Self-hosted AIOE
Environment variables
Every environment variable the AIOE API reads, with its default and what it does.
The API reads its whole configuration from the environment when it starts, and refuses to start when a required value is missing. Set these on the API container: in docker-compose.yml, in your Helm values, or in the Azure template's parameters. Keep secrets (database passwords, keys, client secrets) in your secret store, never in a committed file.
This page lists 154 variables. "Sometimes" in the Required column means the variable is required only in the case its description gives.
Service
Where the API listens and how it describes itself.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_EDITION | No | Which edition this deployment is. enterprise is self-hosted AIOE: one organisation per identity provider issuer. cloud is the multi-organisation Mojo Up AI Cloud mode with its own sign-in. | |
AIOE_FRONT_DOOR_ID | No | Your Azure Front Door ID. When set, a request that does not carry it in its X-Azure-FDID header is refused with 403, so traffic that bypasses Front Door and its firewall is not served. The health probes (/healthz, /readyz) are always answered. Leave it unset if you do not use Front Door. | |
AIOE_STATUS_ORGANISATIONS | No | The platform operators' organisations, as ids or slugs separated by commas. Their administrators write status incidents and open operator access to other organisations. On Mojo Up AI Cloud this is Mojo Up's own organisation. | |
AIOE_TRUST_PROXY_HOPS | 1 | No | How many proxies stand between the internet and the API. Default 1, which suits one ingress (Container Apps, a Kubernetes Ingress or Caddy); use 2 behind Azure Front Door and an ingress. Rate limits and sign-in locks count the address this many hops back, so a wrong value makes them count the proxy instead of the caller. |
CONSOLE_URL | http://localhost:5173 | No | The address of the web console, without a trailing slash. Used in links the API sends, such as invitations and approval pages. |
NODE_ENV | development | No | Set to production in production. Development-only features stay off in production whatever else is set. |
PORT | 3001 | No | The port the API listens on. |
PUBLIC_URL | http://localhost:3001 | No | The address workbenches, nodes and phones use to reach the API, without a trailing slash. |
Database and cache
Where the platform keeps its records, and the shared cache that lets you run more than one replica.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_DATABASE_ALLOCATED_GB | 0 | No | The disk your Postgres has, in GB. The Quotas page shows the database's size against it, and administrators are told at 80 % and 100 %. Left out, the size is shown without a limit. |
AIOE_MIGRATE_AT_START | No | Set to 0 when database migrations run as a separate job (the Helm hook, the Container Apps job or the compose migrate service) rather than as the container starts. The API then only checks that the schema is current. Default: migrate at start. | |
AIOE_MIGRATE_DATABASE_URL | No | The connection string of the database owner, used to apply migrations when you have split the owner and application roles for row-level security. Set it only once you have created the restricted role; setting it also makes AIOE_RLS default to enforce. | |
AIOE_RLS | No | Postgres row-level security, which keeps each organisation's records apart in the database itself. off does nothing; report connects as before and logs any query that ran without an organisation; enforce connects as the restricted aioe_app role so every query is bound to the organisation it serves. Unset, it is enforce when AIOE_MIGRATE_DATABASE_URL is set and report otherwise, so an upgrade never refuses to start. | |
DATABASE_URL | Sometimes | The PostgreSQL connection string. Required when STORE is postgres. | |
REDIS_URL | No | A Redis connection string. Set it when you run more than one API replica, so relay connections and events reach every replica. Unset means one replica. | |
STORE | memory | No | Where records are kept: postgres for any real installation, memory for a throwaway evaluation (everything is lost on restart). |
