pangolin_mirror/docs-v2
1
0
Fork 0
mirror of https://github.com/fosrl/docs-v2.git synced 2026-10-25 04:59:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add _FILE and ENV docs

Browse Source 
Ref #141
This commit is contained in:
Owen
2026-09-15 10:56:56 -04:00
parent ec1a7cf3d7
commit 24e4899c7a
2 changed files with 54 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
self-host/advanced/config-file.mdx
+41 -16
View File
@@ -310,7 +310,7 @@ This section contains the complete reference for all configuration options in `c
**Default**: `false` **Default**: `false`
**Environment Variable**: `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER` **Environment Variable**: `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER` (or `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
<Note> <Note>
Useful when an intermediary proxy sits between Traefik and the AI Gateway and overwrites `X-Forwarded-For`/`X-Real-Ip` instead of appending to them. Requires a Badger version that supports `realIpHeader`. Useful when an intermediary proxy sits between Traefik and the AI Gateway and overwrites `X-Forwarded-For`/`X-Real-Ip` instead of appending to them. Requires a Badger version that supports `realIpHeader`.
@@ -336,7 +336,7 @@ This section contains the complete reference for all configuration options in `c
<ResponseField name="secret" type="string" required> <ResponseField name="secret" type="string" required>
Secret key for encrypting sensitive data. Secret key for encrypting sensitive data.
**Environment Variable**: `SERVER_SECRET` **Environment Variable**: `SERVER_SECRET` (or `SERVER_SECRET_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
**Minimum Length**: 8 characters **Minimum Length**: 8 characters
@@ -765,7 +765,7 @@ This section contains the complete reference for all configuration options in `c
<ResponseField name="smtp_user" type="string"> <ResponseField name="smtp_user" type="string">
SMTP username. SMTP username.
**Environment Variable**: `EMAIL_SMTP_USER` **Environment Variable**: `EMAIL_SMTP_USER` (or `EMAIL_SMTP_USER_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
**Example**: `no-reply@example.com` **Example**: `no-reply@example.com`
</ResponseField> </ResponseField>
@@ -773,7 +773,7 @@ This section contains the complete reference for all configuration options in `c
<ResponseField name="smtp_pass" type="string"> <ResponseField name="smtp_pass" type="string">
SMTP password. SMTP password.
**Environment Variable**: `EMAIL_SMTP_PASS` **Environment Variable**: `EMAIL_SMTP_PASS` (or `EMAIL_SMTP_PASS_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
</ResponseField> </ResponseField>
<ResponseField name="smtp_secure" type="boolean"> <ResponseField name="smtp_secure" type="boolean">
@@ -938,6 +938,8 @@ This section contains the complete reference for all configuration options in `c
<ResponseField name="connection_string" type="string" required> <ResponseField name="connection_string" type="string" required>
PostgreSQL connection string. PostgreSQL connection string.
**Environment Variable**: `POSTGRES_CONNECTION_STRING` (or `POSTGRES_CONNECTION_STRING_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
**Example**: `postgresql://user:password@host:port/database` **Example**: `postgresql://user:password@host:port/database`
<Note> <Note>
@@ -948,6 +950,8 @@ This section contains the complete reference for all configuration options in `c
<ResponseField name="replicas" type="array of objects"> <ResponseField name="replicas" type="array of objects">
Read-only replica database configurations for load balancing. Read-only replica database configurations for load balancing.
**Environment Variable**: `POSTGRES_REPLICA_CONNECTION_STRINGS`, a comma-separated list of connection strings (or `POSTGRES_REPLICA_CONNECTION_STRINGS_FILE` to read the same comma-separated list from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
<Expandable title="Replica Configuration"> <Expandable title="Replica Configuration">
<ResponseField name="connection_string" type="string" required> <ResponseField name="connection_string" type="string" required>
Connection string for the read replica database. Connection string for the read replica database.
@@ -1016,7 +1020,7 @@ This section contains the complete reference for all configuration options in `c
<ResponseField name="connection_string" type="string"> <ResponseField name="connection_string" type="string">
Connection string for the dedicated logs database. Connection string for the dedicated logs database.
**Environment Variable**: `POSTGRES_LOGS_CONNECTION_STRING` **Environment Variable**: `POSTGRES_LOGS_CONNECTION_STRING` (or `POSTGRES_LOGS_CONNECTION_STRING_FILE` to read the value from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
**Example**: `postgresql://user:password@host:port/logs_database` **Example**: `postgresql://user:password@host:port/logs_database`
@@ -1028,6 +1032,8 @@ This section contains the complete reference for all configuration options in `c
<ResponseField name="replicas" type="array of objects"> <ResponseField name="replicas" type="array of objects">
Read-only replica configurations for the logs database. Read-only replica configurations for the logs database.
**Environment Variable**: `POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS`, a comma-separated list of connection strings (or `POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS_FILE` to read the same comma-separated list from a file — see [Reading secrets from a file](#reading-secrets-from-a-file-_file-suffix))
<Expandable title="Replica Configuration"> <Expandable title="Replica Configuration">
<ResponseField name="connection_string" type="string" required> <ResponseField name="connection_string" type="string" required>
Connection string for the read replica logs database. Connection string for the read replica logs database.
