Environment variable reference
LeapView configuration is process-global. Environment settings apply to the entire instance and cannot be overridden per project resource. Values marked secret must come from the deployment environment or a secret manager.
Run leapview config validate to validate the active environment, or add --production to apply production requirements when LEAPVIEW_PRODUCTION is not set. Validation never prints configured values or secrets.
Administration
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_BOOTSTRAP_ADMIN_EMAIL |
string | instance initialization | supported | Email assigned to the initial production administrator. |
Agent
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_AGENT_API_KEY |
string / secret | serve | supported | API key for the configured agent model provider. |
LEAPVIEW_AGENT_BASE_URL |
string / https://api.openai.com/v1 |
serve | supported | OpenAI-compatible agent API base URL. |
LEAPVIEW_AGENT_CONFIG_FILE |
string | serve | supported | Deployment-mounted JSON file watched for live agent configuration reloads. |
LEAPVIEW_AGENT_CREDENTIAL_KEY |
string / secret | serve | supported | Unused legacy agent encryption key. It does not enable administrator-managed settings or decrypt legacy revisions. Configure LEAPVIEW_CREDENTIAL_KEYRING_FILE and explicitly re-enter provider credentials. |
LEAPVIEW_AGENT_MODEL |
string | serve | supported | Legacy deployment-selected agent model identifier. |
LEAPVIEW_AGENT_REASONING_EFFORT |
string | serve | supported | Reasoning effort sent to supported agent models. |
Analytics
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_DASHBOARD_PREWARM_CONCURRENCY |
integer / 1 |
serve | supported | Warm refresh concurrency; the initial implementation accepts only 1. |
LEAPVIEW_DASHBOARD_PREWARM_DEADLINE |
duration / 10s |
serve | supported | Deadline for a local public dashboard warm refresh. |
LEAPVIEW_DASHBOARD_PREWARM_MAX_PUBLICATIONS |
integer / 4 |
serve | supported | Maximum explicitly selected publications to prewarm. |
LEAPVIEW_DASHBOARD_PREWARM_MAX_TARGETS |
integer / 16 |
serve | supported | Maximum default-page targets per warm refresh; larger pages are skipped. |
LEAPVIEW_DASHBOARD_PREWARM_PUBLICATION_IDS |
string | serve | supported | Comma-separated durable public publication row IDs to prewarm locally; empty disables prewarming. |
LEAPVIEW_DUCKDB_NODE_MAX_THREADS |
integer / 5 |
serve | supported | Execution-thread limit shared by all work in the process-owned DuckDB instance. |
LEAPVIEW_DUCKDB_NODE_MEMORY_MAX_BYTES |
integer64 / 2684354560 |
serve | supported | Memory limit for the process-owned DuckDB instance. |
LEAPVIEW_DUCKDB_NODE_TEMP_MAX_BYTES |
integer64 / 10737418240 |
serve | supported | Temporary-storage limit for the process-owned DuckDB instance. |
LEAPVIEW_DUCKDB_TEMP_DIR |
string | serve | supported | Private temporary-storage directory for the process-owned DuckDB instance; defaults beneath LEAPVIEW_HOME. |
LEAPVIEW_QUERY_CACHE_NODE_MAX_BYTES |
integer64 / 536870912 |
serve | supported | Maximum conservatively retained Arrow cache bytes for the node. |
LEAPVIEW_QUERY_CACHE_NODE_MAX_ENTRIES |
integer / 2048 |
serve | supported | Maximum cached result entries retained by the node. |
LEAPVIEW_QUERY_CACHE_RUNTIME_MAX_BYTES |
integer64 / 67108864 |
serve | supported | Maximum conservatively retained Arrow cache bytes for one serving generation. |
LEAPVIEW_QUERY_CACHE_RUNTIME_MAX_ENTRIES |
integer / 256 |
serve | supported | Maximum cached result entries retained by one serving generation. |
LEAPVIEW_QUERY_RESULT_MAX_BYTES |
integer64 / 33554432 |
serve | supported | Maximum conservatively retained Arrow bytes for one logical analytical operation. |
LEAPVIEW_QUERY_RESULT_MAX_ROWS |
integer / 10000 |
serve | supported | Maximum rows retained by one logical analytical operation. |
Assets
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_ASSET_VERSION |
string | serve | supported | Optional browser asset cache-busting version override. |
LEAPVIEW_MAP_ASSET_DIR |
string / .data/map-assets |
serve | supported | Local root containing the verified, content-addressed basemap package. |
Authentication
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_API_TOKEN_ONLY_AUTH |
boolean | serve | supported | Disable browser authentication and accept API tokens only. |
LEAPVIEW_AZURE_CALLBACK_URL |
string | serve | supported | HTTPS callback URL registered with Azure AD or Entra ID. |
LEAPVIEW_AZURE_CLIENT_ID |
string | serve | supported | Azure AD or Entra ID OAuth client identifier. |
LEAPVIEW_AZURE_CLIENT_SECRET |
string / secret | serve | supported | Azure AD or Entra ID OAuth client secret. |
LEAPVIEW_AZURE_TENANT |
string | serve | supported | Optional Azure AD or Entra ID tenant identifier. |
LEAPVIEW_DEV_API_TOKEN |
string / dev / secret |
serve | development | Static bearer credential accepted by the public API in development; replace the development default on shared machines. |
LEAPVIEW_DEV_AUTH_BYPASS |
boolean / false |
serve | development | Bypass authentication in development; forbidden in production. |
LEAPVIEW_DEV_BROWSER_SESSION_TTL |
duration | serve | development | Optional browser-session lifetime for loopback development; production keeps the standard lifetime. |
LEAPVIEW_DEV_COOKIE_NAMESPACE |
string | serve | development | Cookie-name suffix isolating one loopback development worktree from others on localhost. |
LEAPVIEW_DEV_QUICK_LOGIN |
boolean / false |
serve | development | Offer the durable local developer sign-in shortcut on a loopback development server; forbidden in production. |