Your organisation and identity provider
The organisation created at start-up and the identity provider its people sign in with.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_BOOTSTRAP_API_SCOPE | Sometimes | The scope clients request for the API, for example api://aioe.example.com.au/access. Required when AIOE_BOOTSTRAP_TENANT is set. | |
AIOE_BOOTSTRAP_DOMAINS | No | Comma-separated email domains that belong to the organisation, for example example.com.au,example.com. Workbenches use them to find the organisation from a work email. | |
AIOE_BOOTSTRAP_OIDC_AUDIENCE | Sometimes | The audience the API accepts in access tokens from your identity provider (with Microsoft Entra ID, the API app registration's client ID). Required when AIOE_BOOTSTRAP_TENANT is set. | |
AIOE_BOOTSTRAP_OIDC_CLIENT_ID | Sometimes | The client ID the console and workbenches sign in with. Required when AIOE_BOOTSTRAP_TENANT is set. | |
AIOE_BOOTSTRAP_OIDC_ISSUER | Sometimes | Your identity provider's OIDC issuer URL. The issuer of a person's token selects their organisation. Required when AIOE_BOOTSTRAP_TENANT is set. | |
AIOE_BOOTSTRAP_ORGANISATION | No | The organisation's display name. Defaults to the slug. | |
AIOE_BOOTSTRAP_TENANT | No | A short identifier (slug) for the organisation to create at start-up. Unset means no organisation is created from the environment. |
Tokens, devices and the relay
How long sign-ins and device codes last, and how the relay treats workbenches.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_ACCESS_TOKEN_TTL | 3600 | No | Seconds a device access token issued by the platform lasts. |
AIOE_BUDGET_EVALUATE_DELAY_MS | 5000 | No | How long after usage arrives, in milliseconds, before an organisation's budgets are worked out again. Default 5000. A longer delay batches more usage into each check. |
AIOE_DESKTOP_SIGN_IN_GATE | report | No | Whether a desktop that attaches a host or starts a computer session must have signed in recently. report (default) lets it through and records the missed step-up in the log and audit trail; enforce refuses it with 401 sign_in_again. Use report first to see who would be affected. |
AIOE_DEVICE_CODE_TTL | 600 | No | Seconds a workbench's enrolment code stays valid while someone approves it. |
AIOE_DEVICE_POLL_INTERVAL | 5 | No | Seconds between a device's checks on whether its code has been approved. The minimum is 1. |
AIOE_INGEST_RECORDS_PER_MINUTE | 20000 | No | How many records (events, usage, audit entries and tasks) one organisation may send in a minute. Default 20000. In the Cloud edition the figure follows the plan instead. |
AIOE_NODE_CODE_TTL | 86400 | No | Seconds a node's join request waits for an approver. |
AIOE_OFFLINE_AFTER | 90 | No | Seconds without a heartbeat before a workbench shows as offline. |
AIOE_RATE_LIMIT_PER_ADDRESS | 3000 | No | Requests a minute allowed from one network address that presents no credential. Default 3000. The count is shared between replicas through Redis. |
AIOE_RATE_LIMIT_PER_CREDENTIAL | 600 | No | Requests a minute allowed for one credential. Default 600. The count is shared between replicas through Redis. |
AIOE_RATE_LIMIT_RELEASES | 120 | No | Update checks, release downloads and install scripts allowed a minute from one network address. Default 120. These are counted apart from the two limits above, so a machine that is sending too many other requests can still fetch the release that fixes it. |
AIOE_REFRESH_TOKEN_TTL | 2592000 | No | Seconds a device refresh token lasts. |
AIOE_RPC_TIMEOUT | 30 | No | Seconds a remote-control request through the relay waits for the workbench to answer. |
AIOE_STREAM_RECHECK_SECONDS | 120 | No | How often, in seconds, an open live board checks that its reader still belongs to the organisation, so that offboarding ends the stream within this time. Default 120. |
Keys and secrets
Keys the platform uses to protect what it holds. Keep these in your secret store.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_KEYS_AWS_KMS_ENDPOINT | No | AWS KMS only: a different address for the KMS service, such as a VPC endpoint or a local test double. Falls back to AWS_ENDPOINT_URL_KMS. | |
