roles.
LIGHTRAG_KEYWORD_LLM_BINDING_API_KEY lightrag Optional KEYWORD role provider API key. Empty = defaults to ${LITELLM_MASTER_KEY} at compose (#721) so LiteLLM-routed roles need no key wiring.
LIGHTRAG_QUERY_LLM_BINDING_API_KEY lightrag Optional QUERY role provider API key. Empty = defaults to ${LITELLM_MASTER_KEY} at compose (#721) so LiteLLM-routed roles need no key wiring.
LIGHTRAG_EXTRACT_MAX_ASYNC_LLM lightrag Optional EXTRACT role LLM concurrency. Empty = inherit MAX_ASYNC_LLM.
LIGHTRAG_KEYWORD_MAX_ASYNC_LLM lightrag Optional KEYWORD role LLM concurrency. Empty = inherit MAX_ASYNC_LLM.
LIGHTRAG_QUERY_MAX_ASYNC_LLM lightrag Optional QUERY role LLM concurrency. Empty = inherit MAX_ASYNC_LLM.
LIGHTRAG_EXTRACT_LLM_TIMEOUT lightrag Optional EXTRACT role LLM timeout in seconds. Empty = inherit LLM_TIMEOUT.
LIGHTRAG_KEYWORD_LLM_TIMEOUT lightrag Optional KEYWORD role LLM timeout in seconds. Empty = inherit LLM_TIMEOUT.
LIGHTRAG_QUERY_LLM_TIMEOUT lightrag Optional QUERY role LLM timeout in seconds. Empty = inherit LLM_TIMEOUT.
LIGHTRAG_QUERY_ENABLE_RERANK lightrag false LightRAG query default for reranking. Atlas keeps this false by default because direct LightRAG→TEI rerank payloads are incompatible without an adapter.
LIGHTRAG_QUERY_TOP_K lightrag 10 LightRAG query TOP_K. Atlas defaults this to a concrete integer because LightRAG v1.5.4 crashes when this env var is present but empty.
LIGHTRAG_QUERY_CHUNK_TOP_K lightrag 5 LightRAG query CHUNK_TOP_K. Atlas defaults this to a concrete integer because LightRAG v1.5.4 crashes when this env var is present but empty.
LIGHTRAG_QUERY_MAX_TOTAL_TOKENS lightrag 12000 LightRAG query MAX_TOTAL_TOKENS. Atlas defaults this to a concrete integer because LightRAG v1.5.4 crashes when this env var is present but empty.
LIGHTRAG_EMBEDDING_BINDING lightrag openai -
LIGHTRAG_EMBEDDING_BINDING_HOST lightrag http://litellm:4000/v1 -
LIGHTRAG_EMBEDDING_MODEL lightrag Empty = lightrag-init resolves from LITELLM_EMBEDDING_MODEL.
LIGHTRAG_EMBEDDING_DIM lightrag Empty = auto (lightrag-init probes the embedding model's true dimension). Set ONLY to force a value — a wrong dim writes a mismatched PGVector index and every insert fails.
LIGHTRAG_VLM_PROCESS_ENABLE lightrag true -
LIGHTRAG_KV_STORAGE lightrag RedisKVStorage -
LIGHTRAG_VECTOR_STORAGE lightrag PGVectorStorage -
LIGHTRAG_GRAPH_STORAGE lightrag Neo4JStorage -
LIGHTRAG_DOC_STATUS_STORAGE lightrag RedisDocStatusStorage -
LIGHTRAG_SCALE lightrag -
LIGHTRAG_INIT_SCALE lightrag -
LIGHTRAG_ENDPOINT lightrag Consumed by hermes/n8n/backend runtime_adaptive and LiteLLM model_list.
LIGHTRAG_RERANK_BINDING_HOST lightrag -
LIGHTRAG_RERANK_BINDING lightrag Always null by default. Direct LightRAG→TEI rerank payloads are incompatible without an adapter, and LightRAG crashes on an empty value.
LIGHTRAG_DOCLING_ENDPOINT lightrag -
LIGHTRAG_PG_URI lightrag -
LIGHTRAG_NEO4J_URI lightrag -
LIGHTRAG_NEO4J_USERNAME lightrag -
LIGHTRAG_NEO4J_PASSWORD lightrag -
LIGHTRAG_REDIS_URI lightrag -
LITELLM_SOURCE litellm container Locked. LiteLLM is mandatory; only one source value supported.
LITELLM_PORT litellm -
LITELLM_INIT_SCALE litellm 1 Init container always runs (single value).
LITELLM_MASTER_KEY litellm Auto-generated by bootstrapper on first run. Doubles as the admin-dashboard password.
LITELLM_UI_USERNAME litellm admin Admin-dashboard login username at http://litellm.localhost:${KONG_HTTP_PORT}/ui/. Password is LITELLM_MASTER_KEY.
LITELLM_CACHE_TTL litellm 3600 Lifetime in seconds of a cached LiteLLM response. The gateway caches completions/embeddings in Redis; LiteLLM's own fallback is 60s, which is too short to pay off on anything but rapid-fire identical prompts. Raise for heavier reuse, lower if stale answers matter more than the saving. A non-numeric or non-positive value falls back to 3600 rather than failing the render.
LITELLM_CACHE_NAMESPACE litellm litellm.cache Key prefix for LiteLLM's Redis response cache. Redis db 0 is shared with n8n's BullMQ queue, Kong's rate-limit counters, Langfuse's queue and the backend's media store, so a namespace keeps gateway cache keys scannable and separately droppable.
LITELLM_DB_NAME litellm litellm -
LITELLM_EMBEDDING_MODEL litellm ollama/nomic-embed-text Default embedding model used by weaviate-init when computing collection vectorizers.
LITELLM_DEFAULT_MODEL litellm Optional default chat model passed to LangMem (backend).
LITELLM_VISION_MODEL litellm Default vision-capable model (resolved from the model catalog; forward-looking — no consumer routes on it yet).
LITELLM_BASE_URL litellm http://litellm:4000 In-network URL consumers point at (backend, n8n, jupyterhub, open-webui).
LLM_GRAPH_BUILDER_SOURCE llm-graph-builder disabled -
LLM_GRAPH_BUILDER_REF llm-graph-builder 4a412f4688cf4096976045c019edc0a7f6ddcb6b Pinned upstream neo4j-labs/llm-graph-builder git ref used by the source-build containers.
LLM_GRAPH_BUILDER_PORT llm-graph-builder Host port for the Graph Builder frontend (in-container 8080).
LLM_GRAPH_BUILDER_MODEL_ID llm-graph-builder atlas_litellm Model id shown in the Graph Builder UI. Atlas maps this id to LiteLLM's OpenAI-compatible endpoint.
LLM_GRAPH_BUILDER_LLM_MODEL llm-graph-builder LiteLLM model alias used behind atlas_litellm. Empty = use LITELLM_DEFAULT_MODEL.
LLM_GRAPH_BUILDER_NEO4J_DATABASE llm-graph-builder neo4j Neo4j database name for Graph Builder data. Use a dedicated database on editions that support it.
