Operations
Configuration
Configure SOIT services, providers, storage, secrets, and runtime options.
SOIT configuration spans application settings, service endpoints, provider credentials, and runtime behavior. Environment-specific values live outside code — the local stack reads them from .env (start from .env.example), and deployments use environment variables.
Common configuration areas
| Area | What it covers |
|---|---|
| Hosts and ports | API (9200) and web (5000) bind addresses in the local stack |
| Database | PostgreSQL connection URL — business data, runtime ledger, outbox |
| Redis | Broker/cache URL for queues and runtime coordination |
| Object storage | MinIO or S3-compatible endpoint, bucket, and credentials for documents and artifacts |
| Vector database | Milvus endpoint and collection settings |
| Secret storage | Vault address and access configuration |
| Bootstrap | BOOTSTRAP_ADMIN_EMAIL / BOOTSTRAP_ADMIN_PASSWORD for the first admin account |
| Model providers | Configured through ModelHub at runtime — credentials stored as secret references, not env vars |
| Plugins | Package and installation directories (plugins_dir, default ./var/plugins) |
| Workers | Celery queue and concurrency configuration |
| Process role | SOIT_ROLE: all (default) or gateway, which serves only the gateway and runs no background work — new in v1.4.0; see Running the gateway on its own |
| Edition and license | PLATFORM_EDITION and PLATFORM_ENTITLEMENTS without a license; ENTERPRISE_LICENSE_PATH and ENTERPRISE_LICENSE_PUBLIC_KEY_PATH for a signed Enterprise license — new in v1.4.0; see Editions and Licenses |
| Private networks | EGRESS_PRIVATE_NETWORKS: private or loopback networks (CIDR) governed calls may reach, empty by default — new in v1.4.0; see Private networks |
| Telemetry | TELEMETRY_ENABLED (off by default) and TELEMETRY_ENDPOINT — new in v1.4.0; see Telemetry |
| Approval sweeper | APPROVAL_SWEEPER_ENABLED (on in the shipped compose files) and APPROVAL_SWEEPER_INTERVAL (30 seconds): expires overdue approval requests and closes those of ended runs — new in v1.6.1; see Approvals |
Configuration principles
- Secrets are references. Provider keys and connector credentials belong in Vault, referenced as
secret:name. The only plaintext credentials in environment configuration are the bootstrap admin account and infrastructure connection strings. - Runtime capability config is data, not env. Which models are active, which plugins are enabled, and what egress is allowed are workspace-level records managed through the product, not deployment configuration. The deployment only decides which private or loopback networks egress may reach at all (
EGRESS_PRIVATE_NETWORKS). - Settings code has no side effects. The
app/settings/layer parses configuration and feature flags; it makes no external calls.
Hygiene
Do not hard-code local credentials, provider keys, or workspace secrets in docs, source code, tests, or examples. Keep .env files and generated evidence out of commits.
Related pages
- Deployment — the services this configuration feeds.
- Secrets and Security — the secret reference model.
- Editions and Licenses and Telemetry — the license and telemetry settings in detail.