> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Arvo-AI/aurora/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Variables

> Complete reference for all Aurora environment variables

Aurora uses environment variables for configuration. Copy `.env.example` to `.env` and configure the variables below.

## Quick Start

For local development:

```bash theme={null}
make init  # Auto-generates secrets
# Add your OPENROUTER_API_KEY (get from https://openrouter.ai/keys)
make prod-prebuilt  # or: make prod-local to build from source
```

## Core Configuration

<ParamField path="AURORA_ENV" type="string" default="dev">
  Environment mode: `dev`, `staging`, or `prod`
</ParamField>

## Database

PostgreSQL database configuration (required).

<ParamField path="POSTGRES_USER" type="string" default="aurora" required>
  PostgreSQL username
</ParamField>

<ParamField path="POSTGRES_PASSWORD" type="string" required>
  PostgreSQL password. Auto-generated by `make init`.
</ParamField>

<ParamField path="POSTGRES_DB" type="string" default="aurora_db">
  PostgreSQL database name
</ParamField>

<ParamField path="POSTGRES_HOST" type="string" default="postgres">
  PostgreSQL host (Docker service name or hostname)
</ParamField>

<ParamField path="POSTGRES_PORT" type="number" default="5432">
  PostgreSQL port
</ParamField>

## Redis

Redis is used for Celery task queue and caching.

<ParamField path="REDIS_URL" type="string" default="redis://redis:6379/0">
  Redis connection URL
</ParamField>

## Object Storage

S3-compatible object storage configuration. See [Storage Configuration](/configuration/storage) for details.

<ParamField path="STORAGE_BUCKET" type="string" default="aurora-storage" required>
  S3 bucket name
</ParamField>

<ParamField path="STORAGE_ENDPOINT_URL" type="string" default="http://seaweedfs-filer:8333">
  S3 endpoint URL. Default uses SeaweedFS (included in docker-compose).

  For AWS S3, omit this variable. For other providers (Cloudflare R2, MinIO, etc.), set the endpoint URL.
</ParamField>

<ParamField path="STORAGE_ACCESS_KEY" type="string" default="admin" required>
  S3 access key ID
</ParamField>

<ParamField path="STORAGE_SECRET_KEY" type="string" default="admin" required>
  S3 secret access key
</ParamField>

<ParamField path="STORAGE_REGION" type="string" default="us-east-1">
  S3 region
</ParamField>

<ParamField path="STORAGE_USE_SSL" type="boolean" default="false">
  Enable SSL/TLS for storage connections
</ParamField>

<ParamField path="STORAGE_VERIFY_SSL" type="boolean" default="false">
  Verify SSL certificates. Set to `true` in production for security.
</ParamField>

<ParamField path="STORAGE_CACHE_ENABLED" type="boolean" default="true">
  Enable Redis caching for storage file listings
</ParamField>

<ParamField path="STORAGE_CACHE_TTL" type="number" default="60">
  Cache TTL in seconds
</ParamField>

## URLs & Networking

<ParamField path="FRONTEND_URL" type="string" default="http://localhost:3000">
  Frontend URL (for internal use)
</ParamField>

<ParamField path="BACKEND_URL" type="string" default="http://aurora-server:5080">
  Backend URL (for internal container-to-container communication)
</ParamField>

<ParamField path="NEXT_PUBLIC_BACKEND_URL" type="string" default="http://localhost:5080">
  Backend URL accessible from the browser. Injected at container startup.
</ParamField>

<ParamField path="NEXT_PUBLIC_WEBSOCKET_URL" type="string" default="ws://localhost:5006">
  WebSocket URL for chatbot. Injected at container startup.
</ParamField>

<ParamField path="CHATBOT_INTERNAL_URL" type="string" default="http://chatbot:5007">
  Internal chatbot service URL
</ParamField>

<Note>
  `NEXT_PUBLIC_*` variables are injected at container startup, not baked at build time. To change them:

  1. Update `.env`
  2. Recreate the frontend container: `docker compose -f docker-compose.prod-local.yml up -d frontend`
</Note>

## Authentication & Security

<ParamField path="FLASK_SECRET_KEY" type="string" required>
  Flask session secret key. Auto-generated by `make init`.
</ParamField>

<ParamField path="FLASK_PORT" type="number" default="5080">
  Flask API port
</ParamField>

<ParamField path="AUTH_SECRET" type="string" required>
  Auth.js secret key. Auto-generated by `make init`.
</ParamField>

<ParamField path="VAULT_TOKEN" type="string" required>
  HashiCorp Vault root token. Auto-generated by `make init`.