AIOE_KEYS_AWS_KMS_KEY | No | The AWS KMS key that wraps the data keys: a key ARN, key ID, alias/<name> or alias ARN. Required when AIOE_KEYS_DRIVER is aws-kms. The standard AWS credentials are used (see the AWS_* variables below). | |
AIOE_KEYS_AWS_REGION | No | AWS KMS only: the region of the KMS key, when the key is not given as an ARN (an ARN carries its own region). Falls back to AWS_REGION, then AWS_DEFAULT_REGION. | |
AIOE_KEYS_AWS_STS_ENDPOINT | No | AWS KMS only: a different address for the AWS security token service, used when signing in with a web identity token. Falls back to AWS_ENDPOINT_URL_STS. | |
AIOE_KEYS_DRIVER | No | What wraps each organisation's data keys: local (the default; the master key is derived from AIOE_SECRETS_KEY), azure-keyvault (a Key Vault key) or aws-kms (an AWS KMS key). | |
AIOE_KEYS_ENTRA_CLIENT_ID | No | The application (client) ID to reach Key Vault as, with AIOE_KEYS_ENTRA_TENANT_ID and AIOE_ENTRA_CLIENT_SECRET, when there is no managed identity or workload identity. | |
AIOE_KEYS_ENTRA_TENANT_ID | No | The Microsoft Entra tenant of the application to reach Key Vault as when there is no managed identity or workload identity. Used with AIOE_KEYS_ENTRA_CLIENT_ID and AIOE_ENTRA_CLIENT_SECRET. | |
AIOE_KEYS_IDENTITY_CLIENT_ID | No | The client ID of a user-assigned managed identity to reach Key Vault as, when the container has more than one. Falls back to AIOE_AGENT365_IDENTITY_CLIENT_ID. | |
AIOE_KEYS_KEYVAULT_ALGORITHM | No | How Key Vault wraps a key: RSA-OAEP-256 for an RSA key (the default), RSA-OAEP, or A256KW for a Managed HSM AES key. | |
AIOE_KEYS_KEYVAULT_KEY | No | The Key Vault key that wraps the data keys, as https://<vault>.vault.azure.net/keys/<name>. Required when AIOE_KEYS_DRIVER is azure-keyvault. | |
AIOE_KEYS_LOGIN_URL | https://login.microsoftonline.com | No | The sign-in authority used to get a Key Vault token. Default https://login.microsoftonline.com; change it for a sovereign cloud. |
AIOE_SECRETS_KEY | No | A 32-byte AES-256-GCM key, base64-encoded, that encrypts the secrets the platform holds for workbenches and nodes. Unset means no secrets can be stored. | |
AIOE_SIGNING_KEY | No | The Ed25519 private key (a JWK, as JSON) that signs requests the platform sends over the overlay network. Generated at start-up when unset; set it so every replica and every restart uses the same key. | |
AWS_ACCESS_KEY_ID | No | AWS KMS only: the access key ID of an AWS identity allowed to use the KMS key. Used with AWS_SECRET_ACCESS_KEY. Prefer a role or web identity over long-lived keys. | |
AWS_CONTAINER_AUTHORIZATION_TOKEN | No | AWS KMS only: the token to present to the container credentials service. | |
AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE | No | AWS KMS only: a file holding the token to present to the container credentials service. | |
AWS_CONTAINER_CREDENTIALS_FULL_URI | No | AWS KMS only: the full address of a container credentials service, when the platform gives one instead of a relative path. | |
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI | No | AWS KMS only: where an AWS container platform (such as ECS) serves credentials, as a path on its local address. Set by the platform. | |
AWS_DEFAULT_REGION | No | AWS KMS only: the region of the KMS key when neither AIOE_KEYS_AWS_REGION nor AWS_REGION is set and the key is not an ARN. | |
AWS_EC2_METADATA_DISABLED | No | AWS KMS only: set to true to stop the API asking the instance metadata service for credentials. | |
AWS_EC2_METADATA_SERVICE_ENDPOINT | http://169.254.169.254 | No | AWS KMS only: the address of the instance metadata service the API asks for credentials, unless AWS_EC2_METADATA_DISABLED is true. Default http://169.254.169.254. |
AWS_ENDPOINT_URL_KMS | No | AWS KMS only: a different address for the KMS service, when AIOE_KEYS_AWS_KMS_ENDPOINT is not set. | |
AWS_ENDPOINT_URL_STS | No | AWS KMS only: a different address for the AWS security token service, when AIOE_KEYS_AWS_STS_ENDPOINT is not set. | |
AWS_REGION | No | AWS KMS only: the region of the KMS key when AIOE_KEYS_AWS_REGION is not set and the key is not an ARN. | |
