Environment variables

A Docker Compose install reads its settings from .env in the install directory (./pipeshub by default). The installer writes that file and generates the secrets. The full list with comments is deployment/docker-compose/env.template in the pipeshub-ai repository. The default given for each variable is the value Docker Compose uses when the variable is not in .env. “Empty” means the service’s built-in behaviour applies.

Applying a change

Edit .env in the install directory.
From that directory, recreate the containers:
docker compose -p pipeshub-ai up -d
Use the value of COMPOSE_PROJECT_NAME in .env if you changed the project name.

./install.sh --reconfigure runs the wizard again and rewrites .env from scratch. It keeps the existing secrets and saves the old file as .env.bak.<timestamp>, but check that any variable you added by hand, such as TELEMETRY_COLLECTION_FLAG=false, is still there afterwards. The installer starts the containers once it has written the file, so to add your settings first, run ./install.sh --reconfigure --print-env-only, edit .env, then start PipesHub with the command it prints.

Do not change SECRET_KEY or a database password on an existing install. The databases were created with them, and stored settings are encrypted with SECRET_KEY.

Required

The installer generates all of these. Set them yourself only if you write .env by hand.

Variable	What it does
`SECRET_KEY`	Encrypts stored configuration, such as model and connector credentials. The services refuse to start without it.
`MONGO_USERNAME`, `MONGO_PASSWORD`	MongoDB root user. Default username `admin`.
`NEO4J_PASSWORD`	Neo4j password, when `DATA_STORE=neo4j`.
`ARANGO_PASSWORD`	ArangoDB root password, when `DATA_STORE=arangodb`.
`QDRANT_API_KEY`	Key shared by Qdrant and the app.
`REDIS_PASSWORD`	Redis password. Empty runs Redis without one.

Core

Variable	What it does
`NODE_ENV`	Set `production` on any real deployment. `env.template` ships `development`; the installer writes `production`. Default: `production`.
`LOG_LEVEL`	Log level for the services. Default: `info`.
`FRONTEND_PUBLIC_URL`	Public HTTPS URL people use to open PipesHub. Used for OAuth callbacks and email links. Default: empty.
`APP_PORT`	Host port Docker publishes. Default: `3000`.
`ALLOWED_ORIGINS`	Browser origins allowed to call the API, comma-separated. Default: empty.
`IMAGE_TAG`	Image tag for the app and sandbox images. `env.template` and the `slim` and `eval` installs use `slim`. Default: `latest`.
`COMPOSE_PROJECT_NAME`	Docker Compose project. Volume names start with it. The installer writes it; `--stop` and `--uninstall` read it. Default: `pipeshub-ai`.
`COMPOSE_PROFILES`	Which optional containers start. See Backends. Default: `graph-neo4j,sandbox` in `env.template`.
`TELEMETRY_COLLECTION_FLAG`	`false` turns off telemetry collection in every service. Default: empty (on).
`LOG_MAX_SIZE`, `LOG_MAX_FILE`	Docker log rotation for the app container. Default: `20m`, `15`.

Signing secrets and tokens

Variable	What it does
`JWT_SECRET`, `SCOPED_JWT_SECRET`, `COOKIE_SECRET`	Seed the signing secrets on a fresh install only. Otherwise they are generated on first start and stored; later values are ignored. Default: empty.
`ROTATE_SIGNING_SECRETS`	Written by `./install.sh --rotate-signing-secrets`. See Rotate signing secrets. Default: empty.
`ACCESS_TOKEN_EXPIRY`	Lifetime of an access token. Default: `24h`.
`REFRESH_TOKEN_EXPIRY`	Lifetime of a refresh token. Default: `720h`.
`PASSWORD_RESET_LINK_EXPIRY`	Lifetime of a password-reset link. Default: `20m`.
`MCP_SCOPES`	OAuth scopes for MCP access, comma-separated. If you set it, include `code:read`, or first-run setup stops with “Scopes not allowed for this app: code:read”. Default: the fixed list in `env.template`, which includes `code:read`.
`PIPESHUB_ENABLE_DCR`	`true` turns on OAuth dynamic client registration (RFC 7591). Default: empty (off).
`PIPESHUB_ENABLE_DEVICE_GRANT`	`false` turns off the OAuth device authorization grant (RFC 8628). Default: empty (on).
`HIDE_SECRET_CONFIG`	`true` masks secrets, including sign-in and OAuth app secrets, in settings responses until revealed. Default: `false`.

Rate limits and proxies

See Rate limits and API errors for how each limit counts.

