All environment variables can be set in your
.env file for Docker Compose deployments or in terraform.tfvars for AWS deployments.Quick Configuration Examples
Minimal Configuration (Development)
Minimal Configuration (Development)
Production Configuration
Production Configuration
Database Configuration
| Variable | Required | Default | Description |
|---|---|---|---|
DATABASE_HOST | Yes | postgres | Database hostname or IP address |
DATABASE_PORT | Yes | 5432 | Database port |
DATABASE_USERNAME | Yes | omni | Database username |
DATABASE_PASSWORD | Yes | - | Database password (use strong password) |
DATABASE_NAME | Yes | omni | Database name |
DATABASE_SSL | No | false | Enable SSL for database connection |
DB_MAX_CONNECTIONS | No | 10 | Connection pool size per service |
DB_ACQUIRE_TIMEOUT_SECONDS | No | 3 | Connection acquisition timeout |
Redis Configuration
| Variable | Required | Default | Description |
|---|---|---|---|
REDIS_URL | Yes | redis://redis:6379 | Redis connection URL (format: redis://host:port) |
Application Configuration
| Variable | Required | Default | Description |
|---|---|---|---|
APP_URL | Yes | http://localhost:3000 | Public-facing application URL (include protocol) |
OMNI_DOMAIN | No | localhost | Domain name for the application |
SESSION_SECRET | Yes | - | Secret key for session encryption (32+ characters) |
SESSION_COOKIE_NAME | No | auth-session | Name of the session cookie |
SESSION_DURATION_DAYS | No | 7 | Session expiry in days |
NODE_ENV | No | development | Node environment: development or production |
Security & Encryption
| Variable | Required | Default | Description |
|---|---|---|---|
ENCRYPTION_KEY | Yes | - | Encryption key for OAuth tokens (32+ characters) |
ENCRYPTION_SALT | Yes | - | Salt for key derivation (16+ characters) |
Service Ports
| Variable | Required | Default | Description |
|---|---|---|---|
WEB_PORT | No | 3000 | SvelteKit web application port |
SEARCHER_PORT | No | 3001 | Search service port |
INDEXER_PORT | No | 3002 | Indexer service port |
AI_SERVICE_PORT | No | 3003 | AI service port |
GOOGLE_CONNECTOR_PORT | No | 4001 | Google connector port |
SLACK_CONNECTOR_PORT | No | 4002 | Slack connector port |
ATLASSIAN_CONNECTOR_PORT | No | 4003 | Atlassian connector port |
VLLM_PORT | No | 8000 | vLLM inference server port |
In Docker Compose, services communicate via service names (e.g.,
http://searcher:3001). Ports only need to be exposed to the host for debugging.Inter-Service URLs
| Variable | Required | Default | Description |
|---|---|---|---|
SEARCHER_URL | Yes | http://searcher:3001 | Search service URL |
INDEXER_URL | Yes | http://indexer:3002 | Indexer service URL |
AI_SERVICE_URL | Yes | http://ai:3003 | AI service URL |
GOOGLE_CONNECTOR_URL | Yes | http://google-connector:4001 | Google connector URL |
Feature Flags
| Variable | Required | Default | Description |
|---|---|---|---|
AI_ANSWER_ENABLED | No | true | Enable AI-generated answers in search results |
AI_FIRST_SEARCH_ENABLED | No | true | Display AI answers before traditional search results |
LLM Provider Configuration
| Variable | Required | Default | Description |
|---|---|---|---|
LLM_PROVIDER | Yes | vllm | LLM provider: vllm, anthropic, or bedrock |
vLLM (Self-Hosted)
For self-hosted LLM inference:| Variable | Required | Default | Description |
|---|---|---|---|
VLLM_URL | Yes | http://vllm:8000 | vLLM service URL |
VLLM_MODEL | No | microsoft/Phi-3-mini-4k-instruct | HuggingFace model identifier |
VLLM_DTYPE | No | auto | Data type: auto, float16, bfloat16 |
VLLM_API_KEY | No | token-abc123 | API key for vLLM authentication |
VLLM_MAX_MODEL_LEN | No | 2048 | Maximum context length in tokens |
microsoft/Phi-3-mini-4k-instruct(4 GB VRAM)mistralai/Mistral-7B-Instruct-v0.2(14 GB VRAM)meta-llama/Llama-3.1-8B-Instruct(16 GB VRAM)
Anthropic Claude
For Anthropic’s Claude API:| Variable | Required | Default | Description |
|---|---|---|---|
ANTHROPIC_API_KEY | Yes | - | Anthropic API key from https://console.anthropic.com |
