# Configuration and environment variables

> The files Douklar reads and the environment variables an operator sets most often, with their defaults.

`./install.sh` and `./scripts/env_wizard.sh` write `.env` for you. This page
lists what they write, so you can read or change it. After editing `.env`, run
`docker compose up -d`: containers keep the environment they were created
with until they are recreated.

## Where state lives

| What | Where |
|---|---|
| Mappings | `config/simple-config.ini`, generated into `config/sync.yaml` |
| App defaults, plugins | `config/app.yaml` |
| Image-check policy | `image-checker-config.yaml` |
| Runs, logs, audit, sessions, access mappings | PostgreSQL |
| Access keys, SSO sessions, provider keys | Encrypted files under `/app/.cache` |

## Runtime and network

| Variable | Default | What it does |
|---|---|---|
| `APP_ENV` | `local` | `local` keeps local-network defaults; `remote` needs the hardened settings below |
| `AUTH_MODE` | required | `zitadel`, `cognito`, or `none` (local only) |
| `ALLOWED_HOSTS` | required outside local | Hostnames the backend accepts, comma-separated |
| `CORS_ALLOWED_ORIGINS` | required outside local | Allowed browser origins; `*` is refused |
| `ACCESS_MODE` | `local-only` in local, `authenticated` outside | Network access policy |
| `COOKIE_SECURE` | `false` in local, `true` outside | Session cookie `secure` flag |
| `SESSION_TTL_SECONDS` | `2592000` | Lifetime of a sign-in session |
| `APP_ENCRYPTION_KEY` | empty | Key for encrypted credential storage; required outside local |

## Database

| Variable | Default | What it does |
|---|---|---|
| `APP_DB_PROVIDER` | `local` in local, `generic` outside | `local`, `generic`, `rds` or `supabase` |
| `APP_DB_POSTGRES_DSN` | empty | The PostgreSQL connection string |
| `APP_DB_POSTGRES_SCHEMA` | `douklar_app` | Schema for the app's tables |
| `APP_DB_POSTGRES_SECRET_ARN` | unset | Secrets Manager secret with the database user and password |
| `APP_DB_POSTGRES_CONNECT_TIMEOUT` | `5` | Seconds to wait for a database connection |

More: [Use an external PostgreSQL](/docs/douklar/external-postgresql).

## Sync and worker

| Variable | Default | What it does |
|---|---|---|
| `SYNC_JOB_TIMEOUT_SECONDS` | `7200` | Longest a queued sync job may run |
| `SYNC_ECR_MAX_CONCURRENCY` | `4` | Upper bound for parallel ECR mappings |
| `SYNC_S3_MAX_CONCURRENCY` | `3` | Upper bound for parallel S3 mappings |
| `SYNC_CODECOMMIT_MAX_CONCURRENCY` | `3` | Upper bound for parallel CodeCommit mappings |
| `SYNC_DYNAMODB_MAX_CONCURRENCY` | `3` | Upper bound for parallel DynamoDB mappings |
| `SYNC_S3_STAGING_RESERVE_BYTES` | `1073741824` | Free space a relay S3 mapping leaves on the staging disk |
| `DYNAMODB_SYNC_MAX_ITEMS` | `250000` | Item ceiling for one DynamoDB table copy |
| `SYNC_CODECOMMIT_PUSH_MODE` | `mirror` | `mirror` or `incremental` |
| `S3_BUCKET_CATALOG_CACHE_TTL_SECONDS` | `900` | How long a cached bucket list stays fresh |
| `SYNC_RUN_LOG_MAX_LINES` | `5000` | Log lines kept per run |
| `WORKER_POLL_INTERVAL_SECONDS` | `1.0` | How often the worker looks for queued jobs |

Each `SYNC_<SERVICE>_CONCURRENCY` variable fixes the number of parallel
mappings for that service, within its maximum.

## Sign-in

The `ZITADEL_*` and `COGNITO_*` variables are listed in
[Sign-in with ZITADEL or Cognito](/docs/douklar/sign-in-zitadel-or-cognito).

Source: https://douklar.app/docs/douklar/configuration (Douklar docs, last checked 2026-10-18)