orkiva Core environment settings#
| Setting | Purpose |
|---|---|
| PORT | HTTP listening port; the default is 8080. |
| JWT_SECRET | Session-signing secret. Keep it stable and private. |
| ORKIVA_ENCRYPT_KEY | Encryption key for protected persisted data. Preserve it with your recovery material. |
| DB_TYPE / DB_DSN | Database driver and connection/location settings. The available database drivers are SQLite, MySQL and PostgreSQL. Follow the database requirements for your deployment profile and distributed components. |
| ORKIVA_BASE | Application URL subpath when served under a prefix. Configure the proxy and client route base consistently. |
| ORKIVA_CONFIG_FILE | Path to the optional managed configuration file. |
| ORKIVA_TRUSTED_HOSTS / ORKIVA_TRUSTED_ORIGINS | Reviewed public hostnames/origins accepted by the deployment. |
| TRUSTED_PROXIES | Direct proxy addresses or CIDRs allowed to supply forwarding headers. |
| CORS_ALLOWED_ORIGINS | Explicit cross-origin browser origins; this is not a replacement for authentication. |
File-managed configuration#
The configuration loader supports managed sections for clusters, OAuth, LDAP, RBAC and the superuser. When a section is file-managed, the UI presents it as read-only and the backend rejects UI changes. Edit the managed configuration through your deployment process and confirm that the watcher applied it.
Do not maintain conflicting values in the file and UI. Keep secret-bearing configuration outside source-control history unless it is encrypted and handled by your organization’s approved process.
Reverse proxy and TLS#
- Terminate TLS at the reviewed ingress or gateway and route requests to Orkiva.
- Set the public host/origin and trusted direct proxy values to match that route.
- If using a subpath, verify login, static files, API routes, redirects and WebSocket connections beneath that same prefix.
- Test both normal page navigation and a log stream. A working homepage alone does not validate WebSockets or authentication callbacks.
The chart has an explicit externally terminated TLS declaration for profiles that need it. This is a declaration of your reviewed external setup, not a switch that creates or validates an external gateway.
Configuration failures#
Startup can reject unsafe or inconsistent settings. Read the specific startup error, correct the configuration and restart. Do not bypass a validation by broadening trusted destinations or turning a production profile off merely to silence the error. Use the standard profile only when it actually matches the installation you intend to operate.