App users
Settings
The environment variables that configure app users.
These are service settings for a self-hosted stack. A Compose install sets them up (init-secrets writes the keys and tokens into the secrets volume once, and chelabase-init bootstrap sets up the identity service), and so does just workbench up on a workbench stack. You only change them to tune lifetimes or intervals, or to point services at each other. On a Compose install, set the tunables in .env (see .env.example).
| Variable | Default | Read by |
|---|---|---|
CHELABASE_IDENTITY_URL / CHELABASE_IDENTITY_TOKEN_FILE | http://identity:8080; self-hosted: each caller's tokens/<caller>-identity.token in the secrets volume | orchestrator, worker, auth. Pool and user administration in the identity service. When it can't be reached the app-user routes answer 503 identity_unavailable and the worker's jobs wait. |
CHELABASE_APP_JWT_PRIVATE_KEY / CHELABASE_APP_JWT_PUBLIC_KEY | self-hosted: auth/app-jwt.{key,pub} in the secrets volume, made once by init-secrets and never overwritten; workbench: the stack's stack.env (.chelabase/auth/app-jwt.{key,pub}, made once by just workbench up) | auth signs, the gateway verifies. Without them app users are off. |
CHELABASE_APP_AUTH_INTERNAL_TOKEN | chelabase-dev-app-auth | auth to the orchestrator's internal app routes |
CHELABASE_APP_SESSIONS_INTERNAL_TOKEN | chelabase-dev-app-sessions | gateway to the orchestrator, for session liveness |
CHELABASE_APP_ACCESS_TTL_SECS | 900 (60 to 86400) | auth |
CHELABASE_APP_REFRESH_TTL_SECS | 2592000 (30 days; 1 to 7776000, the 90-day cap) | orchestrator |
CHELABASE_APP_USERS_RECONCILE_SECS | 300 (30 to 86400) | worker |
CHELABASE_INTERNAL_URL | http://127.0.0.1:8083 | auth, gateway and rest (the orchestrator's internal listener) |
CHELABASE_WORKER_REMOVE_ORPHANS | true | worker. Whether reconcile removes compute containers no endpoint row records. |
A value outside its range stops the service at start with an error that names the variable.
The two *_INTERNAL_TOKEN defaults are for local development. Set your own values anywhere the stack isn't just on your machine.