Configuration (environment variables)

All Celestian configuration comes from environment variables (the deploy/.env file). No port or URL is written in the code. PUBLIC_BASE_URL is the single source of the public URL.

Address and web

Variable	Default	Description
PUBLIC_BASE_URL		The public URL exactly as users open it (https://host, with a port if not 443).
WEB_BIND, WEB_PORT	127.0.0.1, 3100	The web HTTP address and port for the reverse proxy.
DATA_DIR	./data	The host folder for all persistent data. Created and given an owner by data-init.
TZ	Asia/Jakarta	The container time zone.
LOG_LEVEL	info	The log level.

Secrets

Variable	Description
PG_PASSWORD, TSDB_PASSWORD, APP_DB_PASSWORD, REDIS_PASSWORD	Data service passwords. Created by gen-secrets.sh.
JWT_PRIVATE_KEY, SESSION_SECRET	Token and session signing.
BROKER_SERVICE_SECRET	The password of the internal service principals on the broker (callout and the presence consumer). Do not share it.
SECRETS_KEY	Encrypts stored credentials and firmware download addresses. Do not change or lose it; back it up off the server.

Accounts and access

Variable	Default	Description
SIGNUP_ENABLED	false	Self-registration. With false, registration is still possible through an invitation link.
ALLOW_UNVERIFIED_LOGIN	false	Allow sign-in before the e-mail is verified (temporary only, if SMTP is not working yet).
DEFAULT_MAX_WORKSPACES, DEFAULT_MAX_DEVICES, DEFAULT_MAX_CHANNELS	1, 1, 1	The quota of new accounts. -1 = unlimited. Older accounts are unlimited.
ADMIN_USERNAME, ADMIN_PASSWORD_HASH, ADMIN_SESSION_TTL	empty, empty, 8h	The admin console (Admin console). Empty = the console is off.
INVITATION_TTL	168h	The lifetime of invitations and ownership-transfer offers.
WORKSPACE_DELETE_GRACE	168h	The workspace deletion grace period. 0 = permanent immediately.
AUDIT_RETENTION	4320h (180 days)	Journal retention.
GROUPS_MAX_DEPTH	10	The maximum group hierarchy depth (1 to 50).

E-mail

Variable	Description
SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD	The SMTP server. SMTP_HOST must be exactly as in the certificate.
SMTP_SECURITY	auto (465 = implicit TLS, others STARTTLS), implicit, or starttls.
SMTP_FROM	The sender, for example "Celestian <no-reply@example.com>".

MQTT and devices

Variable	Default	Description
MQTT_BIND, MQTT_PORT, MQTT5_PORT	127.0.0.1, 1883, 1884	The bind address and ports for MQTT 3.1.1 and MQTT 5. The auth callout is active, so 0.0.0.0 may be opened.
MQTTS_PORT, MQTTS_BIND	8883	MQTT with TLS (MQTTS and NTP).
MQTTS_CERT_DIR, MQTTS_CERT_FILE, MQTTS_KEY_FILE, MQTTS_RELOAD_CHECK_S		The certificate source and the check interval (300 seconds by default).
BOOTSTRAP_BROKER_URL		The broker address for devices (mqtt://host:1883): used by the Credentials tab and Bootstrap templates.
BROKERAUTH_CLIENT_ID_POLICY	prefix (production)	prefix: the client ID must start with the device ID. any for development.
PRESENCE_RELAYED_OFFLINE_AFTER	15m	A sensor behind a gateway is considered offline when there is no data for this long or the gateway is offline.
SENFLAT_DEDUP_TTL	72h	How long a SenFlat v2 q number is remembered to drop duplicates.
DEVICECONFIG_RECONCILE_INTERVAL, DEVICECONFIG_MAX_RESENDS, DEVICECONFIG_ROLLOUT_INTERVAL	30s, 10, 15s	The configuration reconciler and rules rollout. 0 = off.

Rules and reports

Variable	Default	Description
RULES_ALLOW_PRIVATE_TARGETS	false	Allow PostgreSQL, Webhook, and Telegram outputs to reach private or local addresses.
RULES_LUA_TIMEOUT	500ms	The Lua logic time limit.
RULES_GO_WORKERS, RULES_GO_TIMEOUT, RULES_GO_MEMORY_MB	2, 500ms, 256	The Go logic workers. 0 workers = Go is disabled.
RULES_GO_ISOLATION, RULES_GO_NAMESPACES	auto, false	OS isolation of Go workers on Linux: auto, strict, or off.
REPORTS_PDF_URL		The PDF rendering service (http://gotenberg:3000). Empty = reports are CSV only.
REPORTS_PDF_TIMEOUT	60s
REPORTS_MAX_ROWS, REPORTS_MAX_FILE_BYTES, REPORTS_RETENTION, REPORTS_WORKERS	200000, 25 MiB, 720h, 2	Report limits.
PDF_MEM_LIMIT	1g	The memory limit of the PDF service.

Firmware and maps

Variable	Default	Description
FIRMWARE_MAX_BYTES	8388608	The maximum size of one firmware file.
FIRMWARE_URL_TTL	720h	The lifetime of signed download addresses.
OTA_INTERVAL	15s	The rollout engine sweep interval. 0 = off.
MAP_TILE_URL, MAP_TILE_ATTRIBUTION	OpenStreetMap	Map tiles for the metadata editor and map widgets. Fill in your own tile server on closed networks.

Backup

Variable	Default	Description
BACKUP_DIR	./backups	The backup output folder.
BACKUP_KEEP_DAYS	7	How long backups are kept.

Note

This list is the variables changed most often. The deploy/.env.example file that ships with your release contains the complete list with a comment for each variable.