Skip to main content
The control plane validates its environment at startup with a strict schema. An invalid or missing required value stops the process immediately rather than failing later at runtime. In Kubernetes, most of these are set by the chart. You normally only manage the secret values.

​
Required

​
string
required
PostgreSQL connection string. Also checked by /api/health.
​
string
required
Signs session cookies. Minimum 32 characters. Changing it invalidates all active sessions.
​
string
required
AES-256-GCM key protecting provider API keys, custom headers, MCP headers, and OIDC client secrets. Minimum 32 characters.
Changing this value does not re-encrypt existing data. Every stored credential becomes unreadable. Treat it as part of your backup set, not as a rotatable key.

​
General

​
string
default:"self-hosted"
self-hosted or managed. A self-hosted installation has no paywall, never contacts a payment provider, and keeps registration invite-only. managed enables subscription billing and open sign-up and is used only by the hosted r5d.chat service. The chart sets this from edition.
​
string
default:"http://localhost:3000"
The external URL of the installation. Must be a valid URL. The chart sets this from publicUrl. A mismatch with the browser’s address breaks cookies and auth redirects.
​
string
Optional one-time token required to create the first administrator. Minimum 16 characters when set. Once setup completes, the value is no longer consulted.

​
Billing

Read only when EDITION=managed. Billing stays inert until the access token, webhook secret, and product id are all present, so an incompletely configured managed installation grants access rather than locking everyone out.
​
string
Polar organization access token used to read subscriptions and open checkout and portal sessions.
​
string
Shared secret used to verify signatures on POST /api/auth/polar/webhooks.
​
string
Product whose subscription grants access. Subscriptions to any other product in the same organization are ignored.
​
string
default:"production"
production or sandbox.
​
integer
default:"72"
Hours a lapsed subscription keeps access after its last paid period ends.

​
Outbound request guard

The control plane makes outbound requests to model providers, MCP servers, and OIDC issuers. Every destination passes through a guard that blocks credential-bearing URLs, unsafe redirects, and internal network addresses.
​
'true' | 'false'
default:"false"
Allow requests to private, loopback, and link-local addresses. Required to reach a model server inside your own network. Enabling this makes SSRF against cluster-internal services possible.
​
'true' | 'false'
default:"false"
Allow plain http:// destinations. Credentials would travel unencrypted, so restrict this to trusted private networks.
Metadata endpoints such as 169.254.169.254 are a standard cloud credential theft target. Leave both flags at false unless you have a specific need and compensating network policy.

​
Workspace controller

​
'kubernetes' | 'local' | 'disabled'
default:"local"
How workspaces are provisioned. The chart always sets kubernetes. Use local for development and disabled to turn off workspace features entirely.
​
string
default:"r5d-chat"
Namespace where workspace objects are created. The chart sets this to the release namespace.
​
string
default:"ghcr.io/ricsam/r5d-chat-workspace:latest"
Image used for new and reconciled workspace pods.
​
string
Pull secret attached to workspace pods. Needed for private images.
​
string
default:"rook-ceph-block"
Storage class for per-user home PVCs.
​
string
default:"5Gi"
Size requested for each new home PVC. Applies only at creation time.
​
string
Optional RuntimeClass, such as kata or gvisor, for a stronger isolation boundary.
​
integer
default:"1800"
Idle seconds before a workspace with no active leases scales to zero. A reconciler evaluates this every 60 seconds.
​
string
default:"200m"
CPU request for workspace pods.
​
string
default:"512Mi"
Memory request for workspace pods.
​
string
default:"2"
CPU limit for workspace pods.
​
string
default:"2Gi"
Memory limit for workspace pods. Raise it if agents run builds or process large datasets; the kernel OOM-kills the container when it is exceeded.

​
Local workspace mode

​
string
default:"http://127.0.0.1:7337"
Address of the local daemon. Only used when WORKSPACE_MODE=local.
​
string
default:"development-only-token"
Bearer token for the local daemon. Only used when WORKSPACE_MODE=local.

​
Optional integrations

​
string
Base URL of an Agentic Web Research service. The web_search, web_read, and web_research tools appear only when this and AWR_API_KEY are both set.
​
string
API key for the web research service. Treat it as a secret.

Enable web research

How the integration works and what it exposes.

​
Variables inside a workspace pod

The controller sets these on each workspace container. They are listed for debugging; you do not configure them directly.