# Environment Variables

> Every operator-tunable environment variable — the bundle .env file, backend, inference runtime, and TLS knobs.

Configuration enters the stack at two levels: the **bundle `.env` file** (read
by Docker Compose in an offline install) and **per-container environment
variables** (set by the compose files themselves). This page lists both.

In a bundle install you normally edit only `compose/.env` — the installer
generates it from `.env.template` and it survives updates. Per-container
variables are pre-wired by the release compose; override them only with a
compose override file you maintain yourself.

## Bundle `.env` (release install)

| Variable | Default | Effect |
|---|---|---|
| `AIBOARD_JWT_SECRET` | generated at install | JWT signing key (≥ 32 bytes). **Mandatory** — the release compose refuses to start without it. |
| `AIBOARD_HTTP_PORT` | `80` | Dashboard HTTP port. |
| `AIBOARD_ALT_PORT` | `3000` | Secondary dashboard port. |
| `AIBOARD_HTTPS_PORT` | `443` | HTTPS port (TLS overlay only). |
| `AIBOARD_TLS_ENABLED` | `0` | `1` = serve HTTPS with the generated self-signed cert and redirect 80 → 443. |
| `AIBOARD_TLS_HOST` | — | Space/comma-separated IPs/hostnames baked into the cert's SAN. |
| `AIBOARD_TLS_DIR` | `<bundle>/tls` | Where `cert.pem` / `key.pem` live (absolute path recorded at install). |
| `AIBOARD_CERTS_ENABLED` | `0` | `1` = mount operator-provisioned datasource client certificates. |
| `AIBOARD_CERTS_DIR` | `<bundle>/certs` | CA + client certs for secured MQTT / OPC UA, mounted read-only. |
| `AIBOARD_MODEL_SEED_DIR` | `<bundle>/models` | Seed model directory (re-pointed by `update.sh`). |
| `BACKEND_IMAGE` · `FRONTEND_IMAGE` · `INFERENCE_IMAGE` | from bundle manifest | Image tags to run — managed by `install.sh` / `update.sh`; do not edit by hand. |

## Backend container

| Variable | Default (release) | Effect |
|---|---|---|
| `ASPNETCORE_ENVIRONMENT` | `Production` | Selects the configuration overlay. |
| `Grpc__InferenceService__Address` | `http://inference:50051` | Inference runtime gRPC target. |
| `Database__ConnectionString` | `Data Source=/data/aiboard.db` | SQLite database location (persistent volume). |
| `AIBOARD_JWT_SECRET` | from `.env` | JWT signing key fallback; required outside development. |
| `CORS_ORIGINS` | localhost dev origins | Comma-separated allowed browser origins — override when serving the UI from a non-default host. |
| `AIBOARD_CERTS_ROOT` | `/certs` | Jail root for datasource TLS certificate paths (blocks arbitrary file reads). |
| `AIBOARD_CSV_ROOT` | `/data/csv` | Jail root for CSV replay/output file paths. |

Deeper backend tuning (token lifetime, rate limits, model validation caps,
retention windows) lives in `appsettings` keys; any of them can be overridden
with the standard .NET double-underscore convention, e.g.
`Auth__Jwt__ExpiryHours=12` or `LoginRateLimit__PermitLimit=10`.

| appsettings key | Default | Effect |
|---|---|---|
| `Auth:Jwt:ExpiryHours` | `8` | Login token lifetime (no refresh tokens). |
| `LoginRateLimit:*` | on, 5 / 60 s | Per-IP failed-login gate. |
| `ExternalApi:Enabled` + `ExternalApi:RateLimit:*` | on, 100 / 60 s | External API-key surface and its rate limit. |
| `ModelManagement:MaxVersionsToKeep` | `5` | Version pruning on cleanup. |
| `ModelManagement:Validation:MaxModelSizeMb` | `500` | Upload size cap. |
| `InferenceObservability:RetentionDays` | `3` | Inference audit-log retention (SQLite). |
| `LoggingService:Retention:MaxEntries` | `10000` | LogViewer store cap. |
| `Swagger:Enabled` | `true` | Swagger UI at `http://<box>:5000/`. Set `false` to hide API docs in locked-down sites. |

## Inference container

| Variable | Default | Effect |
|---|---|---|
| `EXECUTION_MODE` | `auto` | `auto` (TensorRT → CUDA → CPU), `tensorrt`, `cuda`, or `cpu`. |
| `STRICT_EP` | off | `1` = refuse to start instead of silently degrading a pinned GPU mode to CPU. |
| `MODEL_PATH` | `/app/models/predictive_maintenance.onnx` | Seed model loaded at startup (volume-mounted, never baked into the image). |
| `MODEL_STORAGE_PATH` | `/data/models` | Registered model versions (shared volume with the backend). |
| `LOG_DIR` | `/data/logs` (release) | Enables the rotating Warning+ forensic log file; unset = console only. |
| `USE_REAL_INFERENCE` | `true` | Must stay `true` — mock mode is retired; the service fails fast otherwise. |
| `INFERENCE_STUB` | `0` | Debug bypass that echoes zero predictions. **Never enable in production.** |
| `FORCE_CPU` | off | Legacy alias for `EXECUTION_MODE=cpu`. |

Jetson bundles additionally pin `OPENBLAS_CORETYPE` and run with
`runtime: nvidia` — see [Jetson Deployment](/install-deploy/jetson-deployment/).

## Frontend container

| Variable | Default | Effect |
|---|---|---|
| `AIBOARD_TLS_ENABLED` | `0` | Enables the TLS-aware nginx entrypoint (cert mounted from `AIBOARD_TLS_DIR`). |

The API and hub URLs are compiled into the frontend at build time
(same-origin `/api` + `/hub/realtime`) — there is nothing to configure at
runtime.

## Next steps

  - [Offline Bundle Install](/install-deploy/offline-bundle-install/) — Where the .env file comes from and how secrets are generated.
  - [System Architecture](/architecture/) — Which service reads which setting.
  - [Security](/security/) — Hardening checklist for exposed ports and secrets.