LLM_GRAPH_BUILDER_DIFFBOT_API_KEY llm-graph-builder Optional Diffbot API key for upstream Diffbot extraction/model features. Atlas' default LiteLLM path does not require it.
LLM_GRAPH_BUILDER_GCP_LOG_METRICS_ENABLED llm-graph-builder False Enable the upstream Google Cloud logging integration. Requires project id and an ADC credential file.
LLM_GRAPH_BUILDER_GCS_FILE_CACHE llm-graph-builder False Store uploaded and failed files in GCS instead of local container storage. Requires the full GCP and bucket configuration.
LLM_GRAPH_BUILDER_GCP_PROJECT_ID llm-graph-builder Google Cloud project id used by optional GCS caching and Cloud logging.
LLM_GRAPH_BUILDER_GCS_UPLOAD_BUCKET llm-graph-builder GCS bucket for uploaded files when LLM_GRAPH_BUILDER_GCS_FILE_CACHE=true.
LLM_GRAPH_BUILDER_GCS_FAILED_BUCKET llm-graph-builder GCS bucket for failed files when LLM_GRAPH_BUILDER_GCS_FILE_CACHE=true.
LLM_GRAPH_BUILDER_GCP_CREDENTIALS_FILE llm-graph-builder Absolute host path to a Google ADC JSON file. Mounted read-only only for the Graph Builder backend.
LLM_GRAPH_BUILDER_REACT_APP_SOURCES llm-graph-builder local,wiki,web Comma-separated upstream source picker values compiled into the frontend.
LLM_GRAPH_BUILDER_CHAT_MODES llm-graph-builder vector,graph_vector,graph,fulltext,graph_vector_fulltext,entity_vector,global_vector Comma-separated chat modes compiled into the frontend.
LLM_GRAPH_BUILDER_TIME_PER_PAGE llm-graph-builder 50 -
LLM_GRAPH_BUILDER_CHUNK_SIZE llm-graph-builder 5242880 -
LLM_GRAPH_BUILDER_LARGE_FILE_SIZE llm-graph-builder 5242880 -
LLM_GRAPH_BUILDER_BATCH_SIZE llm-graph-builder 2 -
LLM_GRAPH_BUILDER_CHUNK_OVERLAP llm-graph-builder 20 -
LLM_GRAPH_BUILDER_TOKENS_PER_CHUNK llm-graph-builder 200 -
LLM_GRAPH_BUILDER_CHUNK_TO_COMBINE llm-graph-builder 1 -
LLM_GRAPH_BUILDER_MAX_TOKEN_CHUNK_SIZE llm-graph-builder 10000 -
LLM_GRAPH_BUILDER_KNN_MIN_SCORE llm-graph-builder 0.94 -
LLM_GRAPH_BUILDER_UPDATE_GRAPH_CHUNKS_PROCESSED llm-graph-builder 20 -
LLM_GRAPH_BUILDER_ENTITY_EMBEDDING llm-graph-builder false -
LLM_GRAPH_BUILDER_ENABLE_USER_AGENT llm-graph-builder true -
LLM_GRAPH_BUILDER_USER_AGENT llm-graph-builder Atlas-LLM-Graph-Builder -
LLM_GRAPH_BUILDER_TRACK_USER_USAGE llm-graph-builder false -
LLM_GRAPH_BUILDER_AUTHENTICATION_REQUIRED llm-graph-builder false -
LLM_GRAPH_BUILDER_BACKEND_SCALE llm-graph-builder -
LLM_GRAPH_BUILDER_FRONTEND_SCALE llm-graph-builder -
LLM_GRAPH_BUILDER_ENDPOINT llm-graph-builder Internal frontend URL.
LLM_GRAPH_BUILDER_BACKEND_ENDPOINT llm-graph-builder Internal backend API URL.
LLM_GRAPH_BUILDER_LITELLM_MODEL_CONFIG llm-graph-builder Model config consumed as LLM_MODEL_CONFIG_ATLAS_LITELLM by the upstream backend.
LOCAL_DEEP_RESEARCHER_SOURCE local-deep-researcher container -
LOCAL_DEEP_RESEARCHER_PORT local-deep-researcher -
LOCAL_DEEP_RESEARCHER_REF local-deep-researcher 38f769f84380f2065de76021ac7c5215f88aa39e Full upstream local-deep-researcher commit SHA materialized into the managed repo volume. Update deliberately after compatibility validation; runtime startup never follows a branch.
LOCAL_DEEP_RESEARCHER_LANGGRAPH_CLI_VERSION local-deep-researcher 0.4.31 Exact langgraph-cli[inmem] version used to serve the pinned source tree.
LOCAL_DEEP_RESEARCHER_UPSTREAM_LOCK_SHA256 local-deep-researcher 26fc35ac377836de6628e5f7b180944c4d4bd50a5e9f0200bd6e663f20e35c1a SHA-256 digest of uv.lock at LOCAL_DEEP_RESEARCHER_REF; startup rejects a source tree whose lock does not match.
LOCAL_DEEP_RESEARCHER_LOOPS local-deep-researcher 3 -
LOCAL_DEEP_RESEARCHER_SEARCH_API local-deep-researcher searxng -
LOCAL_DEEP_RESEARCHER_WORKERS local-deep-researcher 3 -
LOCAL_DEEP_RESEARCHER_FULL_PAGE_MODE local-deep-researcher disabled Full-page extraction mode: disabled, builtin, or crawl4ai. The crawl4ai mode requires CRAWL4AI_SOURCE=container.
FETCH_FULL_PAGE local-deep-researcher -
LOCAL_DEEP_RESEARCHER_SCALE local-deep-researcher -
LOKI_SOURCE loki disabled -
LOKI_SCALE loki -
LOKI_ENDPOINT loki Internal Loki API endpoint consumed by Grafana.
LOKI_RETENTION_PERIOD loki 24h Short local retention period for Loki compactor-managed log deletion.
MCP_SERVERS_SOURCE mcp-servers disabled Curated MCP package source. Disabled by default because MCP tools can reach stack internals.
MCP_SERVERS_PORT mcp-servers Host port for the curated MCP Streamable HTTP endpoint (container port 8000).
MCP_SERVERS_SCALE mcp-servers Replicas: 1 when MCP_SERVERS_SOURCE=container, else 0.
MCP_POSTGRES_MAX_ROWS mcp-servers 50 Maximum rows returned by the Postgres MCP query tool.
MCP_NEO4J_MAX_ROWS mcp-servers Maximum rows returned by the Neo4j MCP query tool. Empty falls back to MCP_POSTGRES_MAX_ROWS (default 50).
MCP_SEARXNG_MAX_RESULTS mcp-servers 5 Maximum SearXNG results returned by the web-search MCP tool.
MCP_TOOL_TIMEOUT_SECONDS mcp-servers 15 Timeout for upstream database/search calls made by MCP tools.
MINIO_SOURCE minio container -
MINIO_PORT minio Host port for the MinIO S3 API (in-container listen port is 9000).
MINIO_CONSOLE_PORT minio Host port for the MinIO admin console (in-container listen port is 9001).
MINIO_ROOT_USER minio minioadmin -
MINIO_ROOT_PASSWORD minio Auto-generated by bootstrapper KeyGenerator.generate_minio_root_password().
