Environment reference
Every variable the panel reads from its process environment. This is the
reference for running the panel by hand -- from the dev shell, or as a
standalone service. On NixOS you do not set these directly: the
services.panel options derive them, and where a row
below shadows one, the option is named in its description.
Variables marked full are only used in the full local-dev setup (Windmill
plus Centrifugo); leave them unset for the simple synchronous setup. See
panel/README.md
for how to bring either of those up, and the
api/ environment reference
for the variables of the api server that the panel talks to.
| Variable | Setup | Default | Description |
|---|---|---|---|
CREDENTIALS_DIRECTORY |
both | -- | Directory with one file per secret: SECRET_KEY (required) and AUTHZ_CALLBACK_TOKEN (optional: the token that api/ must send to the authz callback of the panel; empty accepts calls without a token). The dev shell sets it to panel/.credentials, writes a SECRET_KEY and links AUTHZ_CALLBACK_TOKEN to $XDG_RUNTIME_DIR/fediversity-authz/token, the token that api-http-stack sends. NixOS: systemd LoadCredential=, from secrets. |
DATABASE_URL |
both | -- | Database of the panel, in dj-database-url syntax. The dev shell sets it to sqlite:///<checkout>/panel/src/db.sqlite3. NixOS: an SQLite file under /var/lib/panel. |
DEBUG |
both | off | 1 turns on the debug mode of Django. The dev shell sets 1. NixOS: off. |
API_BROWSER_BASE_URL |
both | -- | Base URL of api/ that the browser uses, to get the schema and the rename table for the deployment form. For local development, set http://127.0.0.1:8088, and add the origin of the panel to API_CORS_ORIGINS of api/. Unset, the browser gets them from the panel itself, which has no /schema route, so the form fails with 404. NixOS: apiBaseUrl. |
API_HTTP_URL |
both | http://127.0.0.1:8088 |
Base URL of api/ that the panel process uses, for the state poll behind the loading screens, the configuration diff and the deployment list. NixOS: apiBaseUrl. |
API_DOCS_URL |
both | -- | URL of a Swagger UI page for api/. The account page links it beside the button that copies an API token. Unset, the account page names the Swagger UI without a link. NixOS: apiDocsUrl. |
CENTRIFUGO_BROWSER_WS_URL |
full | -- | WebSocket URL of Centrifugo, for example ws://127.0.0.1:8090/connection/websocket. Unset, the loading screens only poll api/. Use the same host as in the address bar of the browser, or the browser does not send the session cookie and the connection fails. NixOS: centrifugo.wsDomain. |
SESSION_COOKIE_DOMAIN |
both | -- | Domain of the session cookie. Set it when Centrifugo is on another subdomain, so that the browser sends the cookie on the WebSocket handshake. NixOS: domain when centrifugo.wsDomain is below it, else the parent of domain. |
API_TOKEN_TTL |
both | 300 |
Lifetime in seconds of the api/ bearer token of the browser. The panel makes a new token from the session when the old one is near its expiry. |
RECONCILE_TOKEN_TTL |
both | 3600 |
Lifetime in seconds of the reconcile token that the browser gives api/ with a DELETE. api/ sends it back when the destroy is complete. |
OIDC_ISSUER |
both | -- | Issuer URL of the OpenID Connect provider. Single sign-on is on only when OIDC_ISSUER, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET_FILE are all set; password login stays available. NixOS: oidc.issuer. |
OIDC_CLIENT_ID |
both | -- | Client ID of the panel at the OpenID Connect provider. NixOS: oidc.clientID. |
OIDC_CLIENT_SECRET_FILE |
both | -- | Path to a file that contains the client secret. NixOS: staged from the oidc contract. |
OIDC_SCOPES |
both | -- | Space-separated scopes to request. NixOS: oidc.scopes. |
OIDC_DISPLAY_NAME |
both | single sign-on |
Name of the provider on the login button. NixOS: oidc.displayName. |
OIDC_REDIRECT_IS_HTTPS |
both | off | 1 makes the callback URLs https://, for a panel behind a TLS proxy. NixOS: production. |
USER_SETTINGS_FILE |
both | -- | Path to a Python file whose top-level names override the Django settings. The panel reads it last. NixOS: settings and extra-settings. |
XDG_STATE_HOME |
both | ~/.local/state |
manage incus_bootstrap writes TF_VAR_* values to $XDG_STATE_HOME/fediversity/tf-env. The dev shell and api-http-stack of api/ read that file on start. |
DOAS_USER, SUDO_USER |
both | -- | Set by doas or sudo. When manage incus_bootstrap runs as root, it writes tf-env to the home of this user, not to the home of root. |
The dev shell also sets NPINS_DIRECTORY to the npins/ directory of the
checkout, for the npins command.
Build-time only
| Variable | Read by | Description |
|---|---|---|
SELF_MODULE_SOURCE |
panel/default.nix |
JSON fetchTree pin of the revision of the repository, which the deploy family gives to core. Nix reads it only under nix-shell/nix-build or --impure. panel/flake.nix derives the pin from the flake itself, so with flakes you do not set it. |