  See [Vault Secrets](/configuration/vault-secrets) for details.
</ParamField>

<ParamField path="VAULT_ADDR" type="string" default="http://vault:8200">
  Vault server address
</ParamField>

<ParamField path="VAULT_KV_MOUNT" type="string" default="aurora">
  Vault KV v2 engine mount point
</ParamField>

<ParamField path="VAULT_KV_BASE_PATH" type="string" default="users">
  Base path for user secrets in Vault
</ParamField>

## LLM & AI Services

At least one LLM provider API key is required. See [LLM Providers](/configuration/llm-providers) for details.

<ParamField path="OPENROUTER_API_KEY" type="string">
  OpenRouter API key (recommended). Get from [https://openrouter.ai/keys](https://openrouter.ai/keys)

  Supports multiple models from various providers through a single API.
</ParamField>

<ParamField path="OPENAI_API_KEY" type="string">
  OpenAI API key. Get from [https://platform.openai.com/api-keys](https://platform.openai.com/api-keys)
</ParamField>

<ParamField path="ANTHROPIC_API_KEY" type="string">
  Anthropic API key. Get from [https://console.anthropic.com/](https://console.anthropic.com/)
</ParamField>

<ParamField path="GOOGLE_AI_API_KEY" type="string">
  Google AI (Gemini) API key. Get from [https://aistudio.google.com/app/apikey](https://aistudio.google.com/app/apikey)
</ParamField>

<ParamField path="LLM_PROVIDER_MODE" type="string" default="openrouter">
  Default LLM provider: `openrouter`, `openai`, `anthropic`, or `google`
</ParamField>

<ParamField path="AGENT_RECURSION_LIMIT" type="number" default="240">
  Maximum recursion depth for agent workflows
</ParamField>

### Web Search

<ParamField path="SEARXNG_URL" type="string" default="http://searxng:8080">
  SearxNG internal URL
</ParamField>

<ParamField path="SEARXNG_BASE_URL" type="string" default="http://localhost:8082">
  SearxNG public URL
</ParamField>

<ParamField path="SEARXNG_SECRET" type="string">
  SearxNG secret key. Auto-generated by `make init`.
</ParamField>

### AI Features

<ParamField path="RCA_OPTIMIZE_COSTS" type="boolean" default="false">
  Enable cost optimization for root cause analysis
</ParamField>

<ParamField path="GEMINI_DISABLE_THINKING" type="boolean" default="false">
  Disable "thinking" mode for Gemini models
</ParamField>

## Cloud Provider Integrations

Optional cloud provider credentials for resource discovery and management.

### Google Cloud Platform

<ParamField path="CLIENT_ID" type="string">
  GCP OAuth client ID
</ParamField>

<ParamField path="CLIENT_SECRET" type="string">
  GCP OAuth client secret
</ParamField>

### Amazon Web Services

<ParamField path="AWS_ACCESS_KEY_ID" type="string">
  AWS access key ID
</ParamField>

<ParamField path="AWS_SECRET_ACCESS_KEY" type="string">
  AWS secret access key
</ParamField>

<ParamField path="AWS_DEFAULT_REGION" type="string" default="us-east-1">
  AWS default region
</ParamField>

### Cloud Provider Cache

Applies to all cloud providers (GCP, AWS, Azure).

<ParamField path="AURORA_SETUP_CACHE_ENABLED" type="boolean" default="true">
  Enable caching for cloud provider API responses
</ParamField>

<ParamField path="AURORA_SETUP_CACHE_TTL" type="number" default="3600">
  Cache TTL in seconds (1 hour)
</ParamField>

<ParamField path="AURORA_VERIFY_CLI_IDENTITY" type="boolean" default="false">
  Verify CLI identity for cloud provider connections
</ParamField>

<ParamField path="AURORA_CACHE_TOKEN_IN_REDIS" type="boolean" default="false">
  Cache cloud provider tokens in Redis
</ParamField>

## Third-Party Integrations

Optional integrations with external services.