MINIO_REGION minio us-east-1 -
MINIO_INIT_SOURCE minio container Auto-managed by minio. Container/disabled.
MINIO_SCALE minio -
MINIO_INIT_SCALE minio -
MINIO_ENDPOINT minio In-network URL (S3 API).
MINIO_PUBLIC_ENDPOINT minio Host-side URL (for browser redirects).
MINIO_PUBLIC_CONSOLE_ENDPOINT minio -
MINIO_EXTRA_CONSUMERS minio Optional space-separated parent-owned MinIO entries using CONSUMER:BUCKET_VAR:ACCESS_VAR:SECRET_VAR[:RW_BUCKET_VAR,...[:RO_BUCKET_VAR,...]] grammar for services/_user overlays.
MINIO_BUCKET_ASSET_INPUTS minio raw-assets Shared input bucket for the Asset Worker and Asset Baker scoped service accounts.
MINIO_ASSET_INGEST_ACCESS_KEY minio Auto-generated scoped MinIO access key for writing shared raw asset inputs.
MINIO_ASSET_INGEST_SECRET_KEY minio Auto-generated scoped MinIO secret key for writing shared raw asset inputs.
MINIO_ASSET_WORKER_ACCESS_KEY minio Auto-generated scoped MinIO access key for Asset Worker input and output buckets.
MINIO_ASSET_WORKER_SECRET_KEY minio Auto-generated scoped MinIO secret key for Asset Worker input and output buckets.
MINIO_ASSET_BAKER_ACCESS_KEY minio Auto-generated scoped MinIO access key for Asset Baker input and output buckets.
MINIO_ASSET_BAKER_SECRET_KEY minio Auto-generated scoped MinIO secret key for Asset Baker input and output buckets.
MINIO_BUCKET_COMFYUI minio comfyui -
MINIO_COMFYUI_ACCESS_KEY minio Auto-generated scoped MinIO access key for the comfyui bucket.
MINIO_COMFYUI_SECRET_KEY minio Auto-generated scoped MinIO secret key for the comfyui bucket.
MINIO_BUCKET_BACKEND minio backend -
MINIO_BACKEND_ACCESS_KEY minio Auto-generated scoped MinIO access key for the backend bucket.
MINIO_BACKEND_SECRET_KEY minio Auto-generated scoped MinIO secret key for the backend bucket.
MINIO_BUCKET_N8N minio n8n -
MINIO_N8N_ACCESS_KEY minio Auto-generated scoped MinIO access key for the n8n bucket.
MINIO_N8N_SECRET_KEY minio Auto-generated scoped MinIO secret key for the n8n bucket.
MINIO_BUCKET_JUPYTER minio jupyter -
MINIO_JUPYTER_ACCESS_KEY minio Auto-generated scoped MinIO access key for the jupyter bucket.
MINIO_JUPYTER_SECRET_KEY minio Auto-generated scoped MinIO secret key for the jupyter bucket.
MINIO_BUCKET_SPARK_HISTORY minio spark-history Spark event-log bucket used by Zeppelin and the Spark History Server.
MINIO_SPARK_ACCESS_KEY minio Auto-generated scoped MinIO access key for Spark event logs and lakehouse workflow buckets.
MINIO_SPARK_SECRET_KEY minio Auto-generated scoped MinIO secret key for Spark event logs and lakehouse workflow buckets.
MINIO_BUCKET_DOCLING minio docling -
MINIO_DOCLING_ACCESS_KEY minio Auto-generated scoped MinIO access key for the docling bucket.
MINIO_DOCLING_SECRET_KEY minio Auto-generated scoped MinIO secret key for the docling bucket.
MINIO_BUCKET_LANGFUSE minio langfuse -
MINIO_LANGFUSE_ACCESS_KEY minio Auto-generated scoped MinIO access key for the langfuse bucket.
MINIO_LANGFUSE_SECRET_KEY minio Auto-generated scoped MinIO secret key for the langfuse bucket.
MINIO_BUCKET_MLFLOW minio mlflow -
MINIO_MLFLOW_ACCESS_KEY minio Auto-generated scoped MinIO access key for the mlflow bucket.
MINIO_MLFLOW_SECRET_KEY minio Auto-generated scoped MinIO secret key for the mlflow bucket.
MINIO_BUCKET_LABEL_STUDIO minio label-studio -
MINIO_LABEL_STUDIO_ACCESS_KEY minio Auto-generated scoped MinIO access key for the label-studio bucket.
MINIO_LABEL_STUDIO_SECRET_KEY minio Auto-generated scoped MinIO secret key for the label-studio bucket.
MINIO_BUCKET_ICEBERG_LAKEHOUSE minio lakehouse -
MINIO_BUCKET_ICEBERG_JARS minio jars -
MINIO_BUCKET_ICEBERG_CHECKPOINTS minio checkpoints -
MINIO_BUCKET_ICEBERG_LANDING minio landing -
MINIO_ICEBERG_ACCESS_KEY minio Auto-generated scoped MinIO access key for the Iceberg lakehouse buckets.
MINIO_ICEBERG_SECRET_KEY minio Auto-generated scoped MinIO secret key for the Iceberg lakehouse buckets.
MLFLOW_SOURCE mlflow disabled -
MLFLOW_PORT mlflow Host port for the MLflow UI/API (in-container 5000).
MLFLOW_ENDPOINT mlflow In-network URL for Atlas services and notebooks.
MLFLOW_TRACKING_URI mlflow Tracking URI injected into JupyterHub when MLflow is enabled.
MLFLOW_SCALE mlflow -
MLFLOW_INIT_SCALE mlflow -
MLFLOW_DB_NAME mlflow mlflow -
MLFLOW_DB_USER mlflow mlflow -
MLFLOW_DB_PASSWORD mlflow Auto-generated Postgres password for the dedicated MLflow database role.
N8N_SOURCE n8n container -
N8N_PORT n8n -
N8N_ENCRYPTION_KEY n8n your-random-encryption-key Encryption key for n8n credentials and workflow secrets; auto-generated by the bootstrapper when left as the placeholder.
N8N_API_KEY n8n n8n public-API key (n8n CE issues these only via the UI: Settings → n8n API). Consumed by the backend's /workflows endpoints; while empty those endpoints currently return backend errors from failed upstream n8n calls.
N8N_HOST n8n n8n.localhost -
N8N_PROTOCOL n8n http -
N8N_EXECUTIONS_MODE n8n queue -
N8N_INIT_SOURCE n8n container -
N8N_INIT_NODES n8n n8n-nodes-comfyui@0.0.9,@ksc1234/n8n-nodes-comfyui-image-to-image@1.0.2 Exact community package specs installed before n8n starts. Atlas' default ComfyUI set uses the committed package-lock; n8n 2.28.2 already supplies first-party MCP nodes. Custom values must use name@x.y.z for every comma-separated package.
N8N_SEED_HTTP_TIMEOUT_MS n8n 10000 Absolute deadline in milliseconds for each consumer workflow seeder HTTP operation; must be positive.