@@ -1179,14 +1185,33 @@ The catalog feeds Known Models pickers, wildcard discovery, provider selection,
Some configuration values can be set using environment variables for enhanced security: Some configuration values can be set using environment variables for enhanced security:
| Name | Variable | Config | | Name | Variable | Config | Supports `_FILE` |
|------|----------|--------| |------|----------|--------|:---:|
| Server Secret | `SERVER_SECRET` | `server.secret` | | Server Secret | `SERVER_SECRET` | `server.secret` | YES |
| Email Username | `EMAIL_SMTP_USER` | `email.smtp_user` | | Email Username | `EMAIL_SMTP_USER` | `email.smtp_user` | YES |
| Email Password | `EMAIL_SMTP_PASS` | `email.smtp_pass` | | Email Password | `EMAIL_SMTP_PASS` | `email.smtp_pass` | YES |
| PostgreSQL Connection String | `POSTGRES_CONNECTION_STRING` | `postgres.connection_string` | | PostgreSQL Connection String | `POSTGRES_CONNECTION_STRING` | `postgres.connection_string` | YES |
| PostgreSQL Replica Connection Strings | `POSTGRES_REPLICA_CONNECTION_STRINGS` | `postgres.replicas` (comma-separated list of connection strings) | | PostgreSQL Replica Connection Strings | `POSTGRES_REPLICA_CONNECTION_STRINGS` | `postgres.replicas` (comma-separated list of connection strings; the file, if used, should contain the same comma-separated list) | YES |
| PostgreSQL Logs Connection String | `POSTGRES_LOGS_CONNECTION_STRING` | `postgres_logs.connection_string` | | PostgreSQL Logs Connection String | `POSTGRES_LOGS_CONNECTION_STRING` | `postgres_logs.connection_string` | YES |
| PostgreSQL Logs Replica Connection Strings | `POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS` | `postgres_logs.replicas` (comma-separated list of connection strings) | | PostgreSQL Logs Replica Connection Strings | `POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS` | `postgres_logs.replicas` (comma-separated list of connection strings; the file, if used, should contain the same comma-separated list) | YES |
| Enable SQLite WAL Mode | `ENABLE_SQLITE_WAL_MODE` | *(SQLite only)* Set to `true` to enable [WAL mode](https://www.sqlite.org/wal.html) for improved SQLite concurrency | | Enable SQLite WAL Mode | `ENABLE_SQLITE_WAL_MODE` | *(SQLite only)* Set to `true` to enable [WAL mode](https://www.sqlite.org/wal.html) for improved SQLite concurrency | YES |
| Enable AI Gateway Client IP Header | `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER` | `server.enable_ai_gateway_client_ip_header` | | Enable AI Gateway Client IP Header | `ENABLE_AI_GATEWAY_CLIENT_IP_HEADER` | `server.enable_ai_gateway_client_ip_header` | YES |
### Reading secrets from a file (`_FILE` suffix)
For any variable marked "Supports `_FILE`" above, you can set `<VARIABLE>_FILE` instead of `<VARIABLE>` to a path on disk, and Pangolin will read that file and use its (trimmed) contents as the value. This is the standard way to consume [Docker/Swarm secrets](https://docs.docker.com/engine/swarm/secrets/) — for example a secret mounted at `/run/secrets/server_secret` — without ever putting the raw value in `config.yml`, a `.env` file, or the container's visible environment.
Setting both `<VARIABLE>` and `<VARIABLE>_FILE` at the same time is an error.
```yaml title="docker-compose.yml"
services:
pangolin:
secrets:
- server_secret
environment:
- SERVER_SECRET_FILE=/run/secrets/server_secret
secrets:
server_secret:
file: ./secrets/server_secret.txt
```
self-host/advanced/private-config-file.mdx
+13 -1
View File
@@ -106,6 +106,8 @@ This section contains the complete reference for all configuration options in `p
<ResponseField name="password" type="string"> <ResponseField name="password" type="string">
Redis authentication password. Redis authentication password.
**Environment Variable**: `REDIS_PASSWORD` (or `REDIS_PASSWORD_FILE` to read the value from a file — see [Reading secrets from a file](/self-host/advanced/config-file#reading-secrets-from-a-file-_file-suffix))
```yaml ```yaml
redis: redis:
@@ -493,4 +495,14 @@ This section contains the complete reference for all configuration options in `p
### Branding Configuration ### Branding Configuration
Please refer to the [branding configuration documentation](/manage/branding). Please refer to the [branding configuration documentation](/manage/branding).
## Environment Variables
Some configuration values can be set using environment variables for enhanced security:
| Name | Variable | Config | Supports `_FILE` |
|------|----------|--------|:---:|
| Redis Password | `REDIS_PASSWORD` | `redis.password` | ✅ |
Any variable marked "Supports `_FILE`" can also be set as `<VARIABLE>_FILE`, pointing to a file on disk whose (trimmed) contents are used as the value instead — see [Reading secrets from a file](/self-host/advanced/config-file#reading-secrets-from-a-file-_file-suffix) in the main configuration file docs for details and a Docker Compose example.