### GitHub OAuth

<ParamField path="GH_OAUTH_CLIENT_ID" type="string">
  GitHub OAuth client ID
</ParamField>

<ParamField path="GH_OAUTH_CLIENT_SECRET" type="string">
  GitHub OAuth client secret
</ParamField>

### Slack

<ParamField path="NEXT_PUBLIC_ENABLE_SLACK" type="boolean" default="false">
  Enable Slack integration
</ParamField>

<ParamField path="SLACK_CLIENT_ID" type="string">
  Slack OAuth client ID
</ParamField>

<ParamField path="SLACK_CLIENT_SECRET" type="string">
  Slack OAuth client secret
</ParamField>

<ParamField path="SLACK_SIGNING_SECRET" type="string">
  Slack signing secret
</ParamField>

### PagerDuty

<ParamField path="NEXT_PUBLIC_ENABLE_PAGERDUTY_OAUTH" type="boolean" default="false">
  Enable PagerDuty OAuth integration
</ParamField>

<ParamField path="PAGERDUTY_CLIENT_ID" type="string">
  PagerDuty OAuth client ID
</ParamField>

<ParamField path="PAGERDUTY_CLIENT_SECRET" type="string">
  PagerDuty OAuth client secret
</ParamField>

### Bitbucket

<ParamField path="NEXT_PUBLIC_ENABLE_BITBUCKET" type="boolean" default="false">
  Enable Bitbucket integration
</ParamField>

<ParamField path="BB_OAUTH_CLIENT_ID" type="string">
  Bitbucket OAuth client ID
</ParamField>

<ParamField path="BB_OAUTH_CLIENT_SECRET" type="string">
  Bitbucket OAuth client secret
</ParamField>

### OVH (Multi-Region)

<ParamField path="NEXT_PUBLIC_ENABLE_OVH" type="boolean" default="false">
  Enable OVH integration
</ParamField>

<ParamField path="OVH_EU_CLIENT_ID" type="string">
  OVH Europe client ID
</ParamField>

<ParamField path="OVH_EU_CLIENT_SECRET" type="string">
  OVH Europe client secret
</ParamField>

<ParamField path="OVH_CA_CLIENT_ID" type="string">
  OVH Canada client ID
</ParamField>

<ParamField path="OVH_CA_CLIENT_SECRET" type="string">
  OVH Canada client secret
</ParamField>

<ParamField path="OVH_US_CLIENT_ID" type="string">
  OVH US client ID
</ParamField>

<ParamField path="OVH_US_CLIENT_SECRET" type="string">
  OVH US client secret
</ParamField>

### Scaleway

<ParamField path="NEXT_PUBLIC_ENABLE_SCALEWAY" type="boolean" default="false">
  Enable Scaleway integration
</ParamField>

### Confluence

<ParamField path="NEXT_PUBLIC_ENABLE_CONFLUENCE" type="boolean" default="false">
  Enable Confluence integration
</ParamField>

<ParamField path="CONFLUENCE_CLIENT_ID" type="string">
  Confluence OAuth client ID
</ParamField>

<ParamField path="CONFLUENCE_CLIENT_SECRET" type="string">
  Confluence OAuth client secret
</ParamField>

### Dynatrace

<ParamField path="NEXT_PUBLIC_ENABLE_DYNATRACE" type="boolean" default="false">
  Enable Dynatrace integration
</ParamField>

### BigPanda

<ParamField path="NEXT_PUBLIC_ENABLE_BIGPANDA" type="boolean" default="false">
  Enable BigPanda integration
</ParamField>

### ThousandEyes

<ParamField path="NEXT_PUBLIC_ENABLE_THOUSANDEYES" type="boolean" default="false">
  Enable ThousandEyes integration
</ParamField>

### Email (SMTP)

<ParamField path="SMTP_HOST" type="string">
  SMTP server hostname
</ParamField>

<ParamField path="SMTP_PORT" type="number" default="587">
  SMTP server port
</ParamField>

<ParamField path="SMTP_USER" type="string">
  SMTP username
</ParamField>

<ParamField path="SMTP_PASSWORD" type="string">
  SMTP password
</ParamField>

<ParamField path="SMTP_FROM_EMAIL" type="string">
  Email sender address
</ParamField>

<ParamField path="SMTP_FROM_NAME" type="string" default="Aurora">
  Email sender name
</ParamField>

## Kubernetes & Pod Isolation

Configuration for running Aurora agents in isolated Kubernetes pods.