Variable	What it does
`MAX_REQUESTS_PER_MINUTE`	Requests per minute from each client IP across the API. Not in `env.template`. Without Docker Compose the built-in default is `1000`. Default: `2000`.
`MAX_AUTH_REQUESTS_PER_MINUTE`	Sign-in, OTP and password requests per minute for each account. One IP may send six times this across all accounts. Default: `10`.
`MAX_OAUTH_CLIENT_REQUESTS_PER_MINUTE`	Requests per minute to OAuth app, personal access token, service account and OAuth token routes. Not in `env.template`. Default: `1000`.
`TRUST_PROXY`	Which reverse proxies to trust for the client IP. Behind one proxy (Nginx, Caddy, Traefik) use `1`, or list the proxy addresses or CIDRs. Never use `true`. Default: empty.

Backends

Each backend variable must agree with COMPOSE_PROFILES. A backend whose profile is missing is not running, and a profile with no matching backend starts a container nothing uses.

Variable	What it does
`DATA_STORE`	Graph database: `neo4j` or `arangodb`. Default: `neo4j`. Profile: `graph-neo4j` or `graph-arango`.
`KV_STORE_TYPE`	Key-value store for configuration: `redis` or `etcd`. Default: `redis`. Profile: `kv-etcd` for `etcd`.
`MESSAGE_BROKER`	Message broker: `redis` (Redis Streams) or `kafka`. Default: `redis`. Profile: `broker-kafka` for `kafka`.
`VECTOR_COLLECTION_STRATEGY`	`single` puts all records in one Qdrant collection; `per_connector_type` uses one per connector type. Do not change it on an existing install: the services stop at startup. Default: `single`.

Other profiles: sandbox (coding sandbox; leave it out for eval), search-searxng (needs SEARXNG_SECRET) and fetch-crawl4ai (needs CRAWL4AI_API_TOKEN). See Web Search.

Redis Streams

Variable	What it does
`REDIS_STREAMS_RETENTION_MODE`	`after_ack` trims a stream only behind its consumers. `maxlen` caps every stream and drops unconsumed events past the cap. Default: `after_ack`.
`REDIS_STREAMS_MAXLEN`	Cap for streams with no consumer group, or for every stream with `maxlen`. Default: `500000`.
`FAIR_SCHEDULING_LANE_COUNT`	Indexing lanes. Every service must use the same count. Default: `8`.
`FAIR_SCHEDULING_LANE_ASSIGNMENT`	`assigned` gives each connector the least busy lane; `hash` picks a lane from the connector id. Default: `assigned`.
`MAX_DELIVERY_ATTEMPTS`	Deliveries before a message is dead-lettered. `docker-compose.yml` does not pass it to the container, so set it with a Compose override (`PIPESHUB_COMPOSE_OVERRIDES`). Default: `3`.

Memory and databases

Variable	What it does
`APP_MEMORY_LIMIT`	Memory cap for the app container. The installer sets it from the machine’s memory less 4 GB, between 6 GB and 32 GB. Indexing and parsing concurrency is sized from it, so it is the main throughput setting. Default: `10G`.
`APP_MEMSWAP_LIMIT`	Memory plus swap cap for the app container. Keep it at or above `APP_MEMORY_LIMIT`. Default: `16G`.
`QDRANT_MEMORY_LIMIT`	Memory cap for Qdrant. Search slows when the index outgrows it. Default: `6G`.
`MONGO_CACHE_GB`	MongoDB WiredTiger cache. Default: `1`.
`MONGO_MEMORY_LIMIT`	Memory cap for MongoDB. Raise it together with `MONGO_CACHE_GB`. Default: `2G`.
`MONGO_GLIBC_TUNABLES`	Set `glibc.pthread.rseq=1` if MongoDB keeps exiting with code 139. Default: `glibc.pthread.rseq=0`.
`MONGO_IMAGE_TAG`	MongoDB image. MongoDB 8 data cannot be read by 7, so do not downgrade an existing volume. Default: `8.0.17`.

Indexing and parsing

Leave these unset unless you are tuning a known bottleneck. Empty values let the services size themselves from the CPU and memory limits.