LEAPVIEW_LOCAL_AUTH |
boolean | serve | supported | Enable administrator-managed local browser authentication. |
LEAPVIEW_MCP_OAUTH_ISSUER_URL |
string | serve | supported | Optional external OAuth issuer for MCP JWT access tokens; when omitted, LeapView provides the MCP authorization server. |
LEAPVIEW_OIDC_CALLBACK_URL |
string | serve | supported | HTTPS callback URL registered with the generic OIDC provider. |
LEAPVIEW_OIDC_CLIENT_ID |
string | serve | supported | Generic OIDC client identifier. |
LEAPVIEW_OIDC_CLIENT_SECRET |
string / secret | serve | supported | Generic OIDC client secret. |
LEAPVIEW_OIDC_ISSUER_URL |
string | serve | supported | HTTPS issuer URL for the generic OIDC provider. |
LEAPVIEW_OIDC_PROVIDER_ID |
string / oidc |
serve | supported | Route-safe identifier for the generic OIDC provider. |
LEAPVIEW_OIDC_SCOPES |
string | serve | supported | Comma- or whitespace-separated additional OIDC scopes. |
LEAPVIEW_SCIM_BEARER_TOKEN |
string / secret | serve | supported | Bearer token enabling SCIM provisioning; production requires at least 32 characters when set. |
Bootstrap
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_BOOTSTRAP_CACHE_DIR |
string | bootstrap tools | tooling | Download cache directory used by dataset bootstrap tools. |
LEAPVIEW_BOOTSTRAP_FORCE |
boolean / false |
bootstrap tools | tooling | Force dataset bootstrap tools to refresh existing files. |
Ci
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_AUTHORING_ARCHIVE |
string | authoring package qualification | internal | Exact released authoring archive supplied to the qualification task. |
LEAPVIEW_AUTHORING_DOCKER_HOST |
string | authoring package qualification | internal | Explicit local Unix Docker socket supplied to the optional authoring lifecycle lane. |
LEAPVIEW_AUTHORING_EVIDENCE_DIR |
string | authoring package qualification | internal | Directory where bounded authoring qualification evidence is written. |
LEAPVIEW_AUTHORING_REQUIRED |
boolean / false |
authoring package qualification | internal | Require authoring package prerequisites instead of recording a skipped result. |
LEAPVIEW_AUTHORING_RUN_LIFECYCLE |
boolean / false |
authoring package qualification | internal | Enable the opt-in released-archive init and local development lifecycle lane. |
LEAPVIEW_CONFORMANCE_EVIDENCE_OUT |
string | MinIO conformance gate | internal | Path where the required object-backed physical-pool conformance evidence artifact is written. |
LEAPVIEW_HISTORICAL_TRANSITION_ADMISSION |
string | historical transition qualification | internal | Absolute path to exact-image OCI admission evidence for final artifact qualification. |
LEAPVIEW_HISTORICAL_TRANSITION_CANDIDATE_IMAGE |
string | historical transition qualification | internal | Exact OCI digest or local pre-merge image ID tested by the transition fixture. |
LEAPVIEW_HISTORICAL_TRANSITION_CANDIDATE_REVISION |
string | historical transition qualification | internal | Full source revision bound to the candidate image. |
LEAPVIEW_HISTORICAL_TRANSITION_EVIDENCE |
string | historical transition qualification | internal | Private absolute path for the passed transition receipt. |
LEAPVIEW_HISTORICAL_TRANSITION_FINAL_ARTIFACT |
boolean / false |
historical transition qualification | internal | Require an admitted published OCI digest instead of a local pre-merge image. |
LEAPVIEW_HISTORICAL_TRANSITION_PREDECESSOR |
string / schema-32 |
historical transition qualification | internal | Exact supported predecessor profile: schema-32 or v0.3.0-alpha.1. |
LEAPVIEW_HISTORICAL_TRANSITION_PRODUCER_WORKFLOW |
string / flidai/leapview/.github/workflows/artifacts.yml |
historical transition qualification | internal | Reviewed workflow that attested the final candidate: flidai/leapview/.github/workflows/artifacts.yml or flidai/leapview/.github/workflows/release.yml. |
LEAPVIEW_HISTORICAL_TRANSITION_REQUIRED |
boolean / false |
historical transition qualification | internal | Require execution of the supported predecessor-to-candidate transition fixture. |
LEAPVIEW_HOST_UPGRADE_QUALIFICATION |
boolean / false |
isolated host recovery qualification | internal | Require the real isolated PostgreSQL recovery and host-layout tests. |
LEAPVIEW_MINIO_CONFORMANCE_REQUIRED |
boolean | MinIO conformance gate | internal | Require the real MinIO conformance lane to fail closed instead of skipping unavailable runtime or evidence checks. |
LEAPVIEW_PLAYWRIGHT_READY |
boolean / false |
browser test setup | internal | Signals that CI already provisioned the pinned Playwright browser and dependencies. |
LEAPVIEW_POSTGRES_BOOTSTRAP_PASSWORD |
string / secret | local PostgreSQL harness | internal | Disposable bootstrap credential for the loopback-only development PostgreSQL container. |
LEAPVIEW_POSTGRES_COMPOSE_PROJECT |
string | local PostgreSQL harness | internal | Explicit Docker Compose project identity used by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_CONFORMANCE_REQUIRED |
boolean | PostgreSQL conformance gate | internal | Require the real PostgreSQL 18 conformance lane to fail closed when Docker or the pinned image is unavailable. |
LEAPVIEW_POSTGRES_CONFORMANCE_SKIP |
boolean | PostgreSQL conformance routing | internal | Skip PostgreSQL-backed packages in ordinary Go test lanes; the dedicated fail-closed conformance lane overrides this flag. |
LEAPVIEW_POSTGRES_CONTROL_MAINTENANCE_PASSWORD |
string / secret | local PostgreSQL harness | internal | Disposable bounded control-maintenance credential generated by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_CONTROL_MIGRATOR_PASSWORD |
