MATEConfiguration
Every knob a running platform reads. The deployment variables — URLs, identity, storage, MCP, tracking — are documented with inline commentary in .env.example; the job and compute knobs below are read from the environment and default as shown.
URLs and identity#
| Variable | Default | Notes |
|---|---|---|
NEXT_PUBLIC_API_URL | http://localhost:8000 | The API URL the browser uses; inlined at build time, so a change needs a rebuild. |
AUTH_URL | http://localhost:3000 | The web origin Auth.js believes in; decides secure-cookie behaviour. |
AUTH_SECRET | – | Encrypts the session cookie. openssl rand -base64 32. |
CORS_ORIGINS | ["http://localhost:3000"] | Extend when the web origin changes. |
KEYCLOAK_ISSUER | dev realm URL | The iss claim the API validates. |
KEYCLOAK_JWKS_URL | internal DNS | Where signing keys are fetched. |
KEYCLOAK_AUDIENCE | flows-funds-api | Expected audience on access tokens. |
KEYCLOAK_CLIENT_ID / _SECRET | seeded dev values | Must match the realm; rotate before any shared deployment. |
KEYCLOAK_ADMIN / _PASSWORD | admin / admin | The Keycloak console login. |
KEYCLOAK_IDP_HINT | empty | Jump straight to a brokered identity provider. |
SESSION_STORE_DIR | unset | Server-side sessions; sidesteps the 4 KB cookie limit. |
DEMO_MODE / DEMO_ADMIN | false | Local-only login bypass. Never on a shared deployment. |
Storage#
| Variable | Default | Notes |
|---|---|---|
STORAGE_MODE | local | local, or s3 for a bucket-authoritative deployment. |
STORAGE_S3_ENDPOINT | – | Endpoint URL with scheme; empty means AWS S3 proper. |
STORAGE_S3_BUCKET / _REGION | – | Region is required by AWS; R2 wants auto. |
STORAGE_S3_ACCESS_KEY / _SECRET_KEY | – | Credentials. |
STORAGE_S3_PATH_STYLE | true | Needed by MinIO and Ceph; set false on AWS. |
STORAGE_S3_USE_SSL / _VERIFY | true / system CAs | TLS toggle; false or a CA-bundle path for an internal CA. |
STORAGE_S3_PREFIX | – | Key prefix, so deployments can share a bucket. |
STORAGE_S3_QUOTA_BYTES | 0 | Ceiling for the prefix; imports answer 507 once reached. |
LOCAL_CACHE_MAX_BYTES | 0 | Cache budget for the eviction reaper; 0 never evicts. |
CACHE_EVICT_DRY_RUN | true | Log candidates without deleting — run in dry-run mode first. |
JOB_RETENTION_DAYS | 0 | Prune terminal jobs after N days. |
Uploads#
Compressed uploads and archives unpack behind zip-bomb guards. The caps count bytes actually produced, never what an archive claims about itself.
| Variable | Default | Notes |
|---|---|---|
INGEST_MAX_DECOMPRESSED_BYTES | 10737418240 (10 GiB) | Most one upload may unpack to: a single log, or all logs picked from one archive together. |
INGEST_MAX_COMPRESSION_RATIO | 1000 | Unpacked/packed ceiling, checked beyond 64 MiB of output; 0 disables. |
INGEST_MAX_ARCHIVE_ENTRIES | 10000 | Entries an uploaded archive may hold. |
Jobs and compute#
| Variable | Default | Notes |
|---|---|---|
WORKER_CONCURRENCY | 2 | Parallel job slots (1–8); also changeable live by an admin. |
JOB_EXECUTION_TIMEOUT_SECONDS | 1800 | Wall-clock backstop per job; 0 disables. |
MODULE_PROCESS_POOL_SIZE | min(cores, 8) | Size of the CPU offload pool. |
MAX_OFFLOADS_PER_USER | 0 (= pool size) | Per-user share of that pool; set it on shared hosts. |
DUCKDB_THREADS / DUCKDB_MEMORY_LIMIT | 0 / unset | Per-query caps. |
EVENT_LOG_CACHE_ENTRIES | 3 | Materialised DataFrame cache for repeated reads. |
ENV | prod | dev enables the module hot-reload watchdog. |
LOG_LEVEL | info | debug, info, warning, error. |
MCP and tracking#
| Variable | Default | Notes |
|---|---|---|
MCP_ENABLED | false | Mounts the MCP server at /mcp; read at boot. |
API_BASE_URL | unset | Public origin for OAuth discovery. |
MCP_TOOLSETS | empty | Empty means all except admin; all includes it. |
MCP_READ_ONLY | false | Unregisters write tools at boot. |
MCP_REQUIRE_EGRESS_CONSENT | true | Each user opts in before tools return their data. |
MCP_OAUTH_CLIENT_ID | unset | Pre-registered public client; empty means PAT-only. |
MCP_RATE_LIMIT_PER_MINUTE / _BURST | 120 / 40 | Per-user request budget. |
MCP_WRITE_RATE_LIMIT_PER_MINUTE / _BURST | 30 / 10 | Tighter bucket for mutating tools. |
MCP_TOOL_TIMEOUT_SECONDS | 30 | Per-call timeout. |
USER_TRACKING_ONBOARDING | force | force, on, or off — see Security and privacy. |