N8N_SEED_COMMAND_TIMEOUT_MS n8n 120000 Deadline in milliseconds for each consumer workflow n8n CLI operation; must be positive.
N8N_SEED_MAX_RESPONSE_BYTES n8n 1048576 Maximum bytes accepted from one consumer workflow seeder HTTP response; must be positive.
N8N_SCALE n8n -
N8N_WORKER_SCALE n8n -
N8N_INIT_SCALE n8n -
NEO4J_GRAPH_DB_SOURCE neo4j container Neo4j deployment source. Drives NEO4J_SCALE and NEO4J_URI.
GRAPH_DB_PORT neo4j Host port for Neo4j bolt (container port 7687).
GRAPH_DB_DASHBOARD_PORT neo4j Host port for Neo4j browser dashboard (container port 7474).
GRAPH_DB_USER neo4j neo4j -
GRAPH_DB_PASSWORD neo4j neo4j_password Neo4j password; auto-generated by the bootstrapper when left as the placeholder.
GRAPH_DB_AUTH neo4j neo4j/neo4j_password Neo4j auth in username/password format.
NEO4J_URI neo4j Computed from NEO4J_GRAPH_DB_SOURCE. Read by backend/jupyterhub.
NEO4J_SCALE neo4j Replicas: 1 for container, 0 otherwise.
NEO4J_LOCALHOST_HTTP_PORT neo4j 7474 Host HTTP port for the neo4j-localhost source variant (browser UI + REST). Kong route target is derived as http://host.docker.internal:7474.
NEO4J_LOCALHOST_BOLT_PORT neo4j 7687 Host Bolt port for the neo4j-localhost source variant (driver protocol). NEO4J_URI is derived as bolt://host.docker.internal:7687. The wizard's inline-textbox edits THIS port (HTTP is overridable via .env hand-edit).
NEO4J_MEMORY_LIMIT neo4j 2g Container memory limit for neo4j-graph-db (deploy.resources.limits.memory). 2 g is conservative for a 32 GB host; Neo4j keeps hot nodes in a heap-based page cache that typically stays well under 2 g for single-node dev/staging workloads.
NEO4J_CPU_LIMIT neo4j 1.5 Container CPU limit for neo4j-graph-db (deploy.resources.limits.cpus). 1.5 cores is sufficient for single-node Bolt + HTTP query serving.
LLM_PROVIDER_SOURCE ollama ollama-container-cpu -
OLLAMA_USER_MODELS ollama Comma-separated Ollama model names to activate/pull. Pre-filled by env_assembler from the catalog's default-active Ollama set (see services/ollama/models.yaml); the wizard overwrites it with the user's selection.
OLLAMA_CUSTOM_MODELS ollama Free-text extra Ollama models (consumer model_sidecars.ollama lands here). Pulled by the ollama-pull init container for container-* sources and by the bootstrapper onto the host daemon for ollama-localhost (#757).
OLLAMA_AUTO_IMPORT_LOCAL_MODELS ollama True When LLM_PROVIDER_SOURCE=ollama-localhost, litellm-init queries the upstream's /api/tags and auto-imports every model found, unioning with OLLAMA_USER_MODELS. Set false to keep strict wizard-only control.
OLLAMA_DEPLOY_RESOURCES ollama ~ Reserved for future GPU deploy block. Currently '~' (null).
OLLAMA_SCALE ollama -
OLLAMA_PULL_SCALE ollama -
OLLAMA_NVIDIA_VISIBLE_DEVICES ollama -
OLLAMA_ENDPOINT ollama -
LITELLM_OLLAMA_UPSTREAM ollama Ollama URL the LiteLLM gateway forwards Ollama-routed requests to. Owned by ollama because the value flips with LLM_PROVIDER_SOURCE; consumed by litellm-init when rendering its config.yaml.
OLLAMA_LOCALHOST_PORT ollama 11434 Host port for the ollama-localhost source variant. URL is derived at compose-render time as http://host.docker.internal:11434.
OLLAMA_NUM_PARALLEL ollama 8 Ollama parallel request slots per model (OLLAMA_NUM_PARALLEL). Multi-agent consumers (8+ concurrent requests) need this >1; Ollama's default of 1 serializes them. Applied to the ollama container-* sources; for ollama-localhost the host daemon owns it (#849).
OLLAMA_MAX_LOADED_MODELS ollama 2 Max models Ollama keeps resident simultaneously (OLLAMA_MAX_LOADED_MODELS). Raise for workloads hot-swapping several models; lower to bound memory. Applied to ollama container-* sources; for ollama-localhost the host daemon owns it (#849).
OLLAMA_KV_CACHE_TYPE ollama q8_0 Quantization of Ollama's in-memory attention KV cache: f16 (Ollama's own default, full precision), q8_0 (~half the KV memory, negligible quality cost) or q4_0 (~quarter, measurable quality cost). Atlas defaults to q8_0 because KV memory is the dominant per-slot cost and unified-memory hosts run several resident models at once. Applies only to the ollama container-* sources; for ollama-localhost the host daemon owns it. NOTE: quantization takes effect only when flash attention is active — see OLLAMA_FLASH_ATTENTION.
OLLAMA_FLASH_ATTENTION ollama 1 Enables Ollama's flash-attention path. Current Ollama versions turn this on automatically wherever the backend and device support it; it is pinned here because OLLAMA_KV_CACHE_TYPE quantization is a NO-OP without it, and a silently-inactive memory setting is worse than an absent one. Set 0 to force it off.
OLLAMA_KEEP_ALIVE ollama How long Ollama keeps a model resident after its last use (e.g. 5m, 1h, or -1 for forever). Empty uses Ollama's own default of 5m. Applies to the ollama container-* sources; for ollama-localhost the host daemon owns it. Raising this stops a multi-model ingest evicting its own working set between calls, but -1 pins EVERY loaded model in RAM until reverted and the daemon is restarted -- on a large model-set that is tens of GB (#798).
OLLAMA_MODELS_RESIDENT_MIN ollama How many models a workload needs resident at once. Advisory only, and only meaningful for ollama-localhost, where Atlas cannot own the host daemon: ./start.sh doctor compares it against the daemon's OLLAMA_MAX_LOADED_MODELS and warns when a run would evict and reload its own models between calls. Empty (default) means no expectation is declared. Set it to the number of distinct models one ingest touches -- a LightRAG run using separate extract/embed/keyword models needs 3 (#798).
OLLAMA_PARALLEL_MIN ollama Concurrent-request floor a consumer needs from Ollama. Advisory only, and only meaningful for ollama-localhost, where Atlas cannot own the host daemon: ./start.sh doctor reads the daemon's OLLAMA_NUM_PARALLEL and warns when it is below this, with launchctl guidance. Empty (default) means no expectation is declared. Ollama's own default is 1 slot, which silently SERIALIZES a multi-agent consumer rather than failing, so an unnoticed default is what this exists to catch (#849).
OPEN_WEB_UI_SOURCE open-webui container -
OPEN_WEB_UI_STT_API_KEY open-webui Parakeet bearer token when a Parakeet source is selected; a non-secret compatibility placeholder for other enabled STT engines.