string / secret | local PostgreSQL harness | internal | Disposable control-migrator credential generated by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_CONTROL_READONLY_PASSWORD |
string / secret | local PostgreSQL harness | internal | Disposable control-readonly credential generated by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_CONTROL_RUNTIME_PASSWORD |
string / secret | local PostgreSQL harness | internal | Disposable control-runtime credential generated by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_CONTROL_UPGRADE_COORDINATOR_PASSWORD |
string / secret | local PostgreSQL harness | internal | Disposable control upgrade-coordinator credential generated by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_DEV_ENV_FILE |
string | local PostgreSQL harness | internal | Path for the mode-0600 environment file emitted by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_DEV_PORT |
integer | local PostgreSQL harness | internal | Loopback port reserved for the worktree-local PostgreSQL container. |
LEAPVIEW_POSTGRES_DUCKLAKE_MAINTENANCE_PASSWORD |
string / secret | local PostgreSQL harness | internal | Disposable DuckLake-maintenance credential generated by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_DUCKLAKE_MIGRATOR_PASSWORD |
string / secret | local PostgreSQL harness | internal | Disposable DuckLake-migrator credential generated by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_DUCKLAKE_RUNTIME_PASSWORD |
string / secret | local PostgreSQL harness | internal | Disposable DuckLake-runtime credential generated by the local PostgreSQL harness. |
LEAPVIEW_POSTGRES_HA_EVIDENCE_DIR |
string | local PostgreSQL HA qualification | internal | Optional directory for redacted PostgreSQL HA qualification evidence. |
LEAPVIEW_POSTGRES_HA_REPLICATION_PASSWORD |
string / secret | local PostgreSQL HA qualification | internal | Disposable replication credential for the PostgreSQL HA qualification fixture. |
LEAPVIEW_POSTGRES_HA_REWIND_PASSWORD |
string / secret | local PostgreSQL HA qualification | internal | Disposable rewind credential for the PostgreSQL HA qualification fixture. |
LEAPVIEW_POSTGRES_HA_SUPERUSER_PASSWORD |
string / secret | local PostgreSQL HA qualification | internal | Disposable superuser credential for the PostgreSQL HA qualification fixture. |
LEAPVIEW_POSTGRES_HA_WAIT_SECONDS |
integer / 120 |
local PostgreSQL HA qualification | internal | Bounded wait in seconds for each PostgreSQL HA qualification transition. |
LEAPVIEW_POSTGRES_PROJECT_SUFFIX |
string | local PostgreSQL harness | internal | Isolate the Docker Compose project name used by worktree-local PostgreSQL tests. |
LEAPVIEW_POSTGRES_TEST_MODE |
boolean | local PostgreSQL harness | internal | Enable the isolated disposable PostgreSQL test-harness mode. |
LEAPVIEW_QUALIFICATION_FIRMWARE |
string | Nix ARM64 host qualification | internal | Nix-provided UEFI firmware path for the emulated ARM64 Compose qualification guest. |
LEAPVIEW_QUALIFICATION_REQUIRED |
boolean / false |
authoring package qualification | internal | Make missing qualification prerequisites fail the released-artifact gate. |
LEAPVIEW_QUALIFICATION_RUN_LIFECYCLE |
boolean / false |
authoring package qualification | internal | Enable the qualification harness lifecycle lane for an exact archive. |
Client
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_API_TOKEN |
string / secret | client commands | supported | Compatibility API token for an ephemeral CLI invocation; prefer device login for people and workload identity for CI. |
LEAPVIEW_CLI_CONFIG |
string | client commands | supported | Path to the non-secret CLI target profile document. |
LEAPVIEW_TARGET |
string | client commands | supported | Default LeapView API target URL. |
LEAPVIEW_WORKLOAD_CLIENT_ID |
string | client commands | supported | Service-principal identifier exchanged for an ephemeral, scoped CI credential. |
LEAPVIEW_WORKLOAD_CLIENT_SECRET |
string / secret | client commands | supported | Service-principal secret injected by the CI secret manager for workload identity exchange. |
LEAPVIEW_WORKLOAD_PROJECT |
string | client commands | supported | Exact project scope requested by CI workload identity. |
Connection
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_DEVELOPMENT_CREDENTIAL_ENV_FILE |
string | released local runtime package | internal | Checkout-owned private Compose env-file containing only selected development credential bundles. |
LEAPVIEW_DEVELOPMENT_CREDENTIAL_VARIABLES |
string | serve | development | Exact comma-separated local profile credential variables admitted by the development resolver. |
LEAPVIEW_WAREHOUSE_DSN |
string / secret | example connection | external | Example externally supplied warehouse connection credential. |
Connections
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_INFISICAL_ALLOWED_SCOPES |
string | serve | supported | JSON array of exact Infisical project/environment/path-prefix scopes the target runtime may read. |
LEAPVIEW_INFISICAL_BASE_URL |
string | serve | supported | HTTPS origin of the target's authoritative read-only Infisical backend. |
LEAPVIEW_INFISICAL_UNIVERSAL_CLIENT_ID |
string | serve | supported | Infisical Universal Auth machine identity client identifier. |
LEAPVIEW_INFISICAL_UNIVERSAL_CLIENT_SECRET |
string / secret | serve | supported | Infisical Universal Auth bootstrap secret supplied only to the target process. |
Delivery
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_DELIVERY_PHYSICAL_POOL_COMPATIBILITY_DIGEST |