AWS_ROLE_ARN | No | AWS KMS only: the role to assume with the web identity token in AWS_WEB_IDENTITY_TOKEN_FILE. | |
AWS_ROLE_SESSION_NAME | No | AWS KMS only: the name for the role session when a web identity token is used. Optional. | |
AWS_SECRET_ACCESS_KEY | No | AWS KMS only: the secret access key that goes with AWS_ACCESS_KEY_ID. Keep it in your secret store. | |
AWS_SESSION_TOKEN | No | AWS KMS only: the session token for temporary credentials given in AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. | |
AWS_WEB_IDENTITY_TOKEN_FILE | No | AWS KMS only: the file holding the web identity token (for example a Kubernetes service account token) to exchange for AWS credentials. Used with AWS_ROLE_ARN. | |
AZURE_AUTHORITY_HOST | https://login.microsoftonline.com | No | Kubernetes workload identity (AKS): the sign-in authority for the federated token, set by the webhook. Default https://login.microsoftonline.com. |
AZURE_CLIENT_ID | No | Kubernetes workload identity (AKS): the identity's client ID. Set by the workload identity webhook. | |
AZURE_FEDERATED_TOKEN_FILE | No | Kubernetes workload identity (AKS): the file holding the federated token. The workload identity webhook sets it, with AZURE_TENANT_ID and AZURE_CLIENT_ID; you do not set it by hand. | |
AZURE_TENANT_ID | No | Kubernetes workload identity (AKS): the Entra tenant the federated token is exchanged in. Set by the workload identity webhook. |
Overlay network
The private network (the mesh), its gateway and relays. Leave these unset if you use the outbound relay only.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_GATEWAY_MAX_TENANTS | No | How many organisations one mesh gateway serves before the rest are treated as overflow. A whole number from 1 to 100,000; default 500. | |
AIOE_GATEWAY_SECRET | No | The secret shared with the overlay gateway. | |
AIOE_GATEWAY_URL | No | The private address of the overlay gateway. Set together with AIOE_GATEWAY_SECRET; unset means remote control uses the relay only. | |
AIOE_MESH_KEEPALIVE | 25 | No | Seconds between keepalives on the private network. |
AIOE_MESH_MTU | 1280 | No | The MTU of the overlay interface. |
AIOE_MESH_OFFLINE_AFTER | 180 | No | Seconds without a status report before an overlay member shows as offline. |
AIOE_MESH_POLL_INTERVAL | 60 | No | Seconds between an overlay member's checks for changes to the network. |
AIOE_MESH_RELAYS | [] | No | The overlay relays, as a JSON array of objects with id, region, host, port and optionally publicKey. |
AIOE_MESH_STUN | stun.cloudflare.com:3478,stun.l.google.com:19302 | No | Comma-separated STUN servers overlay members use to find their public address. |
AIOE_RELAY_UPSTREAM | No | The overlay relay service the API passes relay traffic through to. Unset means the API host does not serve it. |
Integrations
Optional connections to other services.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_AGENT365_GRAPH_URL | https://graph.microsoft.com | No | The Microsoft Graph address Agent 365 uses to create agent identities and registry cards. Defaults to https://graph.microsoft.com; change it for a sovereign cloud. |
AIOE_AGENT365_IDENTITY_CLIENT_ID | No | The client ID of the user-assigned managed identity the API runs as. The Azure templates set it. With it, Agent 365 can use that identity as the blueprint's federated credential instead of a client secret. | |
AIOE_AGENT365_IDENTITY_PRINCIPAL_ID | No | The principal (object) ID of that managed identity, the subject a federated credential on the blueprint names. The Azure templates set it. | |
AIOE_AGENT365_LOGIN_URL | https://login.microsoftonline.com | No | The Microsoft Entra host that issues tokens for Agent 365. Defaults to https://login.microsoftonline.com; change it for a sovereign cloud. |
AIOE_AGENT365_OBSERVABILITY_URL | https://agent365.svc.cloud.microsoft | No | The Agent 365 observability service that agent runs are exported to. Defaults to https://agent365.svc.cloud.microsoft; change it for a sovereign cloud. |
