Environment Variables
Configuration enters the stack at two levels: the bundle .env file (read
by Docker Compose in an offline install) and per-container environment
variables (set by the compose files themselves). This page lists both.
Bundle .env (release install)
Section titled “Bundle .env (release install)”| Variable | Default | Effect |
|---|---|---|
AIBOARD_JWT_SECRET | generated at install | JWT signing key (≥ 32 bytes). Mandatory — the release compose refuses to start without it. |
AIBOARD_HTTP_PORT | 80 | Dashboard HTTP port. |
AIBOARD_ALT_PORT | 3000 | Secondary dashboard port. |
AIBOARD_HTTPS_PORT | 443 | HTTPS port (TLS overlay only). |
AIBOARD_TLS_ENABLED | 0 | 1 = serve HTTPS with the generated self-signed cert and redirect 80 → 443. |
AIBOARD_TLS_HOST | — | Space/comma-separated IPs/hostnames baked into the cert’s SAN. |
AIBOARD_TLS_DIR | <bundle>/tls | Where cert.pem / key.pem live (absolute path recorded at install). |
AIBOARD_CERTS_ENABLED | 0 | 1 = mount operator-provisioned datasource client certificates. |
AIBOARD_CERTS_DIR | <bundle>/certs | CA + client certs for secured MQTT / OPC UA, mounted read-only. |
AIBOARD_MODEL_SEED_DIR | <bundle>/models | Seed model directory (re-pointed by update.sh). |
BACKEND_IMAGE · FRONTEND_IMAGE · INFERENCE_IMAGE | from bundle manifest | Image tags to run — managed by install.sh / update.sh; do not edit by hand. |
Backend container
Section titled “Backend container”| Variable | Default (release) | Effect |
|---|---|---|
ASPNETCORE_ENVIRONMENT | Production | Selects the configuration overlay. |
Grpc__InferenceService__Address | http://inference:50051 | Inference runtime gRPC target. |
Database__ConnectionString | Data Source=/data/aiboard.db | SQLite database location (persistent volume). |
AIBOARD_JWT_SECRET | from .env | JWT signing key fallback; required outside development. |
CORS_ORIGINS | localhost dev origins | Comma-separated allowed browser origins — override when serving the UI from a non-default host. |
AIBOARD_CERTS_ROOT | /certs | Jail root for datasource TLS certificate paths (blocks arbitrary file reads). |
AIBOARD_CSV_ROOT | /data/csv | Jail root for CSV replay/output file paths. |
Deeper backend tuning (token lifetime, rate limits, model validation caps,
retention windows) lives in appsettings keys; any of them can be overridden
with the standard .NET double-underscore convention, e.g.
Auth__Jwt__ExpiryHours=12 or LoginRateLimit__PermitLimit=10.
| appsettings key | Default | Effect |
|---|---|---|
Auth:Jwt:ExpiryHours | 8 | Login token lifetime (no refresh tokens). |
LoginRateLimit:* | on, 5 / 60 s | Per-IP failed-login gate. |
ExternalApi:Enabled + ExternalApi:RateLimit:* | on, 100 / 60 s | External API-key surface and its rate limit. |
ModelManagement:MaxVersionsToKeep | 5 | Version pruning on cleanup. |
ModelManagement:Validation:MaxModelSizeMb | 500 | Upload size cap. |
InferenceObservability:RetentionDays | 3 | Inference audit-log retention (SQLite). |
LoggingService:Retention:MaxEntries | 10000 | LogViewer store cap. |
Swagger:Enabled | true | Swagger UI at http://<box>:5000/. Set false to hide API docs in locked-down sites. |
Inference container
Section titled “Inference container”| Variable | Default | Effect |
|---|---|---|
EXECUTION_MODE | auto | auto (TensorRT → CUDA → CPU), tensorrt, cuda, or cpu. |
STRICT_EP | off | 1 = refuse to start instead of silently degrading a pinned GPU mode to CPU. |
MODEL_PATH | /app/models/predictive_maintenance.onnx | Seed model loaded at startup (volume-mounted, never baked into the image). |
MODEL_STORAGE_PATH | /data/models | Registered model versions (shared volume with the backend). |
LOG_DIR | /data/logs (release) | Enables the rotating Warning+ forensic log file; unset = console only. |
USE_REAL_INFERENCE | true | Must stay true — mock mode is retired; the service fails fast otherwise. |
INFERENCE_STUB | 0 | Debug bypass that echoes zero predictions. Never enable in production. |
FORCE_CPU | off | Legacy alias for EXECUTION_MODE=cpu. |
Jetson bundles additionally pin OPENBLAS_CORETYPE and run with
runtime: nvidia — see Jetson Deployment.
Frontend container
Section titled “Frontend container”| Variable | Default | Effect |
|---|---|---|
AIBOARD_TLS_ENABLED | 0 | Enables the TLS-aware nginx entrypoint (cert mounted from AIBOARD_TLS_DIR). |
The API and hub URLs are compiled into the frontend at build time
(same-origin /api + /hub/realtime) — there is nothing to configure at
runtime.
Next steps
Section titled “Next steps” Offline Bundle Install Where the .env file comes from and how secrets are generated.
System Architecture Which service reads which setting.
Security Hardening checklist for exposed ports and secrets.