Configure · Complete reference

Manager environment

A sanitized, searchable public copy of every Manager template key, with actual defaults, sensitivity, consumer, failure behavior, and the change required to apply it.

Configuration file model

A local .env is for foreground or development use; keep it out of Git and protect it with mode 0600. systemd uses /etc/pauiops/pauiops.env, normally root-owned, mode 0640, and readable only by root and the service group.

Exported process variables win over file-loaded values. Re-running the installer preserves unrelated settings and secrets while synchronizing only installer-managed keys and tightening permissions. Most runtime changes need a restart; service identity, binary path, sudo policy, or installer-managed paths need -service=enable.

bash

curl -fsSLo manager.env.example https://pauiops.kpa.ph/manager.env.example
chmod 600 manager.env.example

Sanitized template

60 of 60 variables shown. Secrets are labeled but never populated with real values.

PAUIOPS_SECURE_COOKIE

Browser & privileged access · Optional

booleanNot secret+

Default

false; inferred for trusted HTTPS

Safe example

Behavior

Forces Secure cookies. Use only when the browser reaches Manager over HTTPS.

Consumer

Manager HTTP server

Apply change

Restart

PAUIOPS_ALLOWED_ORIGINS

Browser & privileged access · Optional

comma-separated originsNot secret+

Default

same-origin only

Safe example

https://center.pauiops.kpa.ph

Behavior

Exact CORS and WebSocket browser origins; never use * in production.

Consumer

Manager HTTP/WebSocket server

Apply change

Restart

SUDO_PASSWORD

Browser & privileged access · Conditional

passwordSensitive+

Default

empty; privileged actions disabled

Safe example

<generated-in-protected-environment>

Behavior

Used only with the exact Dashboard sudo allowlist. A dedicated account can receive an installer-generated value; human account passwords are never changed.

Consumer

Manager service identity

Apply change

Run -service=enable

ANTHROPIC_API_KEY

Browser & privileged access · Optional

API keySensitive+

Default

empty; suggestions disabled

Safe example

<anthropic-api-key>

Behavior

Enables review-only Git or Docker command suggestions; commands never auto-execute.

Consumer

Manager suggestion service

Apply change

Restart

PAUIOPS_APP_NAME

Application & project root · Optional

textNot secret+

Default

PAUIOps Manager

Safe example

PAUIOps Manager

Behavior

Changes the displayed application identity.

Consumer

Manager UI and API

Apply change

Restart

PAUIOPS_APP_VERSION

Application & project root · Optional

release versionNot secret+

Default

build version

Safe example

<release-version>

Behavior

Reported by version and health responses; release automation normally supplies it.

Consumer

Manager API

Apply change

Restart

PAUIOPS_ADMIN_EMAIL

Application & project root · Optional

emailNot secret+

Default

empty

Safe example

ops@example.com

Behavior

May be used as an author-email fallback; it is not a login credential.

Consumer

Manager

Apply change

Restart

PAUIOPS_ROOT_PATH

Application & project root · Required

absolute pathNot secret+

Default

current directory in foreground development

Safe example

/home/deploy/repos

Behavior

Production startup validates protected paths, symlinks, traversal, and writability. An unsafe or inaccessible root is fatal.

Consumer

Manager service identity

Apply change

Run -service=enable for service installs

PAUIOPS_SERVICE_USER

Linux service lifecycle · Optional

Linux accountNot secret+

Default

installer-resolved

Safe example

pauiops

Behavior

Explicit or existing-unit identity wins. root is rejected.

Consumer

Service installer

Apply change

Run -service=enable

PAUIOPS_SERVICE_GROUP

Linux service lifecycle · Optional

Linux groupNot secret+

Default

installer-resolved

Safe example

pauiops

Behavior

Controls managed-root group ownership; Docker socket group membership remains separate and highly privileged.

Consumer

Service installer

Apply change

Run -service=enable

PAUIOPS_SERVICE_GROUP_WRITE

Linux service lifecycle · Optional

booleanNot secret+

Default

derived from shared-group use

Safe example

true

Behavior

Selects whether the configured project group receives write access.

Consumer

Service installer

Apply change

Run -service=enable

PAUIOPS_MANAGER_INSTALL_PATH

Linux service lifecycle · Optional

absolute executable pathNot secret+

Default

/usr/local/bin/pauiops

Safe example

/usr/local/bin/pauiops

Behavior

Must be a full executable path and is shared by service install and binary upgrade.

Consumer

Service installer and upgrader

Apply change

Run -service=enable

PAUIOPS_UPGRADE_HEALTH_URL

Linux service lifecycle · Optional

HTTP(S) URLNot secret+

Default

empty; systemd active check only

Safe example

http://127.0.0.1:51800/api/ready

Behavior

Adds an application-level 2xx gate after a Manager binary upgrade.