Variable	What it does
`MAX_CONCURRENT_PARSING`, `MAX_CONCURRENT_INDEXING`, `MAX_PENDING_INDEXING_TASKS`	Caps on parsing and indexing concurrency. Set a number only to cap. Default: empty.
`INDEXING_UVICORN_WORKERS`, `PARSING_UVICORN_WORKERS`, `DOCLING_UVICORN_WORKERS`	Worker processes for those services. Default: `1`.
`QUERY_UVICORN_WORKERS`	Worker processes for the query service. Default: empty.
`CONNECTOR_UVICORN_WORKERS`	Worker processes for the connector service. Raising it can run duplicate syncs at once. Default: `1`.
`UVICORN_WORKER_HEALTHCHECK_TIMEOUT_SECONDS`	Seconds a worker may stop answering before it is replaced. Default: `60`.
`LOCAL_DOCLING_PARSE_WORKERS`, `PDF_OCR_DETECTION_WORKERS`	Local Docling and OCR-detection workers. Default: `1`.
`ENABLE_PDFPLUMBER_PROCESSOR`	Read text PDFs with the local PdfPlumber parser. Default: `false`.
`PDF_DOCLING_MAX_PAGES`	Text PDFs longer than this go to PdfPlumber; `0` sends every text PDF there. Default: `30`.
`PARSE_POOL_WORKERS`	Processes that parse large text, code and CSV files. Empty derives it from the CPU limit; `0` uses threads. Default: empty.
`CODE_FILE_MAX_SIZE_MB`	Largest code-repository file read as code or text. Default: empty (5).
`CONNECTOR_SYNC_MAX_CONCURRENT`	Most connector syncs running at once. Default: `8`.
`CONNECTOR_SYNC_DELETE_STOP_WAIT_SEC`	How long a connector delete waits for its running sync to stop. Default: `15`.
`MAX_TABLE_ROWS_FOR_LLM`	Table-row threshold for processing with the language model. Default: `1000`.
`EXCEL_MAX_TABLE_ROWS_TO_INDEX`	Most rows indexed from one Excel table. Default: `20000`.
`EXCEL_HEADER_GENERATION_SAMPLE_SCAN_LIMIT`	Rows scanned to generate Excel table headers. Default: `500`.
`EMBEDDING_SERVER_MAX_CONCURRENCY`, `EMBEDDING_BATCH_CONCURRENCY`	`EMBEDDING_SERVER_MAX_CONCURRENCY` caps requests the bundled embedding server handles at once. `EMBEDDING_BATCH_CONCURRENCY` caps how many embedding batches indexing sends at once for one record (code default 5). Default: empty.
`EMBEDDING_SERVER_QUERY_RESERVED_SLOTS`	Embedding slots kept for search queries. Default: empty (1).
`EMBEDDING_SERVER_MODEL_IDLE_SECONDS`	Seconds before an unused local embedding model is unloaded; `0` keeps it loaded. Default: empty (900).
`PARSE_MAX_ORG_SHARE`	Share of a parse pool one organization may hold while another waits. Default: empty (0.5).

env.template also lists GOVERNOR_* and INDEXING_SPLIT_LEASE_POOLS resource-governor settings. Leave them empty.

Search and answers

Variable	What it does
`TARGETED_RETRIEVAL`	Agents read only the relevant part of a record. `false` turns it off. On by default since 1.0. Default: empty (on).
`TIMELINE_SUMMARIES`	Timeline search over date ranges. `false` turns it off. On by default since 1.0. Default: empty (on).
`HIGH_ACCURACY_MODE`	`true` turns on features that spend more compute per question, and named-entity extraction while indexing. Default: `false`.
`PIPESHUB_AGENT_MAX_TURN_OUTPUT_CHARS`	Most characters one agent turn may stream before it is stopped. `0` removes the limit. Default: empty (1000000).
`PIPESHUB_ACCESSIBLE_RECORDS_CACHE`, `PIPESHUB_ACCESSIBLE_RECORDS_CACHE_TTL`	Cache of the records a user can access, and its lifetime in seconds. Default: empty (on), `300`.

Code graph

Variable	What it does
`CODE_GRAPH_ENABLED`	`false` indexes code for search only, with no code graph. Default: `true`.
`CODE_GRAPH_BACKFILL`	`true` re-indexes, on the next start, repositories indexed before the current code-graph version. Default: `false`.
`CODE_FILE_CLASSIFICATION`	Per-file classification of code with the language model. Default: `true`.
`CODE_EDGE_BUILD_RECONCILE_INTERVAL_SECONDS`	How often the connector service looks for repositories that still need a graph build. Default: empty (600).
`CODE_EDGE_FULL_REBUILD_INTERVAL_SECONDS`	Full rebuild of each repository’s graph, in seconds (7 days). Default: empty (604800).
`CODE_EDGE_BUILD_MAX_CONCURRENT`, `CODE_EDGE_BUILD_MAX_PER_ORG`	Graph builds at once per connector process, and per organization. Default: empty (2, 1).
`CODE_EDGE_BUILD_MAX_BLOCKS`	Largest repository one build loads. Default: empty (300000).
`CODE_EDGE_BUILD_MAX_FAILURES`	Failed attempts before a build is marked failed. Default: empty (6).

