Configuration
A consolidated reference for the key settings of each stack. Every stack reads its values from
docker/<stack>/.env, copied from the committed .env.example. The tables
below list the most important options; the .env.example files are the full reference.
ClickHouse #
Reference: docker/clickhouse/.env.example.
| Variable | Purpose | Default |
|---|---|---|
CLICKHOUSE_HTTP_PORT | HTTP port the ingest receiver connects to | 8123 |
CLICKHOUSE_NATIVE_PORT | Native protocol port for clients and BI tools | 9000 |
CLICKHOUSE_DB | Database created on first start | rum |
CLICKHOUSE_USER | User created on first start | ambilobe |
CLICKHOUSE_PASSWORD | Password (required, compose aborts if unset) | none |
PostgreSQL #
Reference: docker/pg/.env.example.
| Variable | Purpose | Default |
|---|---|---|
POSTGRES_PORT | Port the app stacks connect to | 5432 |
POSTGRES_DB | Database created on first start | rum_config |
POSTGRES_USER | Role created on first start | ambilobe |
POSTGRES_PASSWORD | Password (required, compose aborts if unset) | none |
Ingest receiver #
Reference: docker/ingest/.env.example.
| Variable | Purpose | Default |
|---|---|---|
INGEST_CONFIGDB_CONNECTIONSTRING | rum_config Postgres connection (required) | none |
INGEST_CLICKHOUSE_CONNECTIONSTRING | ClickHouse rum.events connection (required) | none |
INGEST_CONFIGDB_AUTOMIGRATE | Apply pending rum_config migrations on startup | true |
INGEST_GEOIP_DBPATH | GeoIP database path; empty disables GeoIP | empty |
INGEST_RATECAP_EXPECTSINGLEINSTANCE | Acknowledge a single-instance deployment | false |
INGEST_COLLECTOR_SERVE_ASSETS | Serve the collector bundle from /v1/rum/* | true |
Admin console #
Reference: docker/admin/.env.example.
| Variable | Purpose | Default |
|---|---|---|
ADMIN_CONFIGDB_CONNECTIONSTRING | rum_config Postgres connection (required) | none |
ADMIN_AUTH_AUTHORITY | OIDC issuer URL (required) | none |
ADMIN_AUTH_AUDIENCE | API resource name in the token aud claim (required) | none |
ADMIN_CONFIGDB_AUTOMIGRATE | Apply pending rum_config migrations on startup | true |
ADMIN_UI_OIDC_CLIENT_ID | SPA OIDC client id (baked into the bundle) | ambilobe-front |
ADMIN_CLICKHOUSE_CONNECTIONSTRING | ClickHouse rum connection for dashboards | empty |
Edge proxy #
Reference: docker/front/.env.example.
| Variable | Purpose | Default |
|---|---|---|
FRONT_HTTPS_PORT | Host HTTPS port (mapped to container 4433) | 443 |
FRONT_CERT_VAULT_URI | Azure Key Vault URI for the TLS certificate | per .env.example |
FRONT_CERT_SECRET_NAME | Key Vault secret holding the PKCS#12 certificate | per .env.example |
FRONT_ADMIN_HOST / FRONT_ADMIN_DESTINATION | Admin hostname and internal upstream | per .env.example |
FRONT_INGEST_HOST / FRONT_INGEST_DESTINATION | Ingest hostname and internal upstream | per .env.example |
AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET | Service principal for Key Vault (empty uses managed identity) | empty |
Rate caps are per pod #
The ingest receiver enforces rate caps (sessions, events, replay bytes) in-process. Running more than one ingest replica divides each policy's cap by the replica count, because the counters are not shared across pods. A Redis-backed implementation is the documented swap for distributed caps.
For a single-instance deployment, set INGEST_RATECAP_EXPECTSINGLEINSTANCE=true to
acknowledge the trade-off and silence the startup warning.