AIOE_ENTRA_CLIENT_SECRET | No | The API's own Microsoft Entra client secret, which lets it act on a person's behalf with Azure DevOps. Unset means Azure DevOps links use a personal access token only. | |
AIOE_EXCHANGE_RATES_URL | https://api.frankfurter.app/latest?from=USD | No | Where the platform fetches the daily US-dollar exchange rates it uses to show costs in other currencies. Defaults to the Frankfurter service. Set it to off for a deployment that must not reach the internet; administrators then set a fixed rate in the console. |
AIOE_WORKIQ_URL | https://workiq.svc.cloud.microsoft | No | The Microsoft Work IQ service the memory asks on a person's behalf when Microsoft 365 grounding is on. Defaults to https://workiq.svc.cloud.microsoft; change it only for a sovereign cloud or a stand-in. |
EXPO_ACCESS_TOKEN | No | An Expo push access token, if your Expo project requires one for push notifications to the mobile app. Pushes are sent without it otherwise. | |
IDENTITY_ENDPOINT | No | Where the container's managed identity gets its tokens. Azure sets it, with IDENTITY_HEADER, on a container that has a managed identity; you do not set it yourself. Used with the two AIOE_AGENT365_IDENTITY_* values. | |
IDENTITY_HEADER | No | The secret header value that goes with IDENTITY_ENDPOINT. Azure sets it on a container with a managed identity; you do not set it yourself. |
Logging and telemetry
Logs and OpenTelemetry. Telemetry is off unless an exporter endpoint is set.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_ENVIRONMENT | No | The deployment environment name reported with telemetry (for example production). Falls back to NODE_ENV. | |
CONTAINER_APP_REPLICA_NAME | No | The replica's name, reported as the instance in traces and metrics. Azure Container Apps sets it; elsewhere the host name is used. | |
HOSTNAME | No | The replica's name when CONTAINER_APP_REPLICA_NAME is not set; Kubernetes sets it to the pod name. Reported as the instance in traces and metrics. | |
LOG_LEVEL | info | No | The log level (pino levels: trace, debug, info, warn, error, fatal). |
OTEL_EXPORTER_OTLP_ENDPOINT | No | The OpenTelemetry collector's OTLP/HTTP endpoint. Traces and metrics are exported only when this is set. | |
OTEL_EXPORTER_OTLP_HEADERS | No | Headers sent to the collector, as comma-separated key=value pairs (for example an API key). | |
OTEL_LOG_LEVEL | No | Set to debug to log the OpenTelemetry SDK's own diagnostics. | |
OTEL_METRIC_EXPORT_INTERVAL | No | Milliseconds between metric exports. | |
OTEL_METRIC_EXPORT_TIMEOUT | No | How long, in milliseconds, one metrics export may take before it is abandoned. Default 10000, at least 1000, and never more than the export interval. | |
OTEL_SERVICE_NAME | No | The service name reported with traces and metrics. |
Releases and licensing
Where this platform follows releases from, and the licence it holds.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_INSTALL_SCRIPTS_URL | No | Where the install scripts (install-node.sh, install-node.ps1, install-workbench-linux.sh) are fetched from, so this platform serves them at /releases/v1/install/ to networks that reach only it. Default: a self-hosted AIOE takes them from its upstream; Mojo Up AI Cloud from the documentation site. | |
AIOE_LICENCE | Sometimes | The enterprise licence token from the customer portal (starts with saa1.). The console's Settings → Licence can install one instead. Without a licence the deployment runs an unlicensed trial, after which its workbenches and nodes are licensed as Free. self-hosted | |
AIOE_LICENCE_CHECK_IN | 1 | Sometimes | 1 (default) checks in with the portal on the schedule the licence names, which also renews it. 0 for air-gapped installs, which paste a new token each term. self-hosted |
AIOE_PORTAL_URL | No | The Mojo Up customer portal's API, used for licence check-in (and, on Mojo Up AI Cloud, Teams billing). Default https://api.mojoup.com.au. | |
AIOE_RELEASES_SYNC_HOURS | 0.25 | No | Hours between pulls of the upstream index. Default 6; an administrator's Check now on the Updates page pulls at once. |
