--- title: "Environment variables" description: "The environment variables obop reads: database URL, agent token, marketplace URL, and the settings of the control plane and Sliplane provisioner." canonical: "https://obop.dev/docs/reference/environment/" lang: "en" --- # Environment variables obop reads a small number of environment variables. Command line flags win over variables. ## Instance and CLI | Variable | Meaning | Default | | -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | | `OBOP_DATABASE_URL` | Where the data lives: `sqlite://obop.db`, `sqlite:///abs/path.db`, `postgres://user:pass@host/db` or `memory:`. Same as `--db`. For PostgreSQL add `?sslmode=require` (or `verify-full` with `&sslrootcert=/path/ca.pem`) to encrypt the connection; see Self-hosting. | `sqlite://obop.db` | | `OBOP_TOKEN` | Bearer token for `obop mcp`, `obop call` and `obop commands`. Same as `--token`. | none | | `OBOP_UPDATE_URL`, `OBOP_UPDATE_TOKEN` | Managed instances: the control plane's address and the instance's update token (set by the provisioner; the token is sealed into the database at start). | | `OBOP_UPDATE_FEED` | The release feed read when an administrator checks for updates. Default `/api/releases`, else `https://obop.dev/api/releases`; `off` disables. | | `OBOP_BACKUP_DIR` | Where the backup taken before an update from inside the instance is written. | | `OBOP_MARKETPLACE_URL` | An extra marketplace: a host serving `index.json` and `packages/.toml`. Shown after the bundled catalog. | none | | `OBOP_BLOB_DIR` | Directory for uploaded pictures and files (images on products, pages, posts, documents). Default: next to the SQLite file; PostgreSQL and memory instances keep them in the database. | beside the db | | `OBOP_DEMO_PAYMENTS` | `1` offers the demo payment provider (`fake`) to the web shop. For trials and tests only; never set it where real buyers pay. | off | | `OBOP_PUBLIC_URL` | External URL of an instance behind a proxy (`https://acme.example.com`), used in the MCP discovery documents, in the `401` challenge of `/mcp` and as the origin and relying party id of passkeys, which work only at this address. | from the request | | `OBOP_ALLOWED_ORIGINS` | Comma-separated exact browser origins (`https://app.example.com`, or `http://localhost:5173` for development) allowed to call `/api` and `/mcp` from another origin. Wildcards and other invalid values stop the server at start. Bearer tokens only; credentials are never allowed. | none (same origin only) | | `OBOP_METRICS_TOKEN` | Opens `/metrics` (Prometheus text) to a scraper that sends this bearer token; at least 16 characters. Without it `/metrics` is served only on a loopback bind, to direct loopback callers; otherwise it answers 404. `/healthz` and `/readyz` are always open. | closed | | `OBOP_ALLOWED_ORIGINS` | Comma-separated browser origins allowed to call `/mcp` (DNS-rebinding protection). Clients that are not browsers send no origin. | none | | `OBOP_BULK_PER_MINUTE` | `bulk_create` calls (and `obop import`) one person may start per minute, dry runs included; `0` turns the limit off. | 12 | | `OBOP_MCP_RATE_PER_MINUTE` | Requests per token per minute on `/mcp`; `0` turns the limit off. | 600 | | `OBOP_SECRET_KEY` | The current server key: 32 random bytes as 64 hex digits (`openssl rand -hex 32`). Seals two-factor secrets, connection credentials, OAuth tokens and pseudonym keys of Connectors (`docs/CONNECTORS.md`), and the sessions, vaults and approval plans kept in the database. Set it as a secret. Without it a key is generated and stored in the database. | none | | `OBOP_SECRET_KEY_PREVIOUS` | Earlier keys, comma separated, that may still protect stored values. Needed between a key change and the end of `obop secrets rotate`. | none | | `OBOP_AUTO_MIGRATE` | `1` lets a starting server run pending schema steps itself; `0` makes it refuse and print `obop migrate run`. `--auto-migrate` and `--no-auto-migrate` override it. | on for SQLite, off for PostgreSQL | | `OBOP_REQUIRE_MFA_FOR_ADMINS` | `0` makes "require two-factor for administrators" off until an administrator stores a value; the default is on. | on | | `OBOP_DEV_INSECURE_KEY` | `1` uses a public key for two-factor secrets and logs a warning. Development only. | off | | `OBOP_CONNECTORS_ALLOW_LOOPBACK` | `1` lets connections reach loopback addresses over plain http. For tests and local development only; the compliance checklist flags it. | off | ## Control plane Used by `obop platform serve`. | Variable | Meaning | | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `OBOP_DATA_DIR` | Where the `local` provisioner keeps instance data. Default `obop-instances`. | | `OBOP_IMAGE` or `OBOP_REPO` (with `OBOP_BRANCH`, default `main`) | Where instance services come from with the `sliplane` provisioner. An image (`ghcr.io/spacecorps/obop:`) needs no build and wins when both are set; a repository means Sliplane builds each instance. | | `OBOP_REGISTRY_CREDENTIAL` | A Sliplane registry credential id (`sliplane credentials create ...`), for a private image. | | `OBOP_UPGRADE_SETTLE_SECS` | Seconds to let a redeploy settle before asking whether the service is live, in `obop platform upgrade-instances` (default 30). | | `OBOP_PLATFORM_ADMINS`, `OBOP_STATUS_INTERVAL_SECS` | Staff emails for the forum and status console; how often the status checks run (default 60; one process per interval runs them). | | `OBOP_MARKETPLACE_URL` | Optional extra catalog for every instance. | ## Sliplane provisioner `--provisioner sliplane` needs: | Variable | Meaning | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `SLIPLANE_ACCOUNT` | Account name the bundled Sliplane CLI is registered under. | | `SLIPLANE_API_KEY` | A Sliplane API key with write access. The container entrypoint registers it with the CLI and removes it from the environment. Set it as a secret. | | `OBOP_SLIPLANE_PROJECT`, `OBOP_SLIPLANE_SERVER` | Where instance services go. | | `OBOP_CELL_ADMIN_URL` | `postgres://` superuser URL of the shared PostgreSQL server, as the control plane reaches it. | | `OBOP_CELL_INSTANCE_HOST` | `host:port` that instances use to reach that server, for example `obop-postgres.internal:5432`. | ## Build time (the website) | Variable | Meaning | | --------------- | ----------------------------------------------------------------------------------------------------------------------------- | | `OBOP_SITE_URL` | Public origin used for canonical links, the sitemap and social cards when building this website. Default: `https://obop.dev`. | ## Tests `OBOP_TEST_POSTGRES_URL` adds PostgreSQL to `cargo test`. `OBOP_BIN` points the end-to-end suite at a built binary.