<ParamField path="ENABLE_POD_ISOLATION" type="boolean" default="false">
  Enable isolated pod execution for terminal and chatbot agents
</ParamField>

<ParamField path="TERMINAL_NAMESPACE" type="string">
  Kubernetes namespace for terminal pods
</ParamField>

<ParamField path="TERMINAL_IMAGE" type="string">
  Container image for terminal pods
</ParamField>

<ParamField path="TERMINAL_POD_TTL" type="number">
  Time-to-live for terminal pods (seconds)
</ParamField>

<ParamField path="TERMINAL_RUNTIME_CLASS" type="string">
  Runtime class for terminal pods (e.g., `gvisor`, `kata-containers`)
</ParamField>

<ParamField path="CHATBOT_POD_TTL" type="number">
  Time-to-live for chatbot pods (seconds)
</ParamField>

<ParamField path="USE_UNTRUSTED_NODES" type="boolean">
  Schedule pods on untrusted nodes (with appropriate taints/tolerations)
</ParamField>

<ParamField path="NEXT_PUBLIC_KUBECTL_AGENT_CHART_URL" type="string">
  Helm chart URL for kubectl agent deployment
</ParamField>

## Weaviate (Vector Database)

<ParamField path="WEAVIATE_HOST" type="string" default="weaviate">
  Weaviate host (Docker service name or hostname)
</ParamField>

<ParamField path="WEAVIATE_PORT" type="number" default="8080">
  Weaviate HTTP port
</ParamField>

<ParamField path="WEAVIATE_GRPC_PORT" type="number" default="50051">
  Weaviate gRPC port
</ParamField>

## Memgraph (Graph Database)

<ParamField path="MEMGRAPH_HOST" type="string" default="memgraph">
  Memgraph host (Docker service name or hostname)
</ParamField>

<ParamField path="MEMGRAPH_PORT" type="number" default="7687">
  Memgraph Bolt protocol port
</ParamField>

<ParamField path="MEMGRAPH_USER" type="string" default="aurora">
  Memgraph username
</ParamField>

<ParamField path="MEMGRAPH_PASSWORD" type="string" default="CHANGE_ME">
  Memgraph password
</ParamField>

<ParamField path="DISCOVERY_INTERVAL_HOURS" type="number" default="1">
  Resource discovery interval (hours)
</ParamField>

## Rate Limiting

<ParamField path="RATE_LIMITING_ENABLED" type="boolean" default="false">
  Enable API rate limiting
</ParamField>

<ParamField path="RATE_LIMIT_BYPASS_TOKEN" type="string">
  Token to bypass rate limits (for testing/admin)
</ParamField>

<ParamField path="RATE_LIMIT_HEADERS_ENABLED" type="boolean" default="true">
  Include rate limit headers in API responses
</ParamField>

## Development

<ParamField path="NGROK_URL" type="string">
  ngrok tunnel URL for local development (webhooks, OAuth callbacks)
</ParamField>

## Configuration Examples

### Minimal Local Development

```bash theme={null}
# .env
AURORA_ENV=dev

# Database (auto-generated by make init)
POSTGRES_PASSWORD=generated_password

# Auth & Security (auto-generated by make init)
FLASK_SECRET_KEY=generated_secret
AUTH_SECRET=generated_secret
VAULT_TOKEN=generated_token
SEARXNG_SECRET=generated_secret

# LLM Provider (add your key)
OPENROUTER_API_KEY=sk-or-v1-...
LLM_PROVIDER_MODE=openrouter

# All other variables use defaults from .env.example
```

### Production with AWS S3

```bash theme={null}
# .env
AURORA_ENV=prod

# Storage (AWS S3)
STORAGE_BUCKET=my-aurora-bucket
STORAGE_ENDPOINT_URL=  # Omit for AWS S3
STORAGE_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
STORAGE_SECRET_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
STORAGE_REGION=us-west-2
STORAGE_USE_SSL=true
STORAGE_VERIFY_SSL=true

# LLM Providers
OPENROUTER_API_KEY=sk-or-v1-...
OPENAI_API_KEY=sk-...
LLM_PROVIDER_MODE=openrouter

# URLs (update for your domain)
FRONTEND_URL=https://aurora.example.com
NEXT_PUBLIC_BACKEND_URL=https://api.aurora.example.com
NEXT_PUBLIC_WEBSOCKET_URL=wss://ws.aurora.example.com
```

### Production with Cloudflare R2

```bash theme={null}
# .env
AURORA_ENV=prod

# Storage (Cloudflare R2)
STORAGE_BUCKET=my-aurora-bucket
STORAGE_ENDPOINT_URL=https://<account_id>.r2.cloudflarestorage.com
STORAGE_ACCESS_KEY=<r2_access_key>
STORAGE_SECRET_KEY=<r2_secret_key>
STORAGE_REGION=auto
STORAGE_USE_SSL=true
STORAGE_VERIFY_SSL=true
```