Both images are set up through environment variables. The API's names use a double underscore
between levels, such as Smtp__Host. A setting left out keeps its default. The starter
kits on Hosting with Docker, Hosting on Kubernetes
and Hosting on AKS already set everything a normal installation needs; this page
is for changing one, or for a setup of your own (Running the images).
API: databases
Setting
What it does
ConnectionStrings__DefaultConnection
The database the default workspace's data lives in, such as Host=postgres;Database=omnicore-db;Username=archestack;Password=.... Required.
ConnectionStrings__Core
The default workspace's metadata: entities, pages, scripts. Database omnicore-core. Required.
ConnectionStrings__Identity
Users, workspaces and keys, shared by every workspace. Database omnicore-identity. Required.
ConnectionStrings__Keycloak
Only when moving users over from Keycloak. Set it empty otherwise.
ConnectionStrings__Cluster
How several API instances tell each other about changes. Defaults to the identity database; set it to PostgreSQL itself when a connection pooler such as PgBouncer sits in between.
Database__CreateMissing
true makes the data database when it is missing; the other two are made either way. Default false; the kits set true.
The user in these strings needs the right to create databases: every new workspace gets two of its
own, named after the base names above.
API: addresses
Setting
What it does
ASPNETCORE_URLS
Where the API listens inside the container: http://+:8080.
ASPNETCORE_ENVIRONMENT
Always Production. Anything else shows error details to anybody.
Http__PathBase
The path the API is served under, such as /archestack. Empty at the root.
Identity__AppBaseUrl
The builder's address, such as https://apps.example.com/archestack. Invitation and password reset links point here.
ForwardedHeaders__TrustedProxies
The addresses of the proxies in front, whose X-Forwarded-For is believed. The default covers private networks; without the right one, every visitor looks like the proxy and shares one rate limit.
Tenancy__HostSuffix
Serves every workspace on a hostname of its own, <label>.<suffix>, and lets workspaces add domains of their own. Empty by default.
API: sign-in
Setting
What it does
Identity__Provider
Builtin: Archestack signs people in itself. Default.
The first admin, made on the first start when there is no user yet. Used once: change the password in Archestack afterwards. Leave both out to create the admin in the builder instead.
Identity__AllowCompanySignup
true lets anyone create a company of their own at /register. Default false. A company's admins can run scripts on the server, so leave it off unless you run a public service.
Identity__AccessTokenMinutes
How long a sign-in token lasts before it is renewed. Default 15.
Identity__RefreshTokenDays
How long somebody stays signed in without using Archestack. Default 30.
After this many wrong passwords an account is locked for this long. Defaults 10 and 15.
API: mail
Setting
What it does
Smtp__Host, Smtp__Port, Smtp__UseSsl
The mail server for invitations and password resets. Port 587 and SSL by default. Without a host, the admin who sends an invitation gets the link to pass on.
Smtp__Username, Smtp__Password
The mail server's sign-in.
Smtp__From, Smtp__FromName
The sender those mails show.
The mail that applications send goes through the mail accounts each workspace sets up in its builder.
API: files and backups
Setting
What it does
Files__Directory
Where uploads and workspace files go, such as /files. Put a volume there: in a container without one, files are lost at the next update.
Files__MaxFileBytes
The largest single file. Default 100 MB.
Files__MaxWorkspaceBytes
How much one workspace may keep. Default 0, no limit.
Backup__Directory
Where backups go, such as /backups. Also a volume, and copy what lands there somewhere else.
Backup__RetentionDays
How long backups are kept. Default 30.
Backup__CronSchedule
When the nightly backup runs, as a Quartz cron. Default 0 0 3 * * ?, 03:00.
API: scale and limits
Setting
What it does
Realtime__EntityChanges
false stops screens refreshing when a record changes elsewhere. Default true. Turned off, one installation serves many more people at once; see Capacity and sizing.
Cluster__Enabled
Lets several API instances work as one. Default true; leave it on.
RateLimiting__Enabled
Per-caller request limits. Default true. The limits apply per API instance.
RateLimiting__PermitsPerMinute
Requests one person may make per minute. Default 2000.
RateLimiting__AuthPermitsPerMinute
Sign-in attempts per minute from one address. Default 20.
RateLimiting__PublicPagePermitsPerMinute
What a visitor without an account may ask of public pages per minute. Default 240.
Scripting__TypedData__Enabled
Business entities as typed sets in scripts (Db.Order). Default true.
A certificate that protects the keys stored passwords are encrypted with. Without it those keys are in the identity database unprotected, so a copy of that database holds both halves.
One key pair for browser notifications on every workspace. Left out, each workspace makes its own. Never change it once people have allowed notifications: their subscriptions stop working.
API: monitoring
Setting
What it does
Observability__Enabled
Sends traces, metrics and logs over OpenTelemetry. Default false.
The API's address as the browser reaches it, such as https://api.example.com. Empty when the API is on the same address under /api.
BASE_PATH
The path it is served under, such as /archestack. Empty at the root.
VITE_UI_MODE
dashboard shows the builder at / and the published app under /app. kiosk shows the published app at /, for an address that is only the app.
VITE_DASHBOARD_URL
With kiosk, the builder's address when it is on another hostname.
VITE_APP_URL
With dashboard, the published app's address when it is on another hostname.
API_INTERNAL_URL
The API's address inside the network, such as http://api:8080. Link previews in chat apps and the pages search engines read come from it. In Kubernetes, write the service's full name, http://<service>.<namespace>.svc.cluster.local:8080.
The PostgreSQL image
Setting
What it does
POSTGRES_USER, POSTGRES_PASSWORD
The user the API connects as. The password is set when PostgreSQL first starts on an empty disk; changing the variable later does not change it in the database.
POSTGRES_DB
postgres. The API makes its own databases.
PGDATA
Only on a fresh disk whose root holds lost+found, as in Kubernetes: a folder below the mount, such as /var/lib/postgresql/data/pgdata.
Give the container 1 GB of shared memory, as Running the images explains.
Cookies
We use cookies to improve your experience on this site.