OPEN_WEB_UI_PORT open-webui -
OPEN_WEB_UI_SECRET_KEY open-webui secret Open WebUI session/signing secret; auto-generated by the bootstrapper when left as the placeholder.
OPEN_WEB_UI_ADMIN_EMAIL open-webui admin@localhost -
OPEN_WEB_UI_ADMIN_PASSWORD open-webui admin Initial Open WebUI admin password; auto-generated by the bootstrapper when left as the placeholder.
OPEN_WEB_UI_ADMIN_NAME open-webui Admin -
OPEN_WEB_UI_WEBSOCKET_SUPPORT open-webui True -
OPEN_WEB_UI_REDIS_DB open-webui 2 -
OPEN_WEB_UI_MODEL_CACHE_TTL open-webui 300 -
OPEN_WEB_UI_TTS_ENGINE open-webui Set by bootstrapper when speaches/chatterbox are enabled.
OPEN_WEB_UI_STT_ENGINE open-webui -
OPEN_WEB_UI_TTS_MODEL open-webui Model name Open WebUI sends to /v1/audio/speech. Empty = engine default.
OPEN_WEB_UI_TTS_VOICE open-webui Voice id. Empty = engine default.
OPEN_WEB_UI_TTS_API_URL open-webui -
OPEN_WEB_UI_STT_API_URL open-webui -
OPEN_WEB_UI_SCALE open-webui -
OPEN_WEB_UI_INIT_SCALE open-webui -
OPENCLAW_SOURCE openclaw disabled -
OPENCLAW_GATEWAY_PORT openclaw -
OPENCLAW_BRIDGE_PORT openclaw -
OPENCLAW_GATEWAY_TOKEN openclaw Optional bearer token for securing the OpenClaw gateway and dashboard.
OPENCLAW_LOCALHOST_PORT openclaw 63065 Host port for the localhost source variant (defaults to the freed OPENCLAW_GATEWAY_PORT slot). URL is derived at compose-render time as http://host.docker.internal:63065.
OPENCLAW_INIT_SOURCE openclaw container -
OPENCLAW_ANTHROPIC_API_KEY openclaw Optional per-OpenClaw Anthropic override.
OPENCLAW_OPENAI_API_KEY openclaw Optional per-OpenClaw OpenAI override. Leave empty to keep OpenClaw routed through LiteLLM instead of bypassing the stack gateway.
OPENCLAW_SCALE openclaw -
OPENCLAW_INIT_SCALE openclaw -
OPENCLAW_ENDPOINT openclaw Resolved per-source by the bootstrapper (container DNS / host.docker.internal / empty when disabled). Forward-looking hook: no compose fragment injects it into a container today — consumers (e.g. n8n workflows) would read it via their own env wiring when that lands.
OTEL_COLLECTOR_SOURCE otel-collector disabled -
OTEL_COLLECTOR_SCALE otel-collector -
OTEL_COLLECTOR_ENDPOINT otel-collector Preferred internal OTLP HTTP endpoint for Atlas services.
OTEL_COLLECTOR_OTLP_HTTP_ENDPOINT otel-collector Internal OTLP HTTP endpoint (http://otel-collector:4318) when enabled.
OTEL_COLLECTOR_OTLP_GRPC_ENDPOINT otel-collector Internal OTLP gRPC endpoint (http://otel-collector:4317) when enabled.
ATLAS_OTEL_ENABLED otel-collector Boolean string consumed by backend and LiteLLM tracing toggles.
STT_PROVIDER_SOURCE parakeet speaches-container-cpu -
STT_PROVIDER_PORT parakeet Wizard display slot. Real per-engine ports live on their own manifests (PARAKEET_, SPEACHES_, etc.).
STT_PROVIDER_SCALE parakeet Aggregate STT scale across all engines. Reserved for future use.
PARAKEET_MODEL parakeet nvidia/parakeet-tdt-0.6b-v3 -
PARAKEET_GPU_DEVICE parakeet cuda -
PARAKEET_MAX_UPLOAD_BYTES parakeet 104857600 Positive maximum audio upload bytes for Parakeet GPU and localhost APIs. Request bodies are capped before multipart parsing with 1 MiB framing overhead; invalid values fail startup and oversized requests return 413.
PARAKEET_UPLOAD_TIMEOUT_SECONDS parakeet 120 Total seconds (1-3600) allowed to receive one Parakeet upload body before a 408 response releases admission capacity.
PARAKEET_CONCURRENCY parakeet 1 Maximum concurrent Parakeet inference calls per provider process. Default 1 prevents model thread-safety and GPU memory contention.
PARAKEET_API_TOKEN parakeet Auto-generated bearer credential required by Parakeet routes except /health.
PARAKEET_AUTH_MODE parakeet required Provider authentication mode: required (default) or disabled for an explicit emergency/local rollback.
PARAKEET_CORS_ORIGINS parakeet Optional comma-separated browser origin allowlist. Empty disables CORS; wildcard is invalid while authentication is required.
PARAKEET_INFERENCE_TIMEOUT_SECONDS parakeet 900 Finite model-load and transcription deadline in seconds (1-3600). A timeout returns 504 and then exits the provider process for restart.
PARAKEET_LOCALHOST_BIND_HOST parakeet 127.0.0.1 Native Parakeet listen address. Set another interface explicitly only when remote access is intended.
PARAKEET_LOCALHOST_PORT parakeet 63042 Host port for the parakeet-localhost source variant. URL is derived at compose-render time as http://host.docker.internal:63042.
WHISPER_CPP_LOCALHOST_PORT parakeet 63042 Host port for the whisper-cpp-localhost source variant, same as parakeet because the two modes are mutually exclusive. URL is derived at compose-render time as http://host.docker.internal:63042.
HUGGING_FACE_HUB_TOKEN parakeet Shared by parakeet, speaches, chatterbox, docling for model downloads. Consumed by ${HUGGING_FACE_HUB_TOKEN} interpolation in those services' compose blocks; owned here as its historic home.
PARAKEET_GPU_SCALE parakeet -
STT_ENDPOINT parakeet Resolved per STT_PROVIDER_SOURCE. Consumed by n8n, backend, jupyterhub, open-webui, hermes-init (the latter as STT_INTERNAL_URL — owned by services/hermes/).
PROMETHEUS_SOURCE prometheus disabled -
PROMETHEUS_PORT prometheus Host port for Prometheus's HTTP UI + API (in-container 9090).
NODE_EXPORTER_PORT prometheus Host port for node-exporter (in-container 9100). Host-level metrics: CPU, memory, disk, network.
CADVISOR_PORT prometheus Host port for cAdvisor (in-container 8080). Per-container metrics: CPU, memory, IO.
PROMETHEUS_RETENTION_DAYS prometheus 7 TSDB retention in days. User-configurable at wizard time via the inline secondary numeric input. Default 7.
PROMETHEUS_ENDPOINT prometheus Resolved per PROMETHEUS_SOURCE — http://prometheus:9090 for container, empty for disabled. Consumed by Grafana's datasource provisioning.