ANTHROPIC_MODEL | No | claude-sonnet-4-20250514 | Claude model version |
ANTHROPIC_MAX_TOKENS | No | 4096 | Maximum tokens in response |
claude-sonnet-4-20250514(Recommended)claude-opus-4-20250514(Highest quality)claude-haiku-4-20250901(Fastest, lowest cost)
AWS Bedrock
For AWS Bedrock:| Variable | Required | Default | Description |
|---|---|---|---|
BEDROCK_MODEL_ID | No | us.anthropic.claude-sonnet-4-20250514-v1:0 | Bedrock model ID |
TITLE_GENERATION_MODEL_ID | No | us.anthropic.claude-haiku-4-5-20251001-v1:0 | Model for title generation |
AWS_REGION | Yes | - | AWS region for Bedrock (e.g., us-east-1) |
AWS_ACCESS_KEY_ID | Conditional | - | AWS access key (if not using IAM role) |
AWS_SECRET_ACCESS_KEY | Conditional | - | AWS secret key (if not using IAM role) |
AI Service Configuration
| Variable | Required | Default | Description |
|---|---|---|---|
MODEL_PATH | No | /models | Directory for model storage |
EMBEDDING_MODEL | No | intfloat/e5-large-v2 | HuggingFace embedding model (if using local) |
EMBEDDING_DIMENSIONS | No | 1024 | Dimension of embedding vectors |
EMBEDDING_PROVIDER | Yes | jina | Embedding provider: jina, local, or bedrock |
JINA_API_KEY | Conditional | - | Jina AI API key (required if EMBEDDING_PROVIDER=jina) |
AI_WORKERS | No | 1 | Number of uvicorn worker processes |
CUDA_VISIBLE_DEVICES | No | 0 | GPU device ID for local models (comma-separated for multiple) |
Conversation Compaction
For long conversations that exceed LLM context limits, Omni automatically compacts older messages into a summary while preserving recent messages.| Variable | Required | Default | Description |
|---|---|---|---|
ENABLE_CONVERSATION_COMPACTION | No | true | Enable automatic conversation compaction |
MAX_CONVERSATION_INPUT_TOKENS | No | 150000 | Maximum token limit (compaction triggers at 80%) |
COMPACTION_RECENT_MESSAGES_COUNT | No | 20 | Number of recent messages to keep intact |
COMPACTION_SUMMARY_MAX_TOKENS | No | 2000 | Maximum tokens for the generated summary |
COMPACTION_CACHE_TTL_SECONDS | No | 86400 | Cache TTL for summaries (24 hours) |
Compaction triggers when conversation tokens reach 80% of
MAX_CONVERSATION_INPUT_TOKENS (default: 120,000 tokens). The compactor preserves tool_use/tool_result pairs and caches summaries in Redis.Batch Embedding Inference (AWS Bedrock)
For large-scale embedding generation using AWS Bedrock batch inference:| Variable | Required | Default | Description |
|---|---|---|---|
ENABLE_EMBEDDING_BATCH_INFERENCE | No | false | Enable batch processing for embeddings |
EMBEDDING_BATCH_S3_BUCKET | Conditional | - | S3 bucket for batch files (required if batch enabled) |
EMBEDDING_BATCH_BEDROCK_ROLE_ARN | Conditional | - | IAM role ARN for Bedrock (required if batch enabled) |
EMBEDDING_BATCH_MIN_DOCUMENTS | No | 100 | Minimum documents to trigger batch job |
EMBEDDING_BATCH_MAX_DOCUMENTS | No | 50000 | Maximum documents per batch |
EMBEDDING_BATCH_ACCUMULATION_TIMEOUT_SECONDS | No | 300 | Wait time before starting batch (5 min) |
EMBEDDING_BATCH_ACCUMULATION_POLL_INTERVAL | No | 10 | Interval to check queue (10 sec) |
EMBEDDING_BATCH_MONITOR_POLL_INTERVAL | No | 300 | Interval to check batch status (5 min) |
Google Workspace Connector
| Variable | Required | Default | Description |
|---|---|---|---|
GOOGLE_CLIENT_ID | Yes | - | Google OAuth 2.0 client ID |
GOOGLE_CLIENT_SECRET | Yes | - | Google OAuth 2.0 client secret |
GOOGLE_REDIRECT_URI | Yes | - | OAuth callback URL (e.g., https://omni.company.com/api/oauth/google/callback) |
GOOGLE_SYNC_INTERVAL_SECONDS | No | 86400 | Interval between full syncs (24 hours) |
GOOGLE_MAX_AGE_DAYS | No | 730 | Maximum age of files to index (2 years) |
GOOGLE_WEBHOOK_URL | No | - | HTTPS URL for real-time updates (requires valid SSL certificate) |
WEBHOOK_RENEWAL_CHECK_INTERVAL_SECONDS | No | 3600 | Interval to check and renew webhooks (1 hour) |
To set up Google OAuth credentials, visit the Google Cloud Console.