Consumer

Binary upgrader

Apply change

Next upgrade invocation

PAUIOPS_UPGRADE_HEALTH_TIMEOUT

Linux service lifecycle · Optional

Go durationNot secret+

Default

30s

Safe example

30s

Behavior

Bounds the optional post-upgrade health gate; invalid values fall back with a warning.

Consumer

Binary upgrader

Apply change

Next upgrade invocation

PAUIOPS_OTP_REQUIRED

booleanNot secret+

Default

false

Safe example

true

Behavior

Requires a six-digit second factor after password login. Working SMTP or controlled code logging becomes required.

Consumer

Authentication service

Apply change

Restart

PAUIOPS_OTP_TTL

Go durationNot secret+

Default

Safe example

Behavior

Sets login-code lifetime; password-reset codes use a separate fixed flow.

Consumer

Authentication service

Apply change

Restart

PAUIOPS_OTP_BYPASS_EMAIL

emailNot secret+

Default

empty

Safe example

admin@example.com

Behavior

Temporary break-glass bypass for one address; reduces security and emits a warning.

Consumer

Authentication service

Apply change

Restart

PAUIOPS_OTP_LOG_CODES

booleanNot secret+

Default

false

Safe example

false

Behavior

Logs login and reset codes for controlled diagnosis. This is a temporary security reduction.

Consumer

Authentication service

Apply change

Restart

PAUIOPS_SMTP_HOST

hostnameNot secret+

Default

empty

Safe example

smtp.example.com

Behavior

No delivery default exists; required when email-based OTP or recovery must work.

Consumer

Manager mailer

Apply change

Restart

PAUIOPS_SMTP_PORT

integer portNot secret+

Default

provider-dependent

Safe example

587

Behavior

Must match the configured SMTP service.

Consumer

Manager mailer

Apply change

Restart

PAUIOPS_SMTP_USERNAME

textSensitive+

Default

empty

Safe example

ops@example.com

Behavior

Leave empty only when the SMTP server permits the intended unauthenticated flow.

Consumer

Manager mailer

Apply change

Restart

PAUIOPS_SMTP_PASSWORD

passwordSensitive+

Default

empty

Safe example

<smtp-password>

Behavior

Protect in the service environment; Manager has no usable mail password default.

Consumer

Manager mailer

Apply change

Restart

PAUIOPS_SMTP_FROM_EMAIL

emailNot secret+

Default

empty

Safe example

ops@example.com

Behavior

Must be accepted by the selected SMTP provider.

Consumer

Manager mailer

Apply change

Restart

PAUIOPS_CLOUDFLARE_API_TOKEN

Cloudflare · Conditional

API tokenSensitive+

Default

empty; integration disabled

Safe example

<scoped-cloudflare-token>

Behavior

Configure with only the cache-purge permission for the intended zone.

Consumer

Manager integration

Apply change

Restart

PAUIOPS_CLOUDFLARE_ZONE_ID

Cloudflare · Conditional

zone IDSensitive+

Default

empty

Safe example

<cloudflare-zone-id>

Behavior

Must identify the same intended zone as the token and record name.

Consumer

Manager integration

Apply change

Restart

PAUIOPS_CLOUDFLARE_RECORD_NAME

Cloudflare · Conditional

DNS record nameNot secret+

Default

empty

Safe example

app.example.com

Behavior

Names the configured record context for cache operations.

Consumer

Manager integration

Apply change

Restart

PAUIOPS_DB_DRIVER

Database & first administrator · Optional

sqlite | mysqlNot secret+

Default

sqlite

Safe example

sqlite

Behavior

Invalid drivers are fatal. MySQL is never auto-migrated.

Consumer

Manager database layer

Apply change

Restart

PAUIOPS_DB_DSN

Database & first administrator · Optional

path or MySQL DSNSensitive+

Default

pauiops.db

Safe example

/var/lib/pauiops/pauiops.db

Behavior

SQLite migration uses verified backup and refuses ambiguity; a MySQL DSN may contain a password.

Consumer

Manager database layer

Apply change

Restart

PAUIOPS_BOOTSTRAP_ADMIN_USERNAME

Database & first administrator · Conditional

usernameNot secret+

Default

empty

Safe example

admin

Behavior

Used only when no account or importable legacy user exists.

Consumer

Manager bootstrap

Apply change

Restart

PAUIOPS_BOOTSTRAP_ADMIN_PASSWORD

Database & first administrator · Conditional

strong passwordSensitive+

Default

empty

Safe example

<strong-one-time-password>

Behavior

Remove immediately after the first successful login; it is not a recurring credential.