PROMETHEUS_SCALE prometheus -
NODE_EXPORTER_SCALE prometheus -
CADVISOR_SCALE prometheus -
RAY_SOURCE ray disabled -
RAY_DASHBOARD_PORT ray Loopback-only host port for the Ray dashboard + native REST job-submission API (in-container 8265). Use the authenticated Kong route for remote access.
RAY_GCS_PORT ray Loopback-only host port for the Ray GCS (in-container 6379). Distinct from the project's Redis cache container; Ray bundles its own GCS process.
RAY_CLIENT_PORT ray Loopback-only host port for the unauthenticated Ray client server (in-container 10001). Used only by trusted host Python: ray.init('ray://localhost:<port>').
RAY_WORKER_COUNT ray 2 Number of ray-worker replicas. The wizard prompts for this with default 2. Valid values: 0 (head-only mode) and up. No hard upper bound — bounded by host resources.
RAY_HEAD_SCALE ray -
RAY_WORKER_SCALE ray Resolved by the bootstrapper from RAY_WORKER_COUNT when source is ray-container-{cpu,gpu}; 0 otherwise.
RAY_ADDRESS ray Resolved per source: ray://ray-head:10001 for container sources, empty for disabled. Injected into the backend + jupyterhub containers via their compose environment blocks.
RAY_DASHBOARD_URL ray Optional override for the Ray dashboard URL the backend's job client uses. Empty = derive from RAY_ADDRESS (http://ray-head:8265).
RAY_HEAD_MEMORY_LIMIT ray 4g Container memory limit for ray-head (deploy.resources.limits.memory). The head node manages the GCS, dashboard, and object directory; 4 g is conservative but safe on a 32 GB host (the shm_size=8gb allocation is for /dev/shm, separate from this OS memory cap).
RAY_HEAD_CPU_LIMIT ray 2.0 Container CPU limit for ray-head (deploy.resources.limits.cpus). GCS + dashboard coordination rarely needs more than 1 core; 2.0 leaves room for brief spikes.
RAY_WORKER_MEMORY_LIMIT ray 4g Container memory limit per ray-worker (deploy.resources.limits.memory). Workers run tasks and actors; 4 g per replica is a modest OOM fence on a 32 GB host with the default 2 workers. Raise for large in-memory datasets.
RAY_WORKER_CPU_LIMIT ray 2.0 Container CPU limit per ray-worker (deploy.resources.limits.cpus). 2.0 cores per worker. Raise if workers need more parallelism; lower if the host is saturated.
REDIS_SOURCE redis container Single-option source toggle. Redis only ever runs as a container. Kept as an env entry (rather than a sources: block) so the wizard does not render a one-option dropdown. The legacy source validator still expects REDIS_SOURCE=container until Phase D.
REDIS_MAXMEMORY redis 0 Redis memory cap (redis-server --maxmemory), e.g. 512mb. 0 means unlimited, which is the historical behaviour: Redis grows until the CONTAINER is OOM-killed, losing in-flight queue state rather than shedding anything. Setting a cap lets REDIS_MAXMEMORY_POLICY shed recomputable data instead. Recommended for long-running or multi-consumer deployments; size it to roughly 75% of the container's memory budget.
REDIS_MAXMEMORY_POLICY redis volatile-lru Eviction policy once REDIS_MAXMEMORY is reached. volatile-lru evicts only keys carrying a TTL, which on this stack means LiteLLM's response cache — db 0 also holds n8n's BullMQ queue, Kong's counters, Langfuse's queue and the backend's media store, all written WITHOUT a TTL, so they survive. Under the previous noeviction a full instance rejected writes instead, letting an oversized cache take the queue down with it. With nothing volatile left, volatile-lru returns the same OOM error noeviction would.
REDIS_PORT redis Host port. Container port is always 6379.
REDIS_PASSWORD redis redis_password Used by every consumer (n8n queue, kong rate-limit cache, open-webui websocket store, backend session/queue, local-deep- researcher worker queue). The default is for fresh-install convenience only; rotate before any deployment.
REDIS_URL redis redis://:${REDIS_PASSWORD}@redis:6379/0 Default connection string (database index 0; also n8n's queue and Kong's rate-limit cache). Consumers that need a different DB index build their own URL (open-webui + lightrag share /2, jupyterhub uses /3). REDIS_PASSWORD is substituted at compose-interpolation time.
REDIS_EXPORTER_PORT redis Host port for redis-exporter (in-container 9121). Sidecar gated by PROMETHEUS_SOURCE.
REDIS_EXPORTER_SCALE redis Set by _generate_prometheus_config() to 1 when PROMETHEUS_SOURCE=container, 0 otherwise.
REDPANDA_SOURCE redpanda disabled -
REDPANDA_KAFKA_PORT redpanda Host port for the Redpanda Kafka API external listener (in-container 19092).
REDPANDA_CONSOLE_PORT redpanda Host port for Redpanda Console (in-container 8080).
REDPANDA_DEMO_TOPICS redpanda atlas_stream_events Comma-separated Kafka topics created idempotently by redpanda-init.
REDPANDA_SCALE redpanda -
REDPANDA_INIT_SCALE redpanda -
REDPANDA_CONSOLE_SCALE redpanda -
REDPANDA_BROKERS redpanda In-network Kafka bootstrap servers for Atlas services.
SPARK_KAFKA_BOOTSTRAP_SERVERS redpanda Spark Structured Streaming Kafka bootstrap servers; blank when Redpanda is disabled.
SEARXNG_SOURCE searxng container -
SEARXNG_PORT searxng -
SEARXNG_SECRET searxng Auto-generated by bootstrapper.
SEARXNG_SCALE searxng -
SPARK_SOURCE spark disabled -
SPARK_MASTER_UI_PORT spark Host port for the Spark Master Web UI (in-container 8080).
SPARK_HISTORY_PORT spark Host port for the Spark History Server (in-container 18080).
SPARK_WORKER_COUNT spark 2 Number of spark-worker replicas alongside the master. 1-8.
SPARK_MASTER_SCALE spark -
SPARK_WORKER_SCALE spark Resolved by the bootstrapper from SPARK_WORKER_COUNT when source=container; 0 otherwise.
SPARK_HISTORY_SCALE spark -
SPARK_INIT_SCALE spark -
SPARK_CONNECT_SCALE spark Resolved by the bootstrapper from SPARK_SOURCE; spark-connect runs as a sidecar to spark-master.
SPARK_CONNECT_CORES_MAX spark 1 Maximum standalone-cluster cores the long-lived Spark Connect server may hold. Keep below total worker cores so Airflow SparkSubmit and Zeppelin standalone workloads can run alongside Connect; raise only when the worker pool has enough headroom.
SPARK_MASTER_MEMORY_LIMIT spark 2g Container memory limit for spark-master (deploy.resources.limits.memory). The standalone master process manages cluster state and requires minimal heap — 2 g is generous on a 32 GB host.
SPARK_MASTER_CPU_LIMIT spark 1.0 Container CPU limit for spark-master (deploy.resources.limits.cpus). Master is lightweight; 1.0 core is ample.
SPARK_WORKER_MEMORY_LIMIT spark 4g Container memory limit per spark-worker (deploy.resources.limits.memory). Workers run executor JVMs; 4 g per replica is a conservative cap on a 32 GB host with the default 2 workers (8 g total). Raise for memory-intensive jobs.