See Google Connector Setup for detailed instructions.
Slack Connector
| Variable | Required | Default | Description |
|---|---|---|---|
SLACK_CLIENT_ID | Yes | - | Slack OAuth client ID |
SLACK_CLIENT_SECRET | Yes | - | Slack OAuth client secret |
SLACK_BOT_TOKEN | Yes | - | Slack bot token (starts with xoxb-) |
Create a Slack app at https://api.slack.com/apps to get credentials.
See Slack Connector Setup for detailed instructions.
Atlassian Connector
| Variable | Required | Default | Description |
|---|---|---|---|
ATLASSIAN_CLIENT_ID | Yes | - | Atlassian OAuth client ID |
ATLASSIAN_CLIENT_SECRET | Yes | - | Atlassian OAuth client secret |
ATLASSIAN_BASE_URL | Yes | - | Atlassian instance URL (e.g., https://yourcompany.atlassian.net) |
ATLASSIAN_USER_EMAIL | Yes | - | User email for API authentication |
ATLASSIAN_API_TOKEN | Yes | - | Atlassian API token |
Generate an API token at https://id.atlassian.com/manage-profile/security/api-tokens.
See Atlassian Connector Setup for detailed instructions.
HubSpot Connector
| Variable | Required | Default | Description |
|---|---|---|---|
HUBSPOT_CONNECTOR_PORT | No | 4004 | HubSpot connector service port |
- Private App Token: A HubSpot private app token (starts with
pat-na1-) - Portal ID: Your HubSpot portal ID (optional)
crm.objects.contacts.readcrm.objects.companies.readcrm.objects.deals.readticketse-commerce(for engagements)
See HubSpot Connector Setup for detailed instructions.
Filesystem Connector
| Variable | Required | Default | Description |
|---|---|---|---|
FILESYSTEM_CONNECTOR_PORT | No | 4006 | Filesystem connector service port |
- base_path: Root directory path to scan (required)
- scan_interval_seconds: Full scan interval (default: 300)
- file_extensions: Whitelist of extensions to include (optional)
- exclude_patterns: Path patterns to exclude (optional)
- max_file_size_bytes: Maximum file size to process (default: 10MB for content)
See Filesystem Connector Setup for detailed instructions including Docker volume mounting.
Connector Manager
The connector-manager service orchestrates all connector operations.| Variable | Required | Default | Description |
|---|---|---|---|
CONNECTOR_MANAGER_PORT | No | 8090 | Connector manager service port |
MAX_CONCURRENT_SYNCS | No | 10 | Maximum concurrent syncs across all sources |
MAX_CONCURRENT_SYNCS_PER_TYPE | No | 3 | Maximum concurrent syncs per connector type |
SCHEDULER_INTERVAL_SECONDS | No | 30 | How often scheduler checks for due syncs |
STALE_SYNC_TIMEOUT_MINUTES | No | 10 | Timeout to mark a sync as stale/failed |
| Variable | Required | Default | Description |
|---|---|---|---|
CONNECTOR_GOOGLE_URL | Yes | - | Google connector URL |
CONNECTOR_SLACK_URL | Yes | - | Slack connector URL |
CONNECTOR_ATLASSIAN_URL | Yes | - | Atlassian connector URL |
CONNECTOR_WEB_URL | Yes | - | Web connector URL |
Storage Configuration
| Variable | Required | Default | Description |
|---|---|---|---|
STORAGE_BACKEND | Yes | s3 | Storage backend: s3 or local |
S3_BUCKET | Conditional | - | S3 bucket name (required if STORAGE_BACKEND=s3) |
S3_REGION | Conditional | - | S3 region (required if STORAGE_BACKEND=s3) |
AWS_ACCESS_KEY_ID | Conditional | - | AWS access key (if not using IAM role) |
AWS_SECRET_ACCESS_KEY | Conditional | - | AWS secret key (if not using IAM role) |
AWS_SESSION_TOKEN | No | - | AWS session token (for temporary credentials) |
Email Configuration
| Variable | Required | Default | Description |
|---|---|---|---|
EMAIL_PROVIDER | Yes | resend | Email provider: resend or smtp |
