At a glance
Database
POSTGRES_DB_URI is where the Control Plane stores its state. It runs
migrations and the organization bootstrap against this database before it
listens, so it has to be reachable at startup.
?sslmode=disable
if your database does not support TLS.
Address
API_URL is the address the web app and every Sidecar reach the deployment on.
It must carry a scheme.
Identity provider
Authentication is local by default: the Control Plane manages users and passwords itself. SettingIDP_ISSUER switches it to OIDC, and a client id and
secret are required with it.
The redirect the provider must have registered is
<API_URL>/api/callback.
It is built from API_URL, so the two move together. The startup output names
the one it resolved:
IDP_GROUPS_CLAIM defaults to https://app.hoop.dev/groups. Set it when your
provider puts groups somewhere else — groups for Keycloak and Okta, for
instance.
IDP_CUSTOM_SCOPES takes a comma-separated list; each entry is trimmed and one
already present is skipped.
IDP_AUDIENCE is only added to the authorization request when it is non-empty.
Auth0 is the common case.
There is no
AUTH_METHOD. The method is inferred: any IDP_* variable selects OIDC, none leaves local.SAML is not configurable by environment at all. It is read from the database, and once that row exists the database supplies the method too — so an authconfig row overrides everything above at runtime, and these values are the boot defaults rather than the last word.See Identity Providers for the per-provider settings.TLS
Two variables, one rule: set both to serve HTTPS, leave both empty to serve plaintext.
Nothing is generated and half a pair serves plaintext rather than failing.
Three forms work for either value:
Logging
LOG_LEVEL is matched case-insensitively and anything unrecognised falls back
to info rather than failing.
LOG_ENCODING decides the encoder, and anything other than the four values
above produces JSON. json is the right choice for a log pipeline; console
and human are for reading in a terminal.
GIN_MODE set to debug adds a per-request HTTP access log on top of whatever
LOG_LEVEL allows. It is the only thing this variable changes here.
Migrations
SQL migrations are compiled into the binary and run at every boot, soMIGRATION_PATH_FILES is empty by default and nothing is read from disk.
Set it only if you manage migration files yourself:
Next
Kubernetes
Deploy it on Kubernetes.
Container Images
What each flavour contains and what it already sets.