Configuration

Deeplinq reads process environment variables. It does not auto-load .env files. Use your deployment platform's secret manager and environment injection.

Configuration is fail-closed: malformed values, incomplete credential pairs, unknown DSN parameters, unsafe production switches, and invalid numeric ranges refuse startup.

Production mode

Set:

ENVIRONMENT=production

Production rejects in-memory fallback and development fixtures. ENVIRONMENT, ENV, and GO_ENV are aliases; the first set value wins.

Durable backends

Variable	Purpose
`DATABASE_MIGRATION_URL`	Schema-owner DSN used only for startup migrations
`DATABASE_APP_URL`	`engine_app` DSN for tenant requests under forced RLS
`DATABASE_SYSTEM_URL`	`engine_system` DSN for workers and control plane
`S3_URL`	Source and derived object storage
`VECTOR_URL`	Weaviate retrieval storage
`REDIS_URL`	Durable admin-session validity

The three PostgreSQL URLs are all-or-nothing and must name distinct roles. DATABASE_URL is a shared development/test fallback and is not a production substitute.

DSN examples:

postgres://engine_app:pass@db:5432/deeplinq?sslmode=require
s3://ACCESS:SECRET@storage.example.com/deeplinq?region=us-east-1
weaviates://:API_KEY@weaviate.example.com:443?hybrid_alpha=0.75
rediss://:PASSWORD@redis.example.com:6379/0

Percent-encode reserved characters in DSN credentials. URL fragments and unknown query parameters are rejected.

Root security

Variable	Purpose	Default
`SECRETS_KEY`	Versioned AES-256-GCM keyring for sealed credentials and admin-cookie key derivation	required in production
`AUDIT_ANCHOR_KEY`	HMAC key for signed audit-chain anchors	required in production
`JWT_AUDIENCE`	Required tenant JWT audience	`deeplinq`
`JWT_MAX_TTL`	Maximum accepted JWT lifetime	`15m`
`ADMIN_USERNAME`, `ADMIN_PASSWORD`	Break-glass browser and Basic-auth admin	disabled unless both set
`ADMIN_UI`	Embedded console switch; `0` disables	on when admin credentials exist
`ADMIN_SESSION_TTL`	Browser session lifetime	`12h`
`TRUSTED_PROXY_CIDRS`	Proxies trusted to supply client IP for login throttling	unset
`BILLING_TOKEN`	Reserved billing-service credential	disabled
`MEMORY_TOKEN`	Memory-sidecar credential toward the engine	disabled

SECRETS_KEY accepts one base64 32-byte key or a rotation keyring such as:

2:<new-base64-key>,1:<old-base64-key>

The highest version seals new values; all listed versions may decrypt.

Optional sidecars

Variable	Capability when set
`DOCLING_URL`	Real document extraction and chunking
`CRAWLER_URL`	JavaScript-capable website crawling
`CRAWLER_ALLOWED_HOSTS`	Production hostname allowlist for crawling
`DUCKDB_URL`	CSV/XLSX ingestion and Text-to-SQL
`MEMORY_URL`	Semantic memory distillation and retrieval
`MEMORY_SIDECAR_TOKEN`	Distinct engine-to-memory credential
`GUARDRAIL_URL`, `GUARDRAIL_TOKEN`	Environment-provisioned safety classifier

Do not reuse MEMORY_TOKEN as MEMORY_SIDECAR_TOKEN; they protect opposite trust directions.

Product and capacity controls

Variable	Default	Purpose
`MAX_INFLIGHT_PER_ORG`	`16`	Concurrent model calls before immediate `429`
`INGEST_WORKERS`	`4`	Durable ingestion worker concurrency
`JOB_MAX_EXECUTION_TIME`	`10m`	One worker-attempt ceiling
`JOB_RESCUE_STUCK_AFTER`	`11m`	Abandoned-work recovery horizon
`KNOWLEDGE_AGENT_ENABLED`	`0`	Exact `1` enables knowledge-agent runtime
`SCHEDULE_ORG_CAP`	`1000`	Active schedule ceiling
`PROJECTS_ORG_CAP`	`1000`	Project ceiling
`DATASETS_ORG_CAP`	`1000`	Standalone dataset ceiling
`TEAMS_ORG_CAP`	`200`	Team ceiling
`TEAM_MEMBERS_CAP`	`1000`	Members per team
`AGENTS_ORG_CAP`	`500`	Agent ceiling
`CONNECTIONS_INVOKE_CONCURRENCY`	`4`	Concurrent connection tools per org
`AGENT_RUN_MAX_TURNS`	`16`	Default durable-run turn bound
`AGENT_RUN_WALL_CLOCK_MINUTES`	`10`	Default run deadline
`AGENT_RUN_APPROVAL_TIMEOUT_HOURS`	`24`	Approval parking limit
`AGENT_RUN_DEFAULT_BUDGET_MICRO_USD`	`0`	Default run budget; `0` means no dedicated cap
`AGENT_RUN_TOOL_RESULT_MAX_BYTES`	`262144`	Maximum result passed back to a model

Capacity values have validated inclusive ranges. Tune from observed production load, not by disabling the ceilings.

Conversations and memory

Variable	Default
`CONVERSATION_COMPACT_TRIGGER_TOKENS`	`24000`
`CONVERSATION_KEEP_VERBATIM_TURNS`	`20`
`CONVERSATION_COMPACT_MODEL`	`auto`
`MEMORY_BLOCK_TOKEN_BUDGET`	`1000`
`MEMORY_TIMEOUT`	`120s`

Networking and telemetry

Variable	Purpose
`ADDR`	HTTP listen address, default `:8080`
`HTTP_BODY_READ_TIMEOUT`	Request-body deadline without cutting off SSE
`PUBLIC_URL`	HTTPS base used to build OAuth callbacks
`LOG_LEVEL`	`debug`, `info`, `warn`, or `error`
`OTEL_EXPORTER_OTLP_ENDPOINT`	Enables OpenTelemetry export
`OTEL_EXPORTER_OTLP_PROTOCOL`	OTLP transport, default `http`
`OTEL_SERVICE_NAME`	Trace service, default `deeplinq-engine`

SEED, FAKE_LLM, FAKE_KNOWLEDGE_AGENT_SCENARIO, FAKE_LLM_RECORDER_URL, CRAWLER_ALLOW_PRIVATE, WEBHOOK_ALLOW_HTTP, WEBHOOK_ALLOW_PRIVATE, CONNECT_ALLOW_HTTP, and provider endpoint overrides are rejected in production.

Never commit environment files, credentials, or generated secret values.