EMAIL_FROM | Yes | Omni <[email protected]> | From email address |
Resend Provider
| Variable | Required | Default | Description |
|---|---|---|---|
RESEND_API_KEY | Yes | - | Resend API key from https://resend.com |
SMTP Provider
| Variable | Required | Default | Description |
|---|---|---|---|
EMAIL_HOST | Yes | - | SMTP server hostname |
EMAIL_PORT | Yes | 587 | SMTP server port (587 for TLS, 465 for SSL) |
EMAIL_USER | Yes | - | SMTP username |
EMAIL_PASSWORD | Yes | - | SMTP password |
EMAIL_SECURE | No | true | Use TLS/SSL |
Search Configuration
| Variable | Required | Default | Description |
|---|---|---|---|
TYPO_TOLERANCE_ENABLED | No | true | Enable typo tolerance in search queries |
TYPO_TOLERANCE_MAX_DISTANCE | No | 2 | Maximum Levenshtein distance for typo correction |
TYPO_TOLERANCE_MIN_WORD_LENGTH | No | 4 | Minimum word length to apply typo correction |
Logging & Monitoring
| Variable | Required | Default | Description |
|---|---|---|---|
RUST_LOG | No | info | Rust services log level: trace, debug, info, warn, error |
LOG_LEVEL | No | debug | Python services log level: DEBUG, INFO, WARNING, ERROR |
- Development:
RUST_LOG=debug,LOG_LEVEL=DEBUG - Production:
RUST_LOG=info,LOG_LEVEL=INFO - Troubleshooting:
RUST_LOG=trace,LOG_LEVEL=DEBUG
Telemetry (OpenTelemetry)
| Variable | Required | Default | Description |
|---|---|---|---|
OTEL_EXPORTER_OTLP_ENDPOINT | No | - | OTLP collector endpoint (empty = telemetry disabled) |
OTEL_DEPLOYMENT_ID | No | - | Deployment identifier for tracing |
OTEL_DEPLOYMENT_ENVIRONMENT | No | development | Environment: development, staging, production |
SERVICE_VERSION | No | 0.1.0 | Service version for tracing |
HTTPS & SSL (Production)
| Variable | Required | Default | Description |
|---|---|---|---|
ACME_EMAIL | Conditional | - | Email for Let’s Encrypt notifications (required for automatic HTTPS) |
CLIO_DOMAIN | Conditional | - | Domain name for Caddy (required for automatic HTTPS) |
- Obtain SSL certificate from Let’s Encrypt
- Configure HTTPS
- Redirect HTTP to HTTPS
- Auto-renew certificates
Environment-Specific Examples
Development (.env)
Staging (.env)
Production (.env)
Security Best Practices
Generate Strong Secrets
Generate Strong Secrets
Use cryptographically secure random values for all secrets:
Protect Environment Files
Protect Environment Files
Rotate Secrets Regularly
Rotate Secrets Regularly
Best practices for secret rotation:
- API Keys: Rotate every 90 days
- Database Passwords: Rotate every 180 days
- Session Secrets: Rotate after security incidents
- Encryption Keys: Only rotate with data migration plan
Separate Environments
Separate Environments
Use different secrets for each environment:Never reuse production secrets in non-production environments.
Validation & Testing
Test your configuration:Troubleshooting Configuration Issues
Services won't start
Services won't start
Check for missing required variables:Common issues:
- Missing
DATABASE_PASSWORD - Missing
SESSION_SECRETorENCRYPTION_KEY - Missing API keys for enabled features
Database connection errors
Database connection errors
Verify database configuration:Check:
DATABASE_HOSTmatches service nameDATABASE_PASSWORDis correct- PostgreSQL is fully started
LLM provider not working
LLM provider not working
Test LLM connectivity:Check:
LLM_PROVIDERis set correctly- API keys are valid
- vLLM service is running (if self-hosted)
Email not sending
Email not sending
Test email configuration:Check:
EMAIL_PROVIDERis set- API key or SMTP credentials are valid
EMAIL_FROMdomain is verified (for Resend)