# SPDX-FileCopyrightText: 2026 Hari Srinivasan # SPDX-FileCopyrightText: 2026 Lokesh # SPDX-License-Identifier: Apache-2.0 # ============================================================================= # Observal v1.0 — Environment Configuration (Boot-Time Only) # # Copy this file to .env and fill in values for your deployment. # SECURITY: never commit your real .env to version control. # # NOTE: As of v1.0, only boot-time infrastructure vars live here. # All runtime settings (eval models, security policies, SAML, retention, etc.) # are configured via the Settings page in the admin UI (super admin only). # # No incremental upgrade from pre-1.0 is supported. See: # https://docs.observal.dev/upgrade/1.0 # ============================================================================= # ----------------------------------------------------------------------------- # Infrastructure — required for every deployment # ----------------------------------------------------------------------------- DATABASE_URL=postgresql+asyncpg://postgres:postgres@observal-db:5432/observal CLICKHOUSE_URL=clickhouse://default:clickhouse@observal-clickhouse:8123/observal REDIS_URL=redis://observal-redis:6379 # ----------------------------------------------------------------------------- # Security # ----------------------------------------------------------------------------- # Generate a unique secret: python3 -c "import secrets; print(secrets.token_hex(32))" # REQUIRED in production: min 32 chars, random. SECRET_KEY=change-me-to-a-random-string # ----------------------------------------------------------------------------- # JWT Key Management # EC signing key pair generated automatically on first start. # ----------------------------------------------------------------------------- JWT_KEY_DIR=~/.observal/keys # JWT_KEY_PASSWORD= # optional password to encrypt the private key at rest JWT_SIGNING_ALGORITHM=ES256 # ----------------------------------------------------------------------------- # Google OAuth # Imported once into dynamic settings on startup when set in the container env. # GOOGLE_OAUTH_CLIENT_ID= # GOOGLE_OAUTH_CLIENT_SECRET= # GOOGLE_OAUTH_ALLOWED_DOMAINS=acme.com,acme.io # ----------------------------------------------------------------------------- # Git webhooks (optional) # Public base URL GitHub and GitLab use for webhook deliveries when the rest of Observal is # private, e.g. a separate hostname that only forwards /api/v1/webhooks/*. # Leave unset when Observal itself is reachable from github.com or gitlab.com. # WEBHOOK_PUBLIC_URL=https://hooks.observal.example.com # ----------------------------------------------------------------------------- # Container credentials (docker-compose only — not read by the app) # Must match DATABASE_URL / CLICKHOUSE_URL above. # ----------------------------------------------------------------------------- POSTGRES_USER=postgres POSTGRES_PASSWORD=postgres CLICKHOUSE_USER=default CLICKHOUSE_PASSWORD=clickhouse # ----------------------------------------------------------------------------- # Logging (boot-time — configured before DB is available) # ----------------------------------------------------------------------------- LOG_LEVEL=INFO LOG_FORMAT=json # ----------------------------------------------------------------------------- # Demo accounts (seeded on first startup when no real users exist) # SECURITY: change all passwords before exposing to any non-local environment. # ----------------------------------------------------------------------------- SEED_DEMO_ACCOUNTS=true DEMO_SUPER_ADMIN_EMAIL=super@demo.example DEMO_SUPER_ADMIN_PASSWORD=super-changeme DEMO_ADMIN_EMAIL=admin@demo.example DEMO_ADMIN_PASSWORD=admin-changeme DEMO_REVIEWER_EMAIL=reviewer@demo.example DEMO_REVIEWER_PASSWORD=reviewer-changeme DEMO_USER_EMAIL=user@demo.example DEMO_USER_PASSWORD=user-changeme