# Environment variables

> Every environment variable of the server, the client commands, the runner and the tasks.

<!-- Generated by `just gen` from internal/app/config.go. Do not edit this file. -->

This page lists every environment variable that Sluice reads.

## Server

`sluice server` and the other server commands read these variables.

| Variable | Default | Description |
|---|---|---|
| `SLUICE_DATABASE_URL` | required | Postgres URL. A pooled URL (PgBouncer transaction mode, Neon pooler) is allowed. |
| `SLUICE_LISTEN_ADDR` | `:8080` | HTTP listen address. |
| `SLUICE_PUBLIC_URL` | required for `server` | External base URL for links, cookies and webhooks. An https URL makes the session cookie Secure. |
| `SLUICE_INTERNAL_URL` | `http://127.0.0.1:<port>` | Base URL that runners call. Use the Service URL in Kubernetes. |
| `SLUICE_MASTER_KEYS` | empty | Master keys for builtin secrets as kid:base64key pairs separated by commas. The first key is active. |
| `SLUICE_BOOTSTRAP_ADMIN_EMAIL` | empty | Email of the first admin. Used only when the users table is empty. |
| `SLUICE_BOOTSTRAP_ADMIN_PASSWORD` | empty | Password of the first admin. Used only when the users table is empty. |
| `SLUICE_SESSION_TTL` | `168h` | Sliding session lifetime. |
| `SLUICE_LOG_LEVEL` | `info` | Server log level. |
| `SLUICE_LOG_FORMAT` | `json` | Server log format. |
| `SLUICE_POOLS` | `default` | Comma-separated pools that this instance serves. |
| `SLUICE_EXECUTORS` | `auto` | auto, or a comma-separated list of process, docker and kubernetes. inline is always enabled. |
| `SLUICE_WORKER_SLOTS` | `8` | Slots for process and docker tasks on this instance. |
| `SLUICE_QUEUE_POLL_INTERVAL` | `1s` | Interval between queue claim polls. |
| `SLUICE_HEARTBEAT_TIMEOUT` | `60s` | Time without runner heartbeat after which a task run is checked and can become lost. |
| `SLUICE_SHUTDOWN_GRACE` | `30s` | Maximum time between SIGTERM and process exit. |
| `SLUICE_RETENTION_DAYS` | `90` | Days to keep ended executions with their logs, metrics and artifacts. |
| `SLUICE_STORAGE_TYPE` | `postgres` | Object storage driver. |
| `SLUICE_FS_ROOT` | empty | Root directory of the fs storage driver. |
| `SLUICE_S3_BUCKET` | empty | Bucket of the s3 storage driver. |
| `SLUICE_S3_REGION` | empty | Region of the s3 storage driver. |
| `SLUICE_S3_ENDPOINT` | empty | Endpoint override of the s3 storage driver (Cloudflare R2, MinIO). |
| `SLUICE_S3_FORCE_PATH_STYLE` | `false` | Use path-style addressing in the s3 storage driver. |
| `SLUICE_S3_ACCESS_KEY_ID` | empty | Static access key ID. Empty uses the default AWS credential chain. |
| `SLUICE_S3_SECRET_ACCESS_KEY` | empty | Static secret access key. Empty uses the default AWS credential chain. |
| `SLUICE_S3_PREFIX` | empty | Key prefix in the s3 bucket. |
| `SLUICE_AZBLOB_ACCOUNT_URL` | empty | Account URL of the azblob storage driver. Uses DefaultAzureCredential. |
| `SLUICE_AZBLOB_CONTAINER` | empty | Container of the azblob storage driver. |
| `SLUICE_AZBLOB_CONNECTION_STRING` | empty | Connection string of the azblob storage driver. Used instead of the account URL. |
| `SLUICE_AZBLOB_PREFIX` | empty | Key prefix in the azblob container. |
| `SLUICE_MAX_FILE_BYTES` | `10MiB` | Maximum size of one namespace file. |
| `SLUICE_MAX_BUNDLE_BYTES` | `200MiB` | Maximum total size of one snapshot. |
| `SLUICE_MAX_ARTIFACT_BYTES` | `100MiB` | Maximum size of one artifact. |
| `SLUICE_RUNNER_IMAGE` | `ghcr.io/alternayte/sluice:<version>` for a release, `sluice:dev` otherwise | Image that holds the runner binary for injection into docker and kubernetes tasks. |
| `SLUICE_DOCKER_API_URL` | `http://host.docker.internal:<port>` | Base URL that runners in docker containers call. |
| `SLUICE_DOCKER_KEEP_CONTAINERS` | `false` | Keep docker task containers after completion. |
| `SLUICE_K8S_KUBECONFIG` | empty | Path to a kubeconfig for out-of-cluster access. |
| `SLUICE_K8S_NAMESPACE` | `<own namespace>` | Kubernetes namespace for task Jobs. Default is the namespace of the server pod. |
| `SLUICE_K8S_MAX_JOBS` | `50` | Maximum running Jobs per pool. |
| `SLUICE_K8S_JOB_TTL` | `600s` | ttlSecondsAfterFinished of task Jobs. |
| `SLUICE_K8S_PENDING_TIMEOUT` | `10m` | Maximum time a task pod can stay pending. |
| `SLUICE_SECRET_CACHE_TTL` | `60s` | Cache lifetime of external secret values. |
| `SLUICE_VAULT_ADDR` | empty | HashiCorp Vault address. |
| `SLUICE_VAULT_TOKEN` | empty | HashiCorp Vault token. |
| `SLUICE_VAULT_K8S_ROLE` | empty | HashiCorp Vault Kubernetes auth role. Used when no token is set. |
| `SLUICE_AI_MAX_CONTEXT_CHARS` | `120000` | Maximum characters of model context. |
| `SLUICE_SECRET_<KEY>` | empty | Value of secret `<KEY>` for the env secret provider. |

Azure credentials use the standard `AZURE_*` variables, workload identity or managed identity.

## Client commands

The client commands (`sluice run`, `sluice executions`, `sluice flows` and `sluice namespaces push`) read these variables.

| Variable | Description |
|---|---|
| `SLUICE_URL` | Base URL of the Sluice server, for example `https://sluice.example.com`. |
| `SLUICE_TOKEN` | API token. Create one on Settings, API tokens. The role of the token limits what the commands can do. |

## Installer

`install.sh` reads these variables.

| Variable | Description |
|---|---|
| `SLUICE_VERSION` | Release to install, for example `0.2.0`. Empty installs the newest release. |
| `SLUICE_BIN_DIR` | Directory of the binary. Empty uses `/usr/local/bin`, or `~/.local/bin` when that needs a password and sudo is not there. |

## Runner

The server sets these variables for `sluice exec`, the runner inside a task. Do not set them yourself.

| Variable | Description |
|---|---|
| `SLUICE_API_URL` | URL of the runner API of the server. |
| `SLUICE_RUN_TOKEN` | Token of one task run. It expires with the task run. |
| `SLUICE_TASK_RUN_ID` | ID of the task run. |

## Task environment

Every task that runs on an executor gets these variables.

| Variable | Value |
|---|---|
| `SLUICE_EXECUTION_ID` | ID of the execution. |
| `SLUICE_TASK_ID` | ID of the task in the flow. |
| `SLUICE_ATTEMPT` | Attempt number, from 1. |
| `SLUICE_NAMESPACE` | Namespace of the flow. |
| `SLUICE_FLOW_ID` | ID of the flow. |
| `SLUICE_OUTPUTS` | Path of the outputs file. Each line is one output, metric or artifact as JSON. |
| `SLUICE_WORKDIR` | Directory that holds the namespace files. |