# Settings (/docs/using/app-users/settings)



These are service settings for a self-hosted stack. A Compose install sets them up (`init-secrets` writes the keys and tokens into the `secrets` volume once, and `chelabase-init bootstrap` sets up the identity service), and so does `just workbench up` on a workbench stack. You only change them to tune lifetimes or intervals, or to point services at each other. On a Compose install, set the tunables in `.env` (see `.env.example`).

| Variable                                                         | Default                                                                                                                                                                                                                      | Read by                                                                                                                                                                                                                     |
| ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `CHELABASE_IDENTITY_URL` / `CHELABASE_IDENTITY_TOKEN_FILE`       | `http://identity:8080`; self-hosted: each caller's `tokens/<caller>-identity.token` in the `secrets` volume                                                                                                                  | orchestrator, worker, auth. Pool and user administration in the [identity service](/docs/architecture/identity). When it can't be reached the app-user routes answer 503 `identity_unavailable` and the worker's jobs wait. |
| `CHELABASE_APP_JWT_PRIVATE_KEY` / `CHELABASE_APP_JWT_PUBLIC_KEY` | self-hosted: `auth/app-jwt.{key,pub}` in the `secrets` volume, made once by `init-secrets` and never overwritten; workbench: the stack's `stack.env` (`.chelabase/auth/app-jwt.{key,pub}`, made once by `just workbench up`) | auth signs, the gateway verifies. Without them app users are off.                                                                                                                                                           |
| `CHELABASE_APP_AUTH_INTERNAL_TOKEN`                              | `chelabase-dev-app-auth`                                                                                                                                                                                                     | auth to the orchestrator's internal app routes                                                                                                                                                                              |
| `CHELABASE_APP_SESSIONS_INTERNAL_TOKEN`                          | `chelabase-dev-app-sessions`                                                                                                                                                                                                 | gateway to the orchestrator, for session liveness                                                                                                                                                                           |
| `CHELABASE_APP_ACCESS_TTL_SECS`                                  | `900` (60 to 86400)                                                                                                                                                                                                          | auth                                                                                                                                                                                                                        |
| `CHELABASE_APP_REFRESH_TTL_SECS`                                 | `2592000` (30 days; 1 to 7776000, the 90-day cap)                                                                                                                                                                            | orchestrator                                                                                                                                                                                                                |
| `CHELABASE_APP_USERS_RECONCILE_SECS`                             | `300` (30 to 86400)                                                                                                                                                                                                          | worker                                                                                                                                                                                                                      |
| `CHELABASE_INTERNAL_URL`                                         | `http://127.0.0.1:8083`                                                                                                                                                                                                      | auth, gateway and rest (the orchestrator's internal listener)                                                                                                                                                               |
| `CHELABASE_WORKER_REMOVE_ORPHANS`                                | `true`                                                                                                                                                                                                                       | worker. Whether reconcile removes compute containers no endpoint row records.                                                                                                                                               |

A value outside its range stops the service at start with an error that names the variable.

<Callout type="warn">
  The two `*_INTERNAL_TOKEN` defaults are for local development. Set your own values anywhere the stack isn't just on your machine.
</Callout>