string | serve,admin | supported | Exact immutable compatibility tuple digest required for the configured delivery pool admission. |
LEAPVIEW_DELIVERY_PHYSICAL_POOL_ID |
string | serve,admin | supported | Exact admitted physical-pool identity used by plan-driven candidate builds; startup never synthesizes admission. |
LEAPVIEW_DELIVERY_ROLLBACK_RETENTION_WINDOW |
duration / 24h |
serve,admin | supported | Target-owned duration for which immutable sealed generations remain eligible for rollback. |
LEAPVIEW_DELIVERY_STAGING_DIR |
string | serve,admin | supported | Private staging directory for disposable plan-driven candidate catalogs and remote verification. |
Deployment
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_IMAGE |
string | serve,admin,Hetzner provisioner | supported | Exact immutable LeapView OCI image identity used by release, backup, and qualification workflows. |
LEAPVIEW_MAINTENANCE_SOCKET |
string | serve | supported | Private Unix control socket for a qualified managed maintenance controller. Starts product HTTP and workers closed until explicitly prepared and admitted; missing controller keeps service closed. |
LEAPVIEW_SITE_HOST |
string / 178.105.204.14 |
public-site operator | tooling | Reserved production IPv4 contacted by the public-site deployment command. |
LEAPVIEW_SITE_IMAGE |
string | public-site provisioner | tooling | Immutable LeapView public-site OCI image reference consumed by deployment tooling. |
LEAPVIEW_SITE_SSH_KEY |
string | public-site operator | tooling | Optional path to the dedicated production SSH identity used by the public-site deployment command. |
Development
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_BASE_URL |
string / http://localhost:8195 |
ui-qa | development | Base URL used by browser QA tooling. |
LEAPVIEW_BRIDGE_BENCH_ITERATIONS |
integer / 120 |
browser benchmark | development | Measured Datastar bridge benchmark iterations. |
LEAPVIEW_BRIDGE_BENCH_WARMUP |
integer / 20 |
browser benchmark | development | Warm-up Datastar bridge benchmark iterations. |
LEAPVIEW_BROWSER_PROFILE_OUTPUT |
string | browser performance profile | development | Output directory for route payloads, browser traces, and bounded interaction observations. |
LEAPVIEW_BROWSER_PROFILE_SERVER_RECEIPT |
string | browser performance profile | development | Path to the source, binary, and process identity receipt admitting the owned native fixture server. |
LEAPVIEW_CONTRIBUTOR_DIAGNOSTICS |
boolean / false |
serve | development | Enable source-contributor browser diagnostics; disabled by default independently of the serving environment. |
LEAPVIEW_DEVELOPMENT_GRAPH_DIGEST |
string | released local runtime package | internal | Exact compiled graph identity used by local profile admission. |
LEAPVIEW_DEVELOPMENT_PROFILE_DIGEST |
string | released local runtime package | internal | Exact non-secret selected profile identity used by local profile admission. |
LEAPVIEW_DEVELOPMENT_PROFILE_NAME |
string | released local runtime package | internal | Exact selected local profile name used by runtime admission. |
LEAPVIEW_DEV_ASSET_CACHE_DIR |
string | development asset tools | development | User-level cache shared by worktrees for immutable development datasets and map assets. |
LEAPVIEW_DEV_BOOTSTRAP_TOKEN |
string / secret | dev server | internal | Private typed bootstrap token prepared by the managed development server. |
LEAPVIEW_DEV_CANDIDATE_KEY |
string | dev server | development | Explicit private candidate key for an authorized development publication. |
LEAPVIEW_DEV_LOG_LINES |
integer / 120 |
dev server | development | Number of log lines shown by the managed development server. |
LEAPVIEW_DEV_MCP_ATTEMPTS |
integer / 20 |
dev server | development | Attempts made by the development MCP smoke check while the active project converges. |
LEAPVIEW_DEV_MCP_INTERVAL |
duration / 500ms |
dev server | development | Delay between development MCP smoke-check attempts. |
LEAPVIEW_DEV_MCP_METRIC |
string / revenue |
dev server | development | Metric queried by the development MCP smoke check. |
LEAPVIEW_DEV_MCP_MODEL_QUERY |
string / sales |
dev server | development | Catalog search query used to select the semantic model for the development MCP smoke check. |
LEAPVIEW_DEV_ONCE |
boolean / false |
dev server | development | Stop the managed development server after one successful candidate publication and MCP smoke check. |
LEAPVIEW_DEV_PORT_COUNT |
integer / 100 |
dev server | development | Number of ports scanned by the managed development server. |
LEAPVIEW_DEV_PORT_START |
integer / 8100 |
dev server | development | First port scanned by the managed development server. |
LEAPVIEW_DEV_PROJECT_ID |
string / project:leapview-showcase |
dev server | development | Project identifier used by the managed development server and agent end-to-end workflow. |
LEAPVIEW_DEV_READY_ATTEMPTS |
integer / 150 |
dev server | development | Readiness attempts made by the managed development server. |
LEAPVIEW_DEV_READY_INTERVAL |
duration / 200ms |
dev server | development | Delay between managed development server readiness attempts. |
LEAPVIEW_DEV_RESET_LOGIN |
boolean / false |
dev server | development | Explicitly restore the private local development login during credential preparation. |
LEAPVIEW_DEV_RESTART |
boolean / false |
dev server | development | Force the managed development server to restart. |
LEAPVIEW_DEV_ROTATE_PUBLISHER |
boolean / false |
dev server | development | Revoke and replace the scoped development publisher token during credential preparation. |
LEAPVIEW_DEV_SKIP_DATA_SYNC |
boolean / false |
