Environment Variables
Configuration enters the stack at two levels: the bundle .env file (read
by Docker Compose in an offline install) and per-container environment
variables (set by the compose files themselves). This page lists both.
Bundle .env (release install)
Section titled “Bundle .env (release install)”| Variable | Default | Effect |
|---|---|---|
AIBOARD_JWT_SECRET | generated at install | JWT signing key (≥ 32 bytes). Mandatory — the release compose refuses to start without it. |
AIBOARD_HTTP_PORT | 80 | Dashboard HTTP port. |
AIBOARD_ALT_PORT | 3000 | Secondary dashboard port. |
AIBOARD_HTTPS_PORT | 443 | HTTPS port (TLS overlay only). |
AIBOARD_TLS_ENABLED | 0 | 1 = serve HTTPS with the generated self-signed cert and redirect 80 → 443. |
AIBOARD_TLS_HOST | — | Space/comma-separated IPs/hostnames baked into the cert’s SAN. |
AIBOARD_TLS_DIR | /opt/aiboard/tls | Where cert.pem / key.pem live (absolute path recorded at install). |
AIBOARD_CERTS_ENABLED | 0 | 1 = mount operator-provisioned datasource client certificates. |
AIBOARD_CERTS_DIR | /opt/aiboard/certs | CA + client certs for secured MQTT / OPC UA, mounted read-only. |
AIBOARD_MODEL_SEED_DIR | /opt/aiboard/models | Seed model directory. |
AIBOARD_BACKUP_KEEP | 3 | How many database backups an update keeps in the backups folder of the install directory, newest first. Older ones are deleted after a healthy update. 0 keeps every backup. A value that is not a whole number falls back to 3. |
BACKEND_IMAGE · FRONTEND_IMAGE · INFERENCE_IMAGE | from bundle manifest | Image tags to run — managed by install.sh / update.sh; do not edit by hand. |
Backend container
Section titled “Backend container”| Variable | Default (release) | Effect |
|---|---|---|
ASPNETCORE_ENVIRONMENT | Production | Selects the configuration overlay. |
Grpc__InferenceService__Address | http://inference:50051 | Inference runtime gRPC target, reached over the internal container network. Port 50051 is bound to the box’s loopback address only by default (AIBOARD_INFERENCE_BIND) and is not reachable from your network. |
Database__ConnectionString | Data Source=/data/aiboard.db | SQLite database location (persistent volume). |
AIBOARD_JWT_SECRET | from .env | JWT signing key fallback; required outside development. |
CORS_ORIGINS | localhost dev origins | Comma-separated allowed browser origins — override when serving the UI from a non-default host. |
AIBOARD_CERTS_ROOT | /certs | Jail root for datasource TLS certificate paths (blocks arbitrary file reads). |
AIBOARD_CSV_ROOT | /data/csv | Jail root for CSV replay/output file paths. |
Deeper backend tuning (token lifetime, rate limits, model validation caps,
retention windows) lives in appsettings keys; any of them can be overridden
with the standard .NET double-underscore convention, e.g.
Auth__Jwt__ExpiryHours=12 or LoginRateLimit__PermitLimit=10.
| appsettings key | Default | Effect |
|---|---|---|
Auth:Jwt:ExpiryHours | 8 | Login token lifetime (no refresh tokens). |
LoginRateLimit:* | on, 5 / 60 s | Per-IP failed-login gate. |
ExternalApi:Enabled + ExternalApi:RateLimit:* | on, 100 / 60 s | External API-key surface and its rate limit. |
ModelManagement:MaxVersionsToKeep | 5 | Version pruning on cleanup. |
ModelManagement:Validation:MaxModelSizeMb | 500 | Upload size cap. |
InferenceObservability:RetentionDays | 1 | Inference audit-log retention (SQLite). |
InferenceObservability:PayloadRetentionHours | 6 | Retention of stored request and response payloads. |
LoggingService:Retention:MaxEntries | 10000 | LogViewer store cap. |
Swagger:Enabled | true (Development only) | Swagger UI at http://<box>:5000/swagger. Ignored outside Development — a shipped box runs ASPNETCORE_ENVIRONMENT=Production and serves no API docs at all. Set false to suppress it during local development. |
Inference container
Section titled “Inference container”| Variable | Default | Effect |
|---|---|---|
EXECUTION_MODE | auto | auto (CUDA, CPU as fallback), cuda, or cpu. TensorRT is not used on the TX2. |
STRICT_EP | off | 1 = refuse to start instead of silently degrading a pinned GPU mode to CPU. |
MODEL_PATH | /app/models/predictive_maintenance_op15.onnx | Seed model loaded at startup (volume-mounted, never baked into the image). |
MODEL_STORAGE_PATH | /data/models | Registered model versions (shared volume with the backend). |
LOG_DIR | /data/logs (release) | Enables the rotating Warning+ forensic log file; unset = console only. |
USE_REAL_INFERENCE | true | Must stay true — mock mode is retired; the service fails fast otherwise. |
INFERENCE_STUB | 0 | Debug bypass that echoes zero predictions. Never enable in production. |
FORCE_CPU | off | Legacy alias for EXECUTION_MODE=cpu. |
Jetson bundles additionally pin OPENBLAS_CORETYPE and run with
runtime: nvidia — see Jetson Deployment.
Frontend container
Section titled “Frontend container”| Variable | Default | Effect |
|---|---|---|
AIBOARD_TLS_ENABLED | 0 | Enables the TLS-aware nginx entrypoint (cert mounted from AIBOARD_TLS_DIR). |
The API and hub URLs are compiled into the frontend at build time
(same-origin /api + /hub/realtime) — there is nothing to configure at
runtime.
Next steps
Section titled “Next steps” Offline Bundle Install Where the .env file comes from and how secrets are generated.
System Architecture Which service reads which setting.
Security Hardening checklist for exposed ports and secrets.