Environment variables
The environment variables obop reads: database URL, agent token, marketplace URL, and the settings of the control plane and Sliplane provisioner.
obop reads a small number of environment variables. Command line flags win over variables.
Instance and CLI
| Variable | Meaning | Default |
|---|---|---|
OBOP_DATABASE_URL | Where the data lives: sqlite://obop.db, sqlite:///abs/path.db, postgres://user:pass@host/db or memory:. Same as --db. For PostgreSQL add ?sslmode=require (or verify-full with &sslrootcert=/path/ca.pem) to encrypt the connection; see Self-hosting. | sqlite://obop.db |
OBOP_TOKEN | Bearer token for obop mcp, obop call and obop commands. Same as --token. | none |
OBOP_UPDATE_URL, OBOP_UPDATE_TOKEN | Managed instances: the control plane's address and the instance's update token (set by the provisioner; the token is sealed into the database at start). | |
OBOP_UPDATE_FEED | The release feed read when an administrator checks for updates. Default <OBOP_UPDATE_URL>/api/releases, else https://obop.dev/api/releases; off disables. | |
OBOP_BACKUP_DIR | Where the backup taken before an update from inside the instance is written. | |
OBOP_MARKETPLACE_URL | An extra marketplace: a host serving index.json and packages/<id>.toml. Shown after the bundled catalog. | none |
OBOP_BLOB_DIR | Directory for uploaded pictures and files (images on products, pages, posts, documents). Default: next to the SQLite file; PostgreSQL and memory instances keep them in the database. | beside the db |
OBOP_DEMO_PAYMENTS | 1 offers the demo payment provider (fake) to the web shop. For trials and tests only; never set it where real buyers pay. | off |
OBOP_PUBLIC_URL | External URL of an instance behind a proxy (https://acme.example.com), used in the MCP discovery documents, in the 401 challenge of /mcp and as the origin and relying party id of passkeys, which work only at this address. | from the request |
OBOP_ALLOWED_ORIGINS | Comma-separated exact browser origins (https://app.example.com, or http://localhost:5173 for development) allowed to call /api and /mcp from another origin. Wildcards and other invalid values stop the server at start. Bearer tokens only; credentials are never allowed. | none (same origin only) |
OBOP_METRICS_TOKEN | Opens /metrics (Prometheus text) to a scraper that sends this bearer token; at least 16 characters. Without it /metrics is served only on a loopback bind, to direct loopback callers; otherwise it answers 404. /healthz and /readyz are always open. | closed |
OBOP_ALLOWED_ORIGINS | Comma-separated browser origins allowed to call /mcp (DNS-rebinding protection). Clients that are not browsers send no origin. | none |
OBOP_BULK_PER_MINUTE | bulk_create calls (and obop import) one person may start per minute, dry runs included; 0 turns the limit off. | 12 |
OBOP_MCP_RATE_PER_MINUTE | Requests per token per minute on /mcp; 0 turns the limit off. | 600 |
OBOP_SECRET_KEY | The current server key: 32 random bytes as 64 hex digits (openssl rand -hex 32). Seals two-factor secrets, connection credentials, OAuth tokens and pseudonym keys of Connectors (docs/CONNECTORS.md), and the sessions, vaults and approval plans kept in the database. Set it as a secret. Without it a key is generated and stored in the database. | none |
OBOP_SECRET_KEY_PREVIOUS | Earlier keys, comma separated, that may still protect stored values. Needed between a key change and the end of obop secrets rotate. | none |
OBOP_AUTO_MIGRATE | 1 lets a starting server run pending schema steps itself; 0 makes it refuse and print obop migrate run. --auto-migrate and --no-auto-migrate override it. | on for SQLite, off for PostgreSQL |
OBOP_REQUIRE_MFA_FOR_ADMINS | 0 makes "require two-factor for administrators" off until an administrator stores a value; the default is on. | on |
OBOP_DEV_INSECURE_KEY | 1 uses a public key for two-factor secrets and logs a warning. Development only. | off |
OBOP_CONNECTORS_ALLOW_LOOPBACK | 1 lets connections reach loopback addresses over plain http. For tests and local development only; the compliance checklist flags it. | off |
Control plane
Used by obop platform serve.
| Variable | Meaning |
|---|---|
OBOP_DATA_DIR | Where the local provisioner keeps instance data. Default obop-instances. |
OBOP_IMAGE or OBOP_REPO (with OBOP_BRANCH, default main) | Where instance services come from with the sliplane provisioner. An image (ghcr.io/spacecorps/obop:<commit>) needs no build and wins when both are set; a repository means Sliplane builds each instance. |
OBOP_REGISTRY_CREDENTIAL | A Sliplane registry credential id (sliplane credentials create ...), for a private image. |
OBOP_UPGRADE_SETTLE_SECS | Seconds to let a redeploy settle before asking whether the service is live, in obop platform upgrade-instances (default 30). |
OBOP_PLATFORM_ADMINS, OBOP_STATUS_INTERVAL_SECS | Staff emails for the forum and status console; how often the status checks run (default 60; one process per interval runs them). |
OBOP_MARKETPLACE_URL | Optional extra catalog for every instance. |
Sliplane provisioner
--provisioner sliplane needs:
| Variable | Meaning |
|---|---|
SLIPLANE_ACCOUNT | Account name the bundled Sliplane CLI is registered under. |
SLIPLANE_API_KEY | A Sliplane API key with write access. The container entrypoint registers it with the CLI and removes it from the environment. Set it as a secret. |
OBOP_SLIPLANE_PROJECT, OBOP_SLIPLANE_SERVER | Where instance services go. |
OBOP_CELL_ADMIN_URL | postgres:// superuser URL of the shared PostgreSQL server, as the control plane reaches it. |
OBOP_CELL_INSTANCE_HOST | host:port that instances use to reach that server, for example obop-postgres.internal:5432. |
Build time (the website)
| Variable | Meaning |
|---|---|
OBOP_SITE_URL | Public origin used for canonical links, the sitemap and social cards when building this website. Default: https://obop.dev. |
Tests
OBOP_TEST_POSTGRES_URL adds PostgreSQL to cargo test. OBOP_BIN points the end-to-end suite at a built binary.