Network and security

Variable	What it does
`PIPESHUB_BLOCK_PRIVATE_ADDRESSES`	`true` refuses AI model endpoints and connector servers on private or internal addresses. Use it when organizations that do not trust each other share one deployment. It does not check model traffic sent through an HTTP(S) proxy, so filter destinations at the proxy as well. Default: empty.
`WEB_CONNECTOR_ALLOWED_HOSTS`	Internal host names the Web and RSS connectors may crawl, comma-separated. Default: empty.
`CONNECTOR_EGRESS_IPS`	Public IPs shown in connector forms for firewall allow-lists. Empty looks them up once; `none` hides them. Default: empty.
`PIPESHUB_NEXTCLOUD_ALLOW_INSECURE_HTTP`	`true` lets the Nextcloud connector use an `http://` URL. Default: empty.
`MCP_ALLOW_CUSTOM_STDIO`	`true` allows custom STDIO MCP servers, which run an admin-entered command inside the app container. Default: `false`.
`SANDBOX_ALLOW_NETWORK`	`true` gives agent-generated code network access. Private and cloud-metadata addresses stay blocked. Default: `false`.
`SANDBOX_EGRESS_ALLOW_CIDRS`	Private ranges sandboxed code may still reach, such as a package mirror. Default: empty.
`WEB_FETCH_RENDER_JS`	`off` stops chat from rendering pages in the headless browser. Rendering is always off while `WEB_CONNECTOR_ALLOWED_HOSTS` is set. `docker-compose.yml` does not pass it to the container, so set it with a Compose override (`PIPESHUB_COMPOSE_OVERRIDES`). Default: empty.
`SEARXNG_SECRET`	Required with the `search-searxng` profile. Default: empty.
`CRAWL4AI_API_TOKEN`	Required with the `fetch-crawl4ai` profile. Default: empty.

Air-gapped hosts

Variable	What it does
`HF_HUB_OFFLINE`, `TRANSFORMERS_OFFLINE`	Set both to `1` on a host with no internet that already has the models, such as the `latest` image. Leave them empty on `slim`, which downloads the embedding model on first use. Default: empty.

See Private Cloud & On-Premises.

Installer variables

These are read by install.sh itself, for scripted installs. They are not written to .env unless noted.

Variable	What it does
`PIPESHUB_DEPLOY_TYPE`	`slim`, `full` or `eval`. See System requirements.
`PIPESHUB_GRAPH_DB`, `PIPESHUB_BROKER`, `PIPESHUB_KV_STORE`	`neo4j` or `arango`; `redis` or `kafka`; `redis` or `etcd`.
`PIPESHUB_VERSION`	Image tag, same as `--version`.
`PIPESHUB_NO_PULL`	`1` or `true`, same as `--no-pull`.
`PIPESHUB_PORT`	Host port. Default `3000`.
`PIPESHUB_PROJECT`	Compose project name. Default `pipeshub-ai`. Use it to run a second copy.
`PIPESHUB_PUBLIC_URL`	Public HTTPS URL, written as `FRONTEND_PUBLIC_URL`.
`PIPESHUB_IMAGE_SOURCE`	`prebuilt` (default) or `local` to build from a clone.
`PIPESHUB_IMAGE`	App image repository. Default `pipeshubai/pipeshub-ai`. Saved in `.env`.
`PIPESHUB_COMPOSE_OVERRIDES`	Extra Compose files layered over `docker-compose.yml`, colon-separated. Saved in `.env`.
`PIPESHUB_ENV_EXTRA`	A file whose lines are added to a newly written `.env`.
`HEALTH_WAIT_SECS`	How long the installer waits for the health check. Default `420`.

Welcome to PipesHub

Using PipesHub

System Overview

Authentication

Mail Configuration

Web Search

Custom Instructions

AI Providers

Connectors

Integrations

Agents

Actions

MCP Server

User Management

Deployment

Developer

Additional Resources

Environment variables

Applying a change

Required

Core

Signing secrets and tokens

Rate limits and proxies

Backends

Redis Streams

Memory and databases

Indexing and parsing

Search and answers

Code graph

Network and security

Air-gapped hosts

Installer variables

​Applying a change

​Required

​Core

​Signing secrets and tokens

​Rate limits and proxies

​Backends

​Redis Streams

​Memory and databases

​Indexing and parsing

​Search and answers

​Code graph

​Network and security

​Air-gapped hosts

​Installer variables

​Related

Applying a change

Required

Core

Signing secrets and tokens

Rate limits and proxies

Backends

Redis Streams

Memory and databases

Indexing and parsing

Search and answers

Code graph

Network and security

Air-gapped hosts

Installer variables

Related