AIOE_RELEASES_UPSTREAM | No | The release index this platform follows. By default Mojo Up AI Cloud follows the customer portal's index and a self-hosted AIOE follows Mojo Up AI Cloud (https://ai.mojoup.com.au/releases/v1/index.json). Empty follows nothing: the Updates page then shows only what the fleet runs. | |
AIOE_RELEASES_UPSTREAM_JWKS | No | Where the upstream publishes the keys its index is signed with. Derived from the upstream address for a self-hosted AIOE (Mojo Up AI Cloud signs its index); set it to empty to follow an unsigned private mirror. |
Mojo Up AI Cloud edition
Read only when AIOE_EDITION is cloud. A self-hosted Enterprise installation leaves these unset.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_BLOCKED_EMAIL_DOMAINS | No | A comma-separated list of email domains refused at sign-in, added to the bundled list of disposable-email domains. Empty by default. | |
AIOE_CLOUD_ACCESS_TTL | 900 | No | Seconds a person's Cloud access token lasts. |
AIOE_CLOUD_AUTH_RATE_LIMIT | 30 | No | Sign-in requests allowed per minute from one address. |
AIOE_CLOUD_ENTITLEMENT_GRACE_DAYS | 7 | No | How long a cached entitlement is honoured past its expiry while the portal cannot be reached. Default 7; after that the team is on the free plan until the portal answers, and nothing is deleted. |
AIOE_CLOUD_ENTITLEMENT_REFRESH_HOURS | 6 | No | How often every team's entitlement token is pulled again from the portal. Default 6. |
AIOE_CLOUD_FACEBOOK_CLIENT_ID | No | Facebook Login: the app ID. | |
AIOE_CLOUD_FACEBOOK_CLIENT_SECRET | No | Facebook Login: the app secret. | |
AIOE_CLOUD_FREE_ACCOUNT_ONLY | on | No | Mojo Up AI Cloud only: whether the Free plan is an account and downloads only (on, the default), so a person without a paid team keeps no organisation data on Cloud. off is for tests. |
AIOE_CLOUD_GITHUB_CLIENT_ID | No | GitHub sign-in: the OAuth app's client ID. | |
AIOE_CLOUD_GITHUB_CLIENT_SECRET | No | GitHub sign-in: the OAuth app's client secret. | |
AIOE_CLOUD_GOOGLE_CLIENT_ID | No | Google sign-in: the OAuth client ID. Google sign-in is offered only when both its ID and secret are set. | |
AIOE_CLOUD_GOOGLE_CLIENT_SECRET | No | Google sign-in: the OAuth client secret. | |
AIOE_CLOUD_INVITATION_DAYS | 7 | No | Days an invitation link stays valid. |
AIOE_CLOUD_MICROSOFT_CLIENT_ID | No | Microsoft sign-in: the application (client) ID. | |
AIOE_CLOUD_MICROSOFT_CLIENT_SECRET | No | Microsoft sign-in: the client secret. | |
AIOE_CLOUD_PORTAL_KEY | No | The shared integration key for Teams billing: the bearer on Cloud's calls to the portal and the key the portal signs its pushes with. Billing is offered only when this and the public key are both set. | |
AIOE_CLOUD_PORTAL_URL | https://api.mojoup.com.au | No | Older name for AIOE_PORTAL_URL; still read. |
AIOE_CLOUD_QUOTAS | No | Changes the quota figures for a plan, as JSON laid over the defaults, for example {"free":{"projects":20}}. Plans are free, teams and enterprise; each figure is a whole number or null. Leave it unset to use the defaults; the process refuses to start if the JSON is not valid. | |
AIOE_CLOUD_REDIRECTS | No | Extra comma-separated addresses a sign-in may return to, beyond the console's callback and the mobile app. | |
AIOE_CLOUD_REFRESH_TTL | 2592000 | No | Seconds a person's Cloud refresh token lasts. Refresh tokens rotate on every use. |
AIOE_EMAIL_FROM | Mojo Up <no-reply@mojoup.com.au> | No | The sender of sign-in codes and invitations. |
AIOE_MESH_CLOUD | No | Set to on to let Teams organisations on Mojo Up AI Cloud use the mesh. Off by default. | |
AIOE_ORGANISATIONS_PER_PERSON_PER_DAY | 1 | No | How many new organisations (teams) one person may create in a day. Default 1. |
AIOE_PLATFORM_CEILINGS | No | Limits on the whole deployment, so that what you run and pay for stays bounded: a JSON object such as {"storageBytes":2000000000000,"organisationsPerDay":500,"meshNodes":5000}. storageBytes caps the bytes all organisations store together, organisationsPerDay caps organisations created in a day, and meshNodes caps the machines on every mesh together. Each is a whole number, or null for no limit; any other key is refused and the service will not start. Empty or unset (the default) sets no ceiling. | |
AIOE_QUOTAS | on | No | on (default) or off. off turns off the Cloud plan quotas and the per-credential request limit; the per-address limit and the ingest rate stay. Leave it on outside testing. |
AIOE_SIGNUPS_PER_ADDRESS_PER_DAY | 20 | No | How many new people may sign up from one network address in a day. Default 20; raise it if a shared office address is being refused. |
AIOE_SIGNUPS_PER_DOMAIN_PER_HOUR | 30 | No | How many new people may sign up from one email domain in an hour. Default 30; raise it for a large organisation onboarding at once. |
AIOE_SMTP_URL | No | The SMTP URL for sign-in codes and invitations. Unset means codes are written to the log, which is for development only. | |
AIOE_TURNSTILE_SECRET | No | The Cloudflare Turnstile secret key. Set it to put a Turnstile check on email sign-in and on creating a team. Turnstile is off while this is unset. | |
AIOE_TURNSTILE_SITE_KEY | Sometimes | The Cloudflare Turnstile site key shown to people at sign-in. Required when AIOE_TURNSTILE_SECRET is set. | |
AIOE_TURNSTILE_VERIFY_URL | https://challenges.cloudflare.com/turnstile/v0/siteverify | No | The address the API checks Turnstile answers against. Defaults to Cloudflare's own siteverify address; change it only for a stand-in in testing. |
Development and testing
Never set these in production.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_DEV_AUTH | 0 | No | Set to 1 to accept development sign-ins without an identity provider. Ignored when NODE_ENV is production. |
AIOE_ENTRA_TOKEN_ENDPOINT | No | A test hook: where to exchange tokens instead of the organisation's issuer. |
Other
Variables the reference has not yet grouped.
| Variable | Default | Required | What it does |
|---|---|---|---|
AIOE_BACKUP_ESCROW_RECIPIENT | No | The platform recovery service's public key as JSON, so backups can also be unlocked by it. Unset means backups are unlocked only by the person's devices, their Emergency Kit and the organisation recovery key. | |
AIOE_BACKUP_QUOTA_BYTES | No | Self-hosted: the most encrypted-backup storage each person may use in the organisation, in bytes. Unset means no limit. Mojo Up AI Cloud's limits are its plans'. | |
AIOE_BREAK_GLASS_ADMINS | No | AIOE_BREAK_GLASS_ADMINS (Entra object ids, comma separated, lower-cased; Enterprise only; docs/rbac.md section 7, hard line 3, decision 8): people who are the organisation's administrators even when the directory's roles are wrong. Each use needs a recent sign-in, is audited role.break_glass and alerts the administrators (auth/breakGlass.ts). Ignored on AI Cloud, whose owners and admins are its own records. | |
AIOE_GEOIP_DB | No | The offline IP-to-place database the audit trail names places from (AIOE_GEOIP_DB): a path to a MaxMind-format city database (DB-IP City Lite, fetched at image build by geoip:update). Unset: the one the image carries, when there is one; off: no places, only private and mesh addresses named. | |
AIOE_MIRROR_MAX_FPS | No | ||
AIOE_MIRROR_MAX_PER_ORGANISATION | No | ||
AIOE_MIRROR_MAX_QUALITY | No | ||
AIOE_MIRROR_MAX_WIDTH | No | ||
AIOE_PLATFORM_OPERATORS | No | AIOE_PLATFORM_OPERATORS (person ids or email addresses, comma separated, lower-cased; docs/rbac.md section 7, hard line 2, decision 7): the platform's named operators. Set, only these people (still administrators of an organisation in operatorOrganisations) open break-glass access, remove organisations and people, write status incidents and see the platform's views. Empty: every administrator of those organisations, as before, with a warning at start. Kept at deployment level only: never a role, and no customer's screen shows it. | |
AIOE_RBAC | off | No | Roles and permissions (AIOE_RBAC, docs/rbac.md): off (the default until 0.90.0) decides with today's rules and shows them read-only on Settings, Roles and permissions; on lets role definitions and assignments decide (auth/rbac.ts can()) and be changed there. |
AIOE_RELAY_STREAM_RECHECK_MS | 60000 | No | How often an open relay stream checks that its machine still holds a live token (milliseconds). |
AIOE_RELEASES_DIR | No | ||
AIOE_SHELL_MAX_PER_ORGANISATION | No | ||
OTEL_TRACES_SAMPLER | No |