dev server | development | Reuse staged managed data instead of opening new upload sessions during development publication. |
LEAPVIEW_DEV_SKIP_PUBLISH |
boolean / false |
dev server | development | Skip automatic project publishing in the managed development server. |
LEAPVIEW_DEV_SOURCE_ROOT |
string / dashboards |
dev server | development | Analytics source root published by the managed development server. |
LEAPVIEW_DEV_WORKTREE |
string | dev server | internal | Worktree path exported by the managed development server. |
LEAPVIEW_LOCAL_APP_PORT |
integer | released local runtime package | internal | Checkout-scoped loopback host port selected by the local runtime controller. |
LEAPVIEW_LOCAL_CHECKOUT_ID |
string | released local runtime package | internal | Canonical checkout identity supplied by the local runtime controller for resource labeling and profile admission. |
LEAPVIEW_LOCAL_OWNER_ID |
string | released local runtime package | internal | Owner identity supplied by the local runtime controller for resource labeling and profile admission. |
LEAPVIEW_PERF_ENFORCE_THRESHOLDS |
boolean / false |
dashboard performance QA | development | Fail dashboard performance QA when phase latency or query-count thresholds are exceeded. |
LEAPVIEW_PERF_ITERATIONS |
integer / 5 |
dashboard performance QA | development | Measured interaction iterations run by the configured dashboard performance scenario. |
LEAPVIEW_PERF_LOG |
string / .tmp/dev-server.log |
dashboard performance QA | development | Development server log consumed by dashboard performance QA. |
LEAPVIEW_PERF_MAX_ALL_TARGET_P95_MS |
integer / 1000 |
dashboard performance QA | development | Maximum all-target settlement p95 when performance thresholds are enforced. |
LEAPVIEW_PERF_MAX_CRITICAL_KPI_P95_MS |
integer / 1000 |
dashboard performance QA | development | Maximum critical-KPI settlement p95 when performance thresholds are enforced. |
LEAPVIEW_PERF_MAX_FIRST_TARGET_PAINT_P95_MS |
integer / 500 |
dashboard performance QA | development | Maximum first-target paint p95 when performance thresholds are enforced. |
LEAPVIEW_PERF_MAX_OPTIMISTIC_FEEDBACK_P95_MS |
integer / 16 |
dashboard performance QA | development | Maximum local optimistic-feedback p95 when performance thresholds are enforced. |
LEAPVIEW_PERF_MAX_QUERIES |
integer / 4 |
dashboard performance QA | development | Maximum physical queries per measured refresh when performance thresholds are enforced. |
LEAPVIEW_PERF_OUTPUT |
string | dashboard performance QA | development | Optional JSON output path; defaults to a suite-specific file under .tmp. |
LEAPVIEW_PERF_SCENARIO |
string / scripts/performance/movielens.json |
dashboard performance QA | development | Path to a dashboard performance scenario manifest. |
LEAPVIEW_QA_DISPOSABLE |
boolean / false |
ui-qa | internal | Marks the isolated QA server whose database is destroyed after browser mutation checks. |
LEAPVIEW_QA_STORAGE_STATE |
string | ui-qa | internal | Private Playwright browser-session file used by authenticated route and visual QA. |
LEAPVIEW_ROUTE_QA_SCOPE |
string / all |
ui-qa | development | Assembled browser route QA scope. |
LEAPVIEW_SMOKE_PORT |
integer / 18080 |
production image smoke test | internal | Host port used by the production image smoke test. |
LEAPVIEW_UI_QA_SCOPE |
string / all |
ui-qa | development | UI framework QA scope; all runs route and visual coverage, while visual runs only screenshot comparisons. |
LEAPVIEW_UPDATE_VISUAL_BASELINES |
boolean / false |
ui-qa | development | Write reviewed UI visual-regression baselines before immediately comparing them again. |
LEAPVIEW_VISUAL_ARTIFACT_DIR |
string / .tmp/qa-ui-framework/visual-artifacts |
ui-qa | development | Directory where UI visual-regression reports and failure artifacts are written. |
Ducklake Retention
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_DUCKLAKE_RETENTION_FILE_GRACE_PERIOD |
duration / 24h |
serve | supported | Minimum age of DuckLake files before bounded retention cleanup. |
LEAPVIEW_DUCKLAKE_RETENTION_INTERVAL |
duration / 1h |
serve | supported | Interval between bounded DuckLake catalog retention passes. |
Jobs
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_JOB_EXECUTION_TIMEOUT |
duration / 24h |
serve | supported | River worker execution deadline, independent of renewable capability leases. |
Maintenance
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_MANAGED_CONFIG |
string | managed release adapter | internal | Controller-injected enrolled Kamal configuration path. |
LEAPVIEW_MANAGED_DEADLINE_UNIX_MS |
integer64 | managed release adapter | internal | Controller-injected absolute child-process deadline in Unix milliseconds. |
LEAPVIEW_MANAGED_FAILURE_NONCE |
string / secret | managed release adapter | internal | Controller-generated private per-command nonce binding fixed failure categories to the local child process. |
LEAPVIEW_MANAGED_GATE |
string | managed release adapter | internal | Controller-injected private durable proxy ingress gate path. |
LEAPVIEW_MANAGED_IMAGE |
string | managed release adapter | internal | Controller-injected admitted immutable application image. |
LEAPVIEW_MANAGED_LOCK_FD |
integer | managed release adapter | internal | Controller-inherited host exclusion lock descriptor; its identity and ownership are independently verified. |
LEAPVIEW_MANAGED_LOCK_PATH |
string | managed release adapter | internal | Controller-injected host exclusion lock path used to verify the inherited descriptor. |
LEAPVIEW_MANAGED_PROXY_IMAGE |