SPARK_WORKER_CPU_LIMIT spark 2.0 Container CPU limit per spark-worker (deploy.resources.limits.cpus). 2.0 cores per worker leaves headroom for other services on the host.
SPEACHES_GPU_IMAGE speaches ghcr.io/speaches-ai/speaches:0.9.0-rc.3-cuda CUDA build of the same image. When the speaches-gpu profile wins, the bootstrapper writes this value into SPEACHES_IMAGE (the compose interpolation target).
SPEACHES_TTS_MODEL speaches speaches-ai/Kokoro-82M-v1.0-ONNX Model id Open WebUI sends in /v1/audio/speech requests. Must be the Speaches Kokoro ONNX executor id (speaches-ai/Kokoro-82M-v1.0-ONNX); the HuggingFace 'hexgrad/Kokoro-82M' id is invalid for Speaches and 404s (#799).
SPEACHES_STT_MODEL speaches Systran/faster-distil-whisper-large-v3 Reserved STT model knob — currently INERT: PRELOAD_MODELS is a hard-coded literal (not interpolated from this var), so changing it has no effect on what Speaches loads (#799). Open WebUI also hard-codes AUDIO_STT_MODEL: whisper-1, which Speaches aliases to Systran/faster-whisper-large-v3; making STT functional needs the correct preloads + a live-container validation (see #799).
SPEACHES_PORT speaches Host port for the Speaches container (in-container listen port is 8000).
SPEACHES_SCALE speaches Computed by bootstrapper/services/service_config.py::_generate_stt_provider_config (or _generate_tts_provider_config) — set to 1 when STT_PROVIDER_SOURCE OR TTS_PROVIDER_SOURCE picks a speaches-* variant.
SUPABASE_DB_SOURCE supabase container Single-option (container only). Kept for forward-compat with legacy source-validator.
SUPABASE_DB_PORT supabase -
SUPABASE_DB_USER supabase supabase_admin -
SUPABASE_DB_PASSWORD supabase password Supabase postgres admin password; auto-generated by the bootstrapper when left as the placeholder.
SUPABASE_DB_NAME supabase postgres -
SUPABASE_DB_APP_USER supabase app_user Reserved for a future least-privilege application-tier database user; not created by init scripts today.
SUPABASE_DB_APP_PASSWORD supabase app_password Reserved future app-user password; auto-generated by the bootstrapper when left as the placeholder.
SUPABASE_DB_INIT_SOURCE supabase container Auto-managed by supabase-db. Container/disabled.
POSTGRES_EXPORTER_PORT supabase Host port for postgres-exporter (in-container 9187). Sidecar gated by PROMETHEUS_SOURCE.
POSTGRES_EXPORTER_SCALE supabase Set by _generate_prometheus_config() to 1 when PROMETHEUS_SOURCE=container, 0 otherwise.
SUPABASE_META_SOURCE supabase container -
SUPABASE_META_PORT supabase -
SUPABASE_STORAGE_SOURCE supabase container -
SUPABASE_STORAGE_PORT supabase -
STORAGE_REGION supabase local -
STORAGE_FILE_SIZE_LIMIT supabase 52428800 -
STORAGE_BACKEND supabase file -
PROJECT_REF supabase default -
TENANT_ID supabase stub -
SUPABASE_AUTH_SOURCE supabase container -
SUPABASE_AUTH_PORT supabase -
SUPABASE_JWT_SECRET supabase Auto-generated by bootstrapper/generate_supabase_keys.py on first run.
SUPABASE_ANON_KEY supabase Auto-generated.
SUPABASE_SERVICE_KEY supabase Auto-generated.
SUPABASE_API_SOURCE supabase container -
SUPABASE_API_PORT supabase -
SUPABASE_REALTIME_SOURCE supabase container -
SUPABASE_REALTIME_PORT supabase -
SUPABASE_STUDIO_SOURCE supabase container -
SUPABASE_STUDIO_PORT supabase -
SUPAVISOR_SOURCE supavisor disabled Deployment mode: container (transaction pooler) or disabled/direct Postgres.
SUPAVISOR_SCALE supavisor 1 when SUPAVISOR_SOURCE=container, otherwise 0.
SUPAVISOR_TENANT_ID supavisor atlas Supavisor tenant suffix. Clients connect as ..
SUPAVISOR_DEFAULT_POOL_SIZE supavisor 20 Default upstream Postgres pool size for the Atlas tenant.
SUPAVISOR_MAX_CLIENT_CONN supavisor 100 Maximum client connections accepted by the Atlas tenant.
SUPAVISOR_DB_POOL_SIZE supavisor 5 Supavisor metadata database pool size.
SUPAVISOR_DATABASE_URL supavisor Generated Postgres URL consumed by backend/Celery; points at Supavisor when enabled and direct Supabase Postgres when disabled.
SUPAVISOR_DB_HOST supavisor Generated n8n Postgres host; supavisor when enabled, supabase-db when disabled.
SUPAVISOR_DB_PORT_VALUE supavisor Generated n8n Postgres port; 6543 when enabled, 5432 when disabled.
SUPAVISOR_DB_USER supavisor Generated n8n Postgres user; appends .${SUPAVISOR_TENANT_ID} when Supavisor is enabled.
SUPAVISOR_SECRET_KEY_BASE supavisor Supavisor Phoenix secret; auto-generated by the bootstrapper when blank.
SUPAVISOR_VAULT_ENC_KEY supavisor Supavisor vault encryption key; must be exactly 32 bytes and is auto-generated when blank.
SUPAVISOR_API_JWT_SECRET supavisor Supavisor tenant API JWT secret; auto-generated by the bootstrapper when blank.
SUPAVISOR_METRICS_JWT_SECRET supavisor Supavisor metrics JWT secret; auto-generated by the bootstrapper when blank.
TEI_RERANKER_SOURCE tei-reranker disabled -
TEI_RERANKER_PORT tei-reranker Host port for the TEI rerank API (in-container listen port is 80).
TEI_RERANKER_LOCALHOST_PORT tei-reranker 63049 Host port for the host-installed TEI rerank source variant.
TEI_RERANKER_MODEL_ID tei-reranker mixedbread-ai/mxbai-rerank-base-v1 -
TEI_RERANKER_REVISION tei-reranker main -
TEI_RERANKER_MAX_CLIENT_BATCH_SIZE tei-reranker 32 -
TEI_RERANKER_MEMORY_LIMIT tei-reranker 4g -
TEI_RERANKER_CPU_LIMIT tei-reranker 2.0 -
TEI_RERANKER_HF_CACHE_DIR tei-reranker /data -
TEI_RERANKER_SCALE tei-reranker -
TEI_RERANKER_ENDPOINT tei-reranker Resolved per TEI_RERANKER_SOURCE. Exposes TEI's rerank endpoint to compatible consumers.
TEI_RERANKER_IMAGE_RESOLVED tei-reranker Image picked per source variant (CPU vs GPU).
TEMPO_SOURCE tempo disabled -
TEMPO_SCALE tempo -
TEMPO_ENDPOINT tempo Internal Tempo query/API endpoint consumed by Grafana.
