Skip to content
Orvanta Docs

Configuration

All Orvanta components are configured via environment variables, plus a smaller set of instance-level settings that live in the database (editable from Instance settings once the instance is up). The reference below covers the environment variables.

API server

Section titled “API server”
VariableRequiredDefaultDescription
DATABASE_URL✅—PostgreSQL connection string (datastore + job queue). postgres://user:pass@host:5432/orvanta
BASE_URL✅—Public URL of your Orvanta instance, e.g. https://orvanta.example.com. Used to build callback and webhook URLs.
BASE_INTERNAL_URL❌—Internal URL other components use to reach the API server (service-to-service calls) when it differs from BASE_URL, e.g. a cluster-internal Service name.
PORT / BACKEND_PORT❌8000Port the API server listens on.
RUST_LOG❌infoStandard Rust log-filter syntax, e.g. info or orvanta_api=debug,info.

There is no operator-set signing secret: the instance generates its own JWT-signing secret on first boot and stores it in the database, refreshing it automatically — nothing to provision or rotate by hand.

Object storage (S3-compatible, for large job results and workspace artefacts) is configured from Instance settings after boot, not via environment variables — see Object storage in Orvanta.

Worker

Section titled “Worker”
VariableRequiredDefaultDescription
DATABASE_URL✅—Same as API server.
BASE_INTERNAL_URL❌—Same as API server (optional).
NUM_WORKERS❌1Number of worker threads inside this process. Raising it above 1 outside of native/dedicated-worker mode also requires I_ACK_NUM_WORKERS_IS_UNSAFE=1; scaling by running more worker containers/pods is the recommended path instead.
WORKER_TAGS❌—Comma-separated list of tags this worker pulls jobs for (see Worker groups).
WORKER_GROUP❌defaultNamed worker-group config profile this worker process belongs to.

Docker Compose example

Section titled “Docker Compose example”
services:
  server:
    image: ghcr.io/orvanta-cloud/orvanta-platform:main
    environment:
      - DATABASE_URL=postgres://orvanta:changeme@postgres:5432/orvanta?sslmode=disable
      - MODE=server
    ports:
      - "8000:8000"
    depends_on:
      - postgres


  worker:
    image: ghcr.io/orvanta-cloud/orvanta-platform:main
    environment:
      - DATABASE_URL=postgres://orvanta:changeme@postgres:5432/orvanta?sslmode=disable
      - MODE=worker
    depends_on:
      - postgres


  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: orvanta
      POSTGRES_USER: orvanta
      POSTGRES_PASSWORD: changeme
    volumes:
      - postgres_data:/var/lib/postgresql/data


volumes:
  postgres_data:

Orvanta ships as a single image that runs in a role chosen by the MODE environment variable (server, worker, indexer, agent) — there are no separate API and worker images. The Teams edition is ghcr.io/orvanta-cloud/orvanta-platform; the Enterprise edition is ghcr.io/orvanta-cloud/orvanta-platform-oee. For a production-shaped setup (reverse proxy, native worker, indexer, log volumes), start from the docker-compose.yml in the platform repository rather than this minimal example.

TLS

Section titled “TLS”

Orvanta does not handle TLS termination directly. Use a reverse proxy such as Caddy, nginx, or Traefik in front of the API server. All traffic to APP_URL should be HTTPS.

Section titled “Related”