string | managed release adapter | internal | Controller-injected retained immutable proxy image. |
LEAPVIEW_MANAGED_REVISION |
string | managed release adapter | internal | Controller-injected exact application source revision. |
Managed Data
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_MANAGED_DATA_BACKEND |
string / local |
serve | supported | Storage backend for project-global managed data; supported values are local and s3. Production local storage requires provider-native volume snapshot protection. |
LEAPVIEW_MANAGED_DATA_DIR |
string | serve | supported | Private local root for managed-data objects, upload staging, and verified runtime views; defaults beneath LEAPVIEW_HOME. |
LEAPVIEW_MANAGED_DATA_GC_GRACE_PERIOD |
duration / 24h |
serve | supported | Minimum age of unreferenced managed-data objects before garbage collection. |
LEAPVIEW_MANAGED_DATA_GC_INTERVAL |
duration / 1h |
serve | supported | Interval between managed-data garbage-collection passes. |
LEAPVIEW_MANAGED_DATA_MAX_FILES |
integer / 10000 |
serve | supported | Maximum number of files in one managed-data revision. |
LEAPVIEW_MANAGED_DATA_MAX_FILE_BYTES |
integer64 / 1073741824 |
serve | supported | Maximum size in bytes of one managed-data file. |
LEAPVIEW_MANAGED_DATA_MAX_REVISION_BYTES |
integer64 / 10737418240 |
serve | supported | Maximum total size in bytes of one managed-data revision. |
LEAPVIEW_MANAGED_DATA_MIN_FREE_BYTES |
integer64 / 5368709120 |
serve | supported | Minimum free bytes required before accepting local managed-data uploads. |
LEAPVIEW_MANAGED_DATA_S3_ACCESS_KEY_ID |
string / secret | serve | supported | Optional S3 access-key identifier for managed-data storage. |
LEAPVIEW_MANAGED_DATA_S3_BUCKET |
string | serve | supported | S3 bucket used for managed-data objects and staging. |
LEAPVIEW_MANAGED_DATA_S3_ENDPOINT |
string | serve | supported | Optional S3-compatible endpoint URL. |
LEAPVIEW_MANAGED_DATA_S3_OBSERVATION_ACCOUNT |
string | serve | supported | Non-secret provider account identity used to bind managed-data S3 write observations. |
LEAPVIEW_MANAGED_DATA_S3_OBSERVATION_PROFILE_ID |
string | serve | supported | Non-secret stable provider profile identity used to bind managed-data S3 write observations. |
LEAPVIEW_MANAGED_DATA_S3_PATH_STYLE |
boolean / false |
serve | supported | Use path-style addressing for S3-compatible managed-data storage. |
LEAPVIEW_MANAGED_DATA_S3_PREFIX |
string / managed-data |
serve | supported | Object-key prefix for managed data in the configured S3 bucket. |
LEAPVIEW_MANAGED_DATA_S3_REGION |
string | serve | supported | S3 region used for managed-data requests. |
LEAPVIEW_MANAGED_DATA_S3_SECRET_ACCESS_KEY |
string / secret | serve | supported | Optional S3 secret access key for managed-data storage. |
LEAPVIEW_MANAGED_DATA_S3_SESSION_TOKEN |
string / secret | serve | supported | Optional temporary S3 session token for managed-data storage. |
LEAPVIEW_MANAGED_DATA_UPLOAD_SESSION_TTL |
duration / 24h |
serve | supported | Lifetime of an incomplete managed-data upload session. |
Object Store
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_OBJECT_STORE_BACKEND |
string / filesystem |
serve | supported | Immutable object-store backend for project sources and compiled serving artifacts; supported values are filesystem and s3. Production filesystem storage requires provider-native volume snapshot protection. |
LEAPVIEW_OBJECT_STORE_FILESYSTEM_ROOT |
string | serve | supported | Optional private, dedicated filesystem root for immutable project sources and compiled serving artifacts; defaults beneath LEAPVIEW_HOME/artifacts. |
LEAPVIEW_OBJECT_STORE_S3_ACCESS_KEY_ID |
string / secret | serve | supported | Optional static S3 access-key identifier for immutable project sources and compiled serving artifacts; omitted values use ambient AWS credentials. |
LEAPVIEW_OBJECT_STORE_S3_BUCKET |
string | serve | supported | S3 bucket for immutable project sources and compiled serving artifacts. |
LEAPVIEW_OBJECT_STORE_S3_ENCRYPTION_CUSTOMER_KEY |
string / secret | serve | supported | Secret standard-base64 32-byte customer key used for immutable object-store S3 SSE-C requests. |
LEAPVIEW_OBJECT_STORE_S3_ENCRYPTION_KEY_REF |
string | serve | supported | Opaque application encryption-key epoch reference for immutable object-store S3 encryption; never sent to S3 as a key ID. |
LEAPVIEW_OBJECT_STORE_S3_ENCRYPTION_MODE |
string / AES256 |
serve | supported | Explicit server-side encryption mode for immutable object-store S3 objects: AES256 (SSE-S3), aws:kms (SSE-KMS), or sse-c (SSE-C). |
LEAPVIEW_OBJECT_STORE_S3_ENCRYPTION_PROVIDER_KEY |
string | serve | supported | Target-resolved provider KMS key identity used for immutable object-store S3 SSE-KMS requests. |
LEAPVIEW_OBJECT_STORE_S3_ENDPOINT |
string | serve | supported | Optional S3-compatible endpoint URL for immutable project sources and compiled serving artifacts. |
LEAPVIEW_OBJECT_STORE_S3_EXPECTED_BUCKET_OWNER |
string | serve | supported | Optional twelve-digit AWS account ID expected to own the immutable object-store bucket. |
LEAPVIEW_OBJECT_STORE_S3_PATH_STYLE |
boolean / false |
serve | supported | Use path-style addressing for S3-compatible immutable object storage. |
LEAPVIEW_OBJECT_STORE_S3_PREFIX |
string / objects |
serve | supported | Object-key prefix for immutable project sources and compiled serving artifacts in the configured S3 bucket. |
LEAPVIEW_OBJECT_STORE_S3_REGION |
string | serve | supported | S3 region used for immutable project sources and compiled serving artifact requests. |
LEAPVIEW_OBJECT_STORE_S3_SECRET_ACCESS_KEY |