TIKA_SOURCE tika disabled -
TIKA_PORT tika -
TIKA_LOCALHOST_PORT tika 9998 Host port for the tika-localhost source variant.
TIKA_JAVA_TOOL_OPTIONS tika -Xmx768m JVM memory cap for the Tika server container.
TIKA_MAX_FILE_SIZE tika 52428800 Positive Backend maximum bytes accepted for Docling/Tika extraction; invalid values fail Backend startup.
TIKA_TIMEOUT_SECONDS tika 30 Finite Backend timeout in seconds for Tika fallback extraction calls. Must be greater than 0 and no greater than 3600; invalid values fail Backend startup.
TIKA_SCALE tika -
TIKA_ENDPOINT tika -
TRINO_SOURCE trino disabled -
TRINO_PORT trino Host port for the Trino coordinator UI/API (in-container 8080).
TRINO_SCALE trino -
TTS_PROVIDER_SOURCE tts-provider speaches-container-cpu -
TTS_PROVIDER_PORT tts-provider Wizard display slot. Real engine port lives on its own container manifest.
TTS_PROVIDER_SCALE tts-provider Aggregate scale across all TTS engines. Reserved for future use.
TTS_ENDPOINT tts-provider Resolved per TTS_PROVIDER_SOURCE. Consumed by n8n, backend, jupyterhub, open-webui, hermes-init (as TTS_INTERNAL_URL — owned by services/hermes/).
VERBA_SOURCE verba disabled -
VERBA_PORT verba Host port for the Verba UI/API (in-container 8000).
VERBA_ENDPOINT verba In-network URL for Atlas services and notebooks.
VERBA_SCALE verba -
VERBA_WEAVIATE_URL verba Resolved Weaviate URL passed to upstream WEAVIATE_URL_VERBA.
VERBA_OPENAI_MODEL verba Optional Verba OpenAI generator model name. Empty lets Verba list LiteLLM models.
VERBA_OPENAI_EMBED_MODEL verba Optional Verba OpenAI-compatible embedding model name. Empty keeps upstream default behavior.
VERBA_DEFAULT_DEPLOYMENT verba Docker Verba deployment selector. Atlas uses Docker to target the external Weaviate container.
VLLM_METAL_SOURCE vllm-metal disabled Options: managed-localhost (bootstrapper-supervised host process on Apple silicon), disabled.
VLLM_METAL_MODEL vllm-metal Qwen/Qwen2.5-7B-Instruct Hugging Face model id served by the managed vLLM Metal process and registered with LiteLLM under the same alias.
VLLM_METAL_LOCALHOST_PORT vllm-metal 8000 Host port the managed vLLM Metal OpenAI server listens on. Not a BASE_PORT slot — vLLM Metal has no Kong route or exposed stack port.
VLLM_METAL_PLUGIN_VERSION vllm-metal 0.3.0.dev20260713103604 Atlas-verified vllm-metal GitHub release wheel installed with checksum verification; unverified overrides are rejected.
VLLM_METAL_CORE_VERSION vllm-metal 0.24.0 Atlas-verified compatible vllm core source release; it must match the supported plugin release.
VLLM_METAL_PYTHON vllm-metal python3.12 Python interpreter used to build the managed host venv (vllm-metal requires 3.12).
VLLM_METAL_STATE_DIR vllm-metal ~/.atlas/vllm-metal Host directory holding the managed venv plus the pid / log / status files.
VLLM_METAL_MODELS_PATH vllm-metal Optional Hugging Face cache dir (HF_HOME) for the managed process. Blank = default HF cache.
VLLM_METAL_MIN_MEMORY_GB vllm-metal 16 Minimum unified memory (GB) the preflight requires before install / start.
VLLM_METAL_SCALE vllm-metal Always 0 — vLLM Metal never runs as a container. Reserved for interface parity with container services.
VLLM_METAL_ENDPOINT vllm-metal Resolved docker-internal URL of the managed host process (http://host.docker.internal:${VLLM_METAL_LOCALHOST_PORT}). Consumed by litellm-init to register the model. Blank when disabled.
WEAVIATE_SOURCE weaviate container -
WEAVIATE_PORT weaviate -
WEAVIATE_GRPC_PORT weaviate -
WEAVIATE_INIT_SOURCE weaviate container Auto-managed by weaviate. Container/disabled.
MULTI2VEC_CLIP_SOURCE weaviate container-cpu Options: container-cpu, container-gpu, disabled. (Effects driven by hook.)
WEAVIATE_ENABLE_MODULES weaviate text2vec-openai,text2vec-ollama,multi2vec-clip,generative-openai,generative-ollama -
CLIP_INFERENCE_API weaviate http://multi2vec-clip:8080 -
MULTI2VEC_CLIP_SIGLIP2_IMAGE weaviate semitechnologies/multi2vec-clip:google-siglip2-so400m-patch16-512-1.5.1 Opt-in SigLIP 2 image reference for MULTI2VEC_CLIP_IMAGE. Produces 1152-d vectors; revectorize or create new Weaviate collections before switching.
WEAVIATE_URL weaviate Resolved per WEAVIATE_SOURCE. Consumed by n8n, backend, jupyterhub.
WEAVIATE_LITELLM_API_KEY weaviate Mirror of LITELLM_MASTER_KEY for Weaviate's vectorizer auth.
WEAVIATE_SCALE weaviate -
WEAVIATE_INIT_SCALE weaviate -
CLIP_SCALE weaviate Computed from MULTI2VEC_CLIP_SOURCE.
CLIP_ENABLE_CUDA weaviate -
CLIP_DEPLOY_RESOURCES weaviate ~ -
WEAVIATE_LOCALHOST_PORT weaviate 8080 Host port for the weaviate-localhost source variant. URL is derived at compose-render time as http://host.docker.internal:8080.
WEAVIATE_MEMORY_LIMIT weaviate 2g Container memory limit for the weaviate container (deploy.resources.limits.memory). 2 g is conservative for a 32 GB host; the Go-based Weaviate data plane plus in-memory HNSW index fits comfortably for small-to-medium collections.
WEAVIATE_CPU_LIMIT weaviate 1.5 Container CPU limit for the weaviate container (deploy.resources.limits.cpus). 1.5 cores covers routine indexing and query serving on a shared host.
ZEPPELIN_SOURCE zeppelin disabled -
ZEPPELIN_PORT zeppelin Host port for the Zeppelin Web UI (in-container 8080).
ZEPPELIN_SCALE zeppelin -
ZEPPELIN_INIT_SCALE zeppelin -
ZEPPELIN_MEMORY_LIMIT zeppelin 2g Container memory limit for the zeppelin container (deploy.resources.limits.memory). Zeppelin's JVM-based interpreter host typically uses under 1 g for a single-user session; 2 g leaves comfortable headroom on a 32 GB host.
ZEPPELIN_CPU_LIMIT zeppelin 1.5 Container CPU limit for the zeppelin container (deploy.resources.limits.cpus). 1.5 cores covers notebook rendering and interpreter dispatch; compute-heavy work runs on the remote Spark cluster, not in this process.