Configuration

Novodat is configured with environment variables. There is no configuration file of its own and nothing to edit in the database to get started.

Where to set them

How you run Novodat	Where the variables go
Docker image	An env file passed with --env-file (start from docker/novodat.env.example), or environment: in Compose
From source	The environment of the process, or a .env file at the root of the repository
Platforms (Kubernetes, PaaS…)	The environment of the container, with secrets from the platform's secret store

How values are read

• They are validated when the server starts. If one is missing or wrong, Novodat does not start, and the message names every wrong variable (never its value).
• Empty means unset. CORS_ORIGIN= is the same as not writing the line, so the default applies.
• Yes/no values accept true/false, 1/0, yes/no and on/off.
• Lists are comma-separated: CORS_ORIGIN=https://a.example.com,https://b.example.com.
• Durations of the retention settings are a whole number and a unit: s, m (minutes), h, d, w or y (365 days), such as 90d or 12h. Other times are plain numbers of seconds, as each table says.
• Changes need a restart. Values are read once, when the process starts.

The minimum

DB_CLIENT=pg
DB_HOST=localhost
DB_DATABASE=novodat
DB_USER=novodat
DB_PASSWORD=change-me

SECRET=a-random-value-of-at-least-32-characters
PUBLIC_URL=https://data.example.com

# Only for the first start: the administrator to create
ADMIN_EMAIL[email protected]
ADMIN_PASSWORD=change-me-too

Generate SECRET with openssl rand -base64 48. It signs the access tokens and encrypts the AI keys stored from the Desk: keep it secret, and keep it stable.

Reference

Page	What it covers
Database	Engine, connection, pool, PostgreSQL schemas
Server	SECRET, PUBLIC_URL, port, logs, Desk, CORS, base map
Security	Token lifetimes, rate limits, proxies
Single sign-on	OpenID Connect, OAuth 2.0, SAML and LDAP
Email	SMTP and password recovery
Files	Storage locations (local, S3, Azure, Google Cloud) and image transformations
Cache and Redis	Schema cache, several instances, background jobs
GraphQL and WebSockets	Query limits and real-time subscriptions
Flows and extensions	Limits of flows, extension loading, variables they may read
AI and MCP	Language and embedding models, vector search, MCP server
Retention	Automatic cleanup of the activity log, revisions and flow runs