Configuration and environment variables
The files Douklar reads and the environment variables an operator sets most often, with their defaults.
./install.sh and ./scripts/env_wizard.sh write .env for you. This page
lists what they write, so you can read or change it. After editing .env, run
docker compose up -d: containers keep the environment they were created
with until they are recreated.
Where state lives
| What | Where |
|---|---|
| Mappings | config/simple-config.ini, generated into config/sync.yaml |
| App defaults, plugins | config/app.yaml |
| Image-check policy | image-checker-config.yaml |
| Runs, logs, audit, sessions, access mappings | PostgreSQL |
| Access keys, SSO sessions, provider keys | Encrypted files under /app/.cache |
Runtime and network
| Variable | Default | What it does |
|---|---|---|
APP_ENV | local | local keeps local-network defaults; remote needs the hardened settings below |
AUTH_MODE | required | zitadel, cognito, or none (local only) |
ALLOWED_HOSTS | required outside local | Hostnames the backend accepts, comma-separated |
CORS_ALLOWED_ORIGINS | required outside local | Allowed browser origins; * is refused |
ACCESS_MODE | local-only in local, authenticated outside | Network access policy |
COOKIE_SECURE | false in local, true outside | Session cookie secure flag |
SESSION_TTL_SECONDS | 2592000 | Lifetime of a sign-in session |
APP_ENCRYPTION_KEY | empty | Key for encrypted credential storage; required outside local |
Database
| Variable | Default | What it does |
|---|---|---|
APP_DB_PROVIDER | local in local, generic outside | local, generic, rds or supabase |
APP_DB_POSTGRES_DSN | empty | The PostgreSQL connection string |
APP_DB_POSTGRES_SCHEMA | douklar_app | Schema for the app's tables |
APP_DB_POSTGRES_SECRET_ARN | unset | Secrets Manager secret with the database user and password |
APP_DB_POSTGRES_CONNECT_TIMEOUT | 5 | Seconds to wait for a database connection |
More: Use an external PostgreSQL.
Sync and worker
| Variable | Default | What it does |
|---|---|---|
SYNC_JOB_TIMEOUT_SECONDS | 7200 | Longest a queued sync job may run |
SYNC_ECR_MAX_CONCURRENCY | 4 | Upper bound for parallel ECR mappings |
SYNC_S3_MAX_CONCURRENCY | 3 | Upper bound for parallel S3 mappings |
SYNC_CODECOMMIT_MAX_CONCURRENCY | 3 | Upper bound for parallel CodeCommit mappings |
SYNC_DYNAMODB_MAX_CONCURRENCY | 3 | Upper bound for parallel DynamoDB mappings |
SYNC_S3_STAGING_RESERVE_BYTES | 1073741824 | Free space a relay S3 mapping leaves on the staging disk |
DYNAMODB_SYNC_MAX_ITEMS | 250000 | Item ceiling for one DynamoDB table copy |
SYNC_CODECOMMIT_PUSH_MODE | mirror | mirror or incremental |
S3_BUCKET_CATALOG_CACHE_TTL_SECONDS | 900 | How long a cached bucket list stays fresh |
SYNC_RUN_LOG_MAX_LINES | 5000 | Log lines kept per run |
WORKER_POLL_INTERVAL_SECONDS | 1.0 | How often the worker looks for queued jobs |
Each SYNC_<SERVICE>_CONCURRENCY variable fixes the number of parallel
mappings for that service, within its maximum.
Sign-in
The ZITADEL_* and COGNITO_* variables are listed in
Sign-in with ZITADEL or Cognito.