Archigov · docs
  1. Docs
  2. Reference

Configuration Reference

Every environment variable the Archigov image reads, and the settings an administrator changes in the product.

All variables are optional. Secrets belong in an env file, Docker or Kubernetes secrets, or your orchestrator's secret store — never in compose files or images.

#Core

VariablePurposeDefault
PORTHTTP port for the API and UI8080
DATA_DIRDatabase, backups, keys, evidence packs, blobs/data in the image; ../data from source
SEED_DEMOLoad the demo tenant on the first boot of an empty databasetrue; set false in production
APP_BASE_URLPublic URL, used for sign-in redirects and secure cookies—
ARCHIGOV_FIXTURES1 answers every Azure and Azure DevOps call from recorded fixtures (demos, CI)unset

#Sign-in

VariablePurposeDefault
AUTH_MODElocal (trusted network; acting user chosen in the UI or sent as x-user) or entralocal
ENTRA_TENANT_ID, ENTRA_CLIENT_IDEntra app registration—
ENTRA_CLIENT_SECRETConfidential client secret; omit for a public client with PKCE—
ENTRA_ROLE_MAPRemap app-role values: from=to,from=to—
ENTRA_DEFAULT_ROLESystem role for users whose token carries nonenone (read-only)
SESSION_SECRETSession-cookie signing secretgenerated into DATA_DIR/keys/session.secret

See Sign-in with Entra ID.

#Azure Estate

VariablePurposeDefault
AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRETService principal with Reader and Security Reader; a managed identity works without the secret—
AZURE_SUBSCRIPTIONSComma-separated subscription ids in scopeevery subscription the identity can see

See Connect Azure.

#Azure DevOps

VariablePurposeDefault
ADO_ORG, ADO_PROJECTOrganisation and project—
ADO_PATPersonal access token (Work Items: Read); without it the Entra identity is used—
ADO_HOOK_SECRETSecret the service hook must present to POST /api/hooks/ado—
ADO_WIQLBackfill query overrideepics and features, not removed, changed in the last year

See Azure DevOps.

#AI

VariablePurposeDefault
AI_OPENAI_API_KEY, AI_ANTHROPIC_API_KEY, AI_MISTRAL_API_KEY, AI_OLLAMA_API_KEYProvider keys; each also as …_FILE pointing at a secret file. Beat keys stored in Settings—
ARCHIGOV_SECRET_KEYMaster key for secrets stored in the database (AES-256-GCM). Any string; hashed to 256 bitsgenerated DATA_DIR/keys/secret.key
LLM_BASE_URL, LLM_API_KEY, LLM_MODELLegacy single OpenAI-compatible gateway for every enabled feature; per-feature settings win—

See AI providers.

#Replication

VariablePurposeDefault
LITESTREAM_URLs3://bucket/path/app.db — command-line mode—
LITESTREAM_CONFIGPath to a Litestream 0.5 YAML — config-file mode (/etc/litestream.yml is picked up automatically)—
LITESTREAM_ACCESS_KEY_ID, LITESTREAM_SECRET_ACCESS_KEYReplica credentials—
AWS_ENDPOINT, AWS_REGIONS3-compatible endpoint and region (R2: https://<account>.r2.cloudflarestorage.com + auto; MinIO: http://minio:9000 + us-east-1)AWS defaults
LITESTREAM_BUCKET, LITESTREAM_PATHUsed only by the example YAML—

See Backups and upgrades.

#In-product Settings

Changed by the platform admin under Settings; every change is audited.

SettingWhereEffect
Tenant nameGeneralShown in the product and the evidence pack
Collection intervalGeneralMinutes between scheduled collections of every configured source (default 60)
Home regionsGeneralRegions not flagged on the Applications page (default uksouth, ukwest, global; empty flags nothing)
Evidence control mapGeneralJSON map from source keys (defender:<slug>, policy:<name>) to control names
Data & backupsGeneralLast backup, back up now, evidence-signing public key
SourcesSourcesTest and sync Azure, Defender, Azure Policy, Azure DevOps, demo
ImportImportStarter packs, CSV and ArchiMate imports
Users and accessUsers & AccessUsers, system roles, the platform admin flag
AIAIProviders, keys, per-feature enablement
Demo toolsDemo ToolsLoad, re-sync or perturb the demo estate