Consumer

Manager bootstrap

Apply change

Restart

PAUIOPS_BOOTSTRAP_ADMIN_EMAIL

Database & first administrator · Conditional

emailNot secret+

Default

empty

Safe example

admin@example.com

Behavior

Required with the other bootstrap values when the user database is empty.

Consumer

Manager bootstrap

Apply change

Restart

PAUIOPS_ROLES_JSON

Roles & command presets · Optional

JSON array/objectNot secret+

Default

built-in roles

Safe example

<valid-roles-json>

Behavior

Invalid JSON is fatal; an override must contain at least one role and include admin.

Consumer

Authorization layer

Apply change

Restart

PAUIOPS_GIT_PRESETS_JSON

Roles & command presets · Optional

valid JSONNot secret+

Default

built-in presets

Safe example

[]

Behavior

Commands are normalized; presets never bypass permissions or destructive confirmations.

Consumer

Terminal UI

Apply change

Restart

PAUIOPS_BUTTON_PRESETS_JSON

Roles & command presets · Optional

valid JSONNot secret+

Default

built-in presets

Safe example

[]

Behavior

Adds repeatable action buttons within the current role and project scope.

Consumer

Manager UI

Apply change

Restart

PAUIOPS_GIT_USERNAME

Git · Conditional

provider usernameSensitive+

Default

empty

Safe example

<git-provider-username>

Behavior

Must be paired with PAUIOPS_GIT_PASSWORD. Used for app clone and service-user credential-store setup.

Consumer

Manager Git runners

Apply change

Restart

PAUIOPS_GIT_PASSWORD

Git · Conditional

scoped provider tokenSensitive+

Default

empty

Safe example

<provider-access-token>

Behavior

A normal account password is usually unsuitable. Clearing it does not remove a previously stored credential.

Consumer

Manager Git runners

Apply change

Restart

PAUIOPS_GIT_HOST

Git · Optional

bare HTTPS host[:port]Not secret+

Default

github.com

Safe example

github.com

Behavior

No scheme or repository path. Changing hosts preserves the old host entry until explicitly rejected.

Consumer

Credential auto-configuration

Apply change

Restart

PAUIOPS_GIT_AUTHOR_NAME

Git · Optional

textNot secret+

Default

PAUIOPS_GIT_USERNAME fallback

Safe example

PAUIOps Automation

Behavior

Injected per app-owned commit and never authenticates the remote.

Consumer

App Git runner

Apply change

Restart

PAUIOPS_GIT_AUTHOR_EMAIL

Git · Optional

emailNot secret+

Default

PAUIOPS_ADMIN_EMAIL fallback

Safe example

ops@example.com

Behavior

Injected per app-owned commit without changing global or repository configuration.

Consumer

App Git runner

Apply change

Restart

PAUIOPS_AWS_ACCESS_KEY_ID

AWS RDS allowlisting · Optional

AWS credentialSensitive+

Default

SDK credential chain

Safe example

<leave-empty-for-instance-role>

Behavior

Prefer an instance role or standard SDK chain over static keys.

Consumer

AWS SDK in Manager

Apply change

Restart

PAUIOPS_AWS_SECRET_ACCESS_KEY

AWS RDS allowlisting · Optional

AWS secretSensitive+

Default

SDK credential chain

Safe example

<leave-empty-for-instance-role>

Behavior

Requires the matching access-key ID if static credentials are deliberately used.

Consumer

AWS SDK in Manager

Apply change

Restart

PAUIOPS_AWS_SESSION_TOKEN

AWS RDS allowlisting · Optional

temporary session tokenSensitive+

Default

SDK credential chain

Safe example

<temporary-session-token>

Behavior

Use only with temporary credentials that require it.

Consumer

AWS SDK in Manager

Apply change

Restart

PAUIOPS_AWS_DEFAULT_REGION

AWS RDS allowlisting · Conditional

AWS regionNot secret+

Default

SDK/provider resolution

Safe example

ap-southeast-1

Behavior

Must match the intended security group region.

Consumer

AWS SDK in Manager

Apply change

Restart

PAUIOPS_AWS_RDS_SECURITY_GROUP_ID

AWS RDS allowlisting · Conditional

sg- identifierSensitive+

Default

empty; feature disabled

Safe example

sg-0123456789abcdef0

Behavior

The credential requires the narrow EC2 ingress permission for this intended group.

Consumer

Manager RDS integration

Apply change

Restart

PAUIOPS_AWS_RDS_DATABASE_PORT

AWS RDS allowlisting · Optional

integer portNot secret+

Default

3306

Safe example

3306

Behavior

Creates the narrowly scoped ingress rule for the database port.