string / secret | serve | supported | Optional static S3 secret access key for immutable project sources and compiled serving artifacts; omitted values use ambient AWS credentials. |
LEAPVIEW_OBJECT_STORE_S3_SESSION_TOKEN |
string / secret | serve | supported | Optional static S3 session token for immutable project sources and compiled serving artifacts. |
Operations
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_HEALTHCHECK_URL |
string | healthcheck | supported | Explicit readiness URL used by the healthcheck command. |
LEAPVIEW_METRICS_BEARER_TOKEN |
string / secret | serve | supported | Bearer token protecting the Prometheus metrics endpoint; production requires at least 32 characters. |
Postgres
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_POSTGRES_BOOTSTRAP_HOST |
string | bundled PostgreSQL role reconciliation | internal | TLS-verified PostgreSQL service hostname supplied to the idempotent host bootstrap retry; the bundled deployment uses postgres. |
LEAPVIEW_POSTGRES_CONTROL_ACQUIRE_TIMEOUT |
duration / 5s |
serve | supported | Maximum time to wait when acquiring a control-plane PostgreSQL connection. |
LEAPVIEW_POSTGRES_CONTROL_IDLE_TX_TIMEOUT |
duration / 1m |
serve | supported | Control-plane PostgreSQL idle-in-transaction timeout. |
LEAPVIEW_POSTGRES_CONTROL_LOCK_TIMEOUT |
duration / 5s |
serve | supported | Control-plane PostgreSQL session lock-wait timeout. |
LEAPVIEW_POSTGRES_CONTROL_MAINTENANCE_ROLE |
string / leapview_control_maintenance |
maintenance operation | supported | Provisioned canonical PostgreSQL role used by bounded control-plane maintenance operations; custom role names are rejected. |
LEAPVIEW_POSTGRES_CONTROL_MAINTENANCE_URL |
string / secret | maintenance operation | supported | Explicit PostgreSQL control-plane maintenance URL using the separately authenticated bounded maintenance role. |
LEAPVIEW_POSTGRES_CONTROL_MIGRATOR_ROLE |
string / leapview_control_migrator |
initialization operation | supported | Provisioned canonical PostgreSQL role used by explicit control-plane migrations; custom role names are rejected. |
LEAPVIEW_POSTGRES_CONTROL_MIGRATOR_URL |
string / secret | initialization operation | supported | Explicit PostgreSQL control-plane migration connection URL; never opened by production serving. |
LEAPVIEW_POSTGRES_CONTROL_POOL_MAX_CONNS |
integer / 8 |
serve | supported | Maximum connections allowed in the control-plane PostgreSQL pool. |
LEAPVIEW_POSTGRES_CONTROL_POOL_MIN_CONNS |
integer / 1 |
serve | supported | Minimum connections reserved for the control-plane PostgreSQL pool. |
LEAPVIEW_POSTGRES_CONTROL_READONLY_ROLE |
string / leapview_control_readonly |
serve | supported | Provisioned canonical PostgreSQL role used by the optional control-plane readonly pool; custom role names are rejected. |
LEAPVIEW_POSTGRES_CONTROL_READONLY_URL |
string / secret | serve | supported | Optional PostgreSQL control-plane readonly connection URL for bounded reporting and backup reads. |
LEAPVIEW_POSTGRES_CONTROL_RUNTIME_ROLE |
string / leapview_control_runtime |
serve | supported | Provisioned canonical PostgreSQL role used by the control-plane pool; custom role names are rejected. |
LEAPVIEW_POSTGRES_CONTROL_STATEMENT_TIMEOUT |
duration / 30s |
serve | supported | Control-plane PostgreSQL session statement timeout. |
LEAPVIEW_POSTGRES_CONTROL_UPGRADE_COORDINATOR_ROLE |
string / leapview_control_upgrade_coordinator |
upgrade operation | supported | Provisioned canonical PostgreSQL role used by the DuckLake upgrade coordinator connection; custom role names are rejected. |
LEAPVIEW_POSTGRES_CONTROL_UPGRADE_COORDINATOR_URL |
string / secret | upgrade operation | supported | Explicit PostgreSQL control-plane upgrade coordinator URL; this role has no owner membership and only guarded DuckLake authority functions. |
LEAPVIEW_POSTGRES_CONTROL_URL |
string / secret | serve | supported | Explicit PostgreSQL control-plane connection URL (including credentials and TLS parameters). |
LEAPVIEW_POSTGRES_DUCKLAKE_ACQUIRE_TIMEOUT |
duration / 5s |
serve | supported | Maximum time to wait when acquiring a DuckLake catalog PostgreSQL connection. |
LEAPVIEW_POSTGRES_DUCKLAKE_IDLE_TX_TIMEOUT |
duration / 1m |
serve | supported | DuckLake catalog PostgreSQL idle-in-transaction timeout. |
LEAPVIEW_POSTGRES_DUCKLAKE_LOCK_TIMEOUT |
duration / 5s |
serve | supported | DuckLake catalog PostgreSQL session lock-wait timeout. |
LEAPVIEW_POSTGRES_DUCKLAKE_MAINTENANCE_ROLE |
string / leapview_ducklake_maintenance |
maintenance operation | supported | Provisioned canonical PostgreSQL role used by bounded DuckLake catalog expiry and cleanup operations; custom role names are rejected. |
LEAPVIEW_POSTGRES_DUCKLAKE_MAINTENANCE_URL |
string / secret | maintenance operation | supported | Explicit PostgreSQL DuckLake catalog maintenance URL using the separately authenticated bounded cleanup role. |
LEAPVIEW_POSTGRES_DUCKLAKE_MIGRATOR_ROLE |
string / leapview_ducklake_migrator |
upgrade operation | supported | Provisioned canonical PostgreSQL role used by the DuckLake catalog migration connection; custom role names are rejected. |
LEAPVIEW_POSTGRES_DUCKLAKE_MIGRATOR_URL |
string / secret | upgrade operation | supported | Explicit PostgreSQL DuckLake catalog owner-capable migration URL; never used by ordinary runtime attachments. |
LEAPVIEW_POSTGRES_DUCKLAKE_POOL_MAX_CONNS |
integer / 4 |
serve | supported | Maximum connections allowed in the DuckLake catalog PostgreSQL pool. |
LEAPVIEW_POSTGRES_DUCKLAKE_POOL_MIN_CONNS |
integer / 1 |
serve | supported | Minimum connections reserved for the DuckLake catalog PostgreSQL pool. |
LEAPVIEW_POSTGRES_DUCKLAKE_RUNTIME_ROLE |
string / leapview_ducklake_runtime |
serve | supported | Provisioned canonical PostgreSQL role used by the DuckLake catalog pool; custom role names are rejected. |
LEAPVIEW_POSTGRES_DUCKLAKE_STATEMENT_TIMEOUT |
duration / 30s |
serve | supported | DuckLake catalog PostgreSQL session statement timeout. |
LEAPVIEW_POSTGRES_DUCKLAKE_URL |
string / secret | serve | supported | Explicit PostgreSQL DuckLake catalog connection URL; independent from the control-plane URL. |
LEAPVIEW_POSTGRES_EXPECTED_MAJOR |
integer / 18 |
serve | supported | Required PostgreSQL server major version for runtime readiness. |
LEAPVIEW_POSTGRES_REQUIRE_TLS |
boolean / true |
serve | supported | Require PostgreSQL URLs to use sslmode=verify-full, authenticating both the server certificate chain and hostname. |
LEAPVIEW_POSTGRES_SECRET_DIR |
string | bundled PostgreSQL container bootstrap | internal | Persistent in-volume directory containing the bundled PostgreSQL bootstrap credentials and TLS material; set by the private PostgreSQL Compose service. |
Recovery
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_RECOVERY_SET_ID |
string | serve | supported | Optional exact recovery-set UUID required for production pre-traffic validation; readiness reads only this immutable ID. |
Refresh
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_REFRESH_JOB_LEASE_TIMEOUT |
duration / 2m |
serve | supported | Lease duration before an abandoned refresh job may be reclaimed. |
Release
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_DESKTOP_DISTRIBUTION |
string | desktop packaging | tooling | Required desktop package identity; accepted values are preview and stable. |
LEAPVIEW_DESKTOP_PACKAGED_PROOF_ORIGIN |
string | packaged desktop security proof | internal | Exact loopback hostile-instance origin injected only into an isolated packaged-app security proof. |
LEAPVIEW_DESKTOP_RELEASE_MANIFEST |
string / docs/desktop-release.json |
public site smoke | tooling | Desktop release manifest compared with the public download page and deployed desktop release identity. |
LEAPVIEW_PACKAGED_APP |
string | packaged desktop security proof | internal | Path to the exact packaged LeapView executable qualified by the hostile-instance proof. |
LEAPVIEW_PUBLIC_RELEASE_MANIFEST |
string / docs/public-release.json |
public site smoke | tooling | Release manifest compared with the public site's deployed release identity. |
LEAPVIEW_PUBLIC_SITE_ALIASES |
string / http://leapview.dev,https://www.leapview.dev |
public site smoke | tooling | Comma-separated public aliases that must redirect to the canonical site origin. |
LEAPVIEW_PUBLIC_SITE_URL |
string / https://leapview.dev |
public site smoke | tooling | Canonical public site origin verified by the release adoption smoke test. |
Security
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_ALLOWED_HOSTS |
string | serve | supported | Comma- or whitespace-separated exact hosts and wildcard suffixes accepted in production. |
LEAPVIEW_COOKIE_SECURE |
boolean | serve | supported | Secure-cookie override; defaults to true for production browser authentication. |
LEAPVIEW_CREDENTIAL_KEYRING_FILE |
string | serve,admin credentials setup | supported | Private credential-keyring-v1 file for customer credentials, bound to the durable instance ID. Configure after admin initialization and declare the customer owner with admin credentials setup. Key bytes never belong in environment variables or PostgreSQL. |
LEAPVIEW_CSRF_KEY |
string / secret | serve | supported | Key used for CSRF protection and OAuth state cookies; requires at least 32 characters. |
LEAPVIEW_TOKEN_HASH_KEY |
string / secret | serve | supported | Optional dedicated key for deterministic API-token fingerprints; falls back to the CSRF key. |
LEAPVIEW_TRUST_PROXY_HEADERS |
boolean / false |
serve | supported | Trust client-address headers only when a trusted proxy overwrites them. |
Server
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_ADDR |
string | serve,healthcheck | supported | HTTP listen address. |
LEAPVIEW_ENVIRONMENT |
string | serve,admin | supported | Single serving environment permanently bound to this LeapView instance. |
LEAPVIEW_PRODUCTION |
boolean / false |
serve,admin | supported | Enable production serving and validation behavior. |
LEAPVIEW_PUBLIC_URL |
string | serve | supported | Canonical externally visible LeapView origin used for MCP resource identity and OAuth discovery. |
LEAPVIEW_REQUIRE_ACTIVE_DEPLOYMENT |
boolean / false |
serve | supported | Require an active serving deployment before readiness succeeds; production always enables this contract. |
Site
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_SITE_BASE_URL |
string | public site | supported | Externally visible HTTP(S) origin used for canonical URLs, discovery documents, and transport policy. |
LEAPVIEW_SITE_SHOWCASE_EMBED_URL |
string | public site | supported | Optional public dashboard embed URL that enables the live /showcase route and its exact frame-src policy. |
Storage
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_DUCKDB_DIR |
string | serve | supported | Directory containing node-local DuckDB runtime state. |
LEAPVIEW_DUCKDB_EXTENSION_CACHE_DIR |
string | serve | supported | Private content-addressed cache for admitted DuckDB extensions. |
LEAPVIEW_DUCKDB_EXTENSION_SUPPLY_PATH |
string | serve | supported | Required absolute path to the target-reviewed packaged DuckDB extension supply document. |
LEAPVIEW_DUCKDB_EXTENSION_SUPPLY_SHA256 |
string | serve | supported | