OrcaCD LogoOrcaCD

Environment Variables

Complete reference for all OrcaCD configuration options

Below are all the environment variables supported by OrcaCD. These should be configured in your .env file. Be cautious when modifying environment variables that are not recommended to change.

Each variable is tagged with a Type:

  • Required - OrcaCD will not function correctly without this being set.
  • Recommended - optional, but recommended to change
  • Security - optional, but recommended to harden your deployment.
  • Optional - safe to leave at the default value.

General

These environment variables can be used in both the agent and the hub.

VariableDefault ValueTypeDescription
LOG_LEVELinfo OptionalLog level. Options: trace, debug, info, warn, error, fatal
LOG_JSONfalseOptionalEnable JSON formatted logs.

Hub

VariableDefault ValueTypeDescription
APP_URL-RequiredThe URL of the OrcaCD instance
APP_SECRET-RequiredSecret used for authentication and encryption. Generate one with openssl rand -base64 42
TRUSTED_PROXIES-RecommendedRecommended if using a reverse proxy. Comma seperated list of network origins
DISABLE_LOCAL_AUTHfalseSecurityDisable password authentication. Useful when using SSO with OIDC
ALLOWED_IPS-SecurityHarden the hub by only allowing requests from certain IPs. Comma seperated list of CIDR ranges or single IPs. This does not apply to webhooks or the agent connections.
HOST0.0.0.0OptionalHost address
PORT8080OptionalContainer port
DISABLE_UIfalseOptionalDisable serving the frontend. Useful when using the hub only for API access.
ALLOWED_INTERNAL_IPS-OptionalPrivate IPs that should be ignored by the SSRF protection. Comma seperated list of CIDR ranges or single IPs
DEMOfalseOptionalThis mode disables all functions except the login and additionally seeds some demo data in the database

Agent

VariableDefault ValueTypeDescription
HUB_URL-RequiredThe URL of the Hub. Example: https://example.com
AUTH_TOKEN- RequiredThe authentication token of the agent. Register an agent in the hub frontend to retrieve it
RESTRICT_VOLUMES_TO_DEPLOYMENTS_DIRfalseSecurityRestrict the volumes that can be mounted to locations within the OrcaCD deployments directory. This enhances security.
ALLOWED_PRIVILEGED_APPS-OptionalComma seperated list of app id that are allowed to bypass certain restrictions enforced by OrcaCD

Last updated on

On this page