Consumer

Manager RDS integration

Apply change

Restart

PAUIOPS_TRUST_PROXY_HEADERS

AWS RDS allowlisting · Optional

booleanNot secret+

Default

false

Safe example

true

Behavior

Trust forwarded source/protocol only behind a controlled proxy that replaces untrusted headers.

Consumer

Manager HTTP server

Apply change

Restart

PAUIOPS_SESSION_TIMEOUT

Operational limits · Optional

Go durationNot secret+

Default

24h

Safe example

24h

Behavior

Controls session lifetime; invalid values fall back with a warning where implemented.

Consumer

Authentication service

Apply change

Restart

PAUIOPS_COMMAND_TIMEOUT

Operational limits · Optional

Go durationNot secret+

Default

10m

Safe example

10m

Behavior

Bounds buffered commands and safety checks; diagnose slow Git before increasing it.

Consumer

Command runner

Apply change

Restart

PAUIOPS_MAX_CONCURRENT_COMMANDS

Operational limits · Optional

non-negative integerNot secret+

Default

0 (unlimited)

Safe example

Behavior

0 means unlimited only for command concurrency.

Consumer

Command runner

Apply change

Restart

PAUIOPS_SHUTDOWN_TIMEOUT

Operational limits · Optional

Go durationNot secret+

Default

25s

Safe example

25s

Behavior

Keeps graceful draining below the generated unit’s TimeoutStopSec=30.

Consumer

Manager lifecycle

Apply change

Restart

PAUIOPS_FILE_WATCH_INTERVAL

Operational limits · Optional

Go durationNot secret+

Default

Safe example

Behavior

Controls file-tree refresh cadence.

Consumer

File workspace

Apply change

Restart

PAUIOPS_OVERVIEW_INTERVAL

Operational limits · Optional

Go durationNot secret+

Default

10s

Safe example

10s

Behavior

Controls overview metric refresh cadence.

Consumer

Overview streamer

Apply change

Restart

PAUIOPS_MAX_EDIT_FILE_MB

Operational limits · Optional

positive MB integerNot secret+

Default

Safe example

Behavior

Files above the limit cannot be edited in the browser.

Consumer

File API

Apply change

Restart

PAUIOPS_MAX_UPLOAD_MB

Operational limits · Optional

positive MB integerNot secret+

Default

Safe example

Behavior

Requests above the upload-body limit are rejected.

Consumer

File API

Apply change

Restart

PAUIOPS_SEARCH_MAX_RESULTS

Operational limits · Optional

positive integerNot secret+

Default

300

Safe example

300

Behavior

Caps file search results for predictable resource use.

Consumer

Search API

Apply change

Restart

PAUIOPS_SEARCH_MAX_FILE_MB

Operational limits · Optional

positive MB integerNot secret+

Default

Safe example

Behavior

Skips oversized files during content search.

Consumer

Search API

Apply change

Restart

PAUIOPS_SYSTEMD_UNIT_PATH

Disposable test overrides · Test only

absolute file pathNot secret+

Default

/etc/systemd/system/pauiops.service

Safe example

<temporary-test-path>

Behavior

Unsupported for ordinary production path customization.

Consumer

Integration harness

Apply change

Next one-shot command

PAUIOPS_SYSTEMD_ENV_PATH

Disposable test overrides · Test only

absolute file pathNot secret+

Default

/etc/pauiops/pauiops.env

Safe example

<temporary-test-path>

Behavior

Keep unset outside disposable integration environments.

Consumer

Integration harness

Apply change

Next one-shot command

PORT

Implementation-supported additions · Optional

integer portNot secret+

Default

51800

Safe example

51800

Behavior

Foreground HTTP port; -port overrides it. This key is supported but not printed in the sanitized source template.

Consumer

Manager HTTP server

Apply change

Restart

Template status

Implementation-supported addition; not printed in the source template

PAUIOPS_PUBLIC_IP_ECHO_URL

Implementation-supported additions · Optional

single HTTP(S) URLNot secret+

Default

built-in bounded endpoint

Safe example

https://ip.example.com

Behavior

Optional server-side public-IP echo for self-hosted or air-gapped discovery; never use a secret-bearing URL.

Consumer

Manager RDS integration

Apply change

Restart

Template status

Implementation-supported addition; not printed in the source template

Implementation-supported additions

PORT and PAUIOPS_PUBLIC_IP_ECHO_URL are supported at runtime but are deliberately marked as supplemental because they are not printed in the sanitized source template. The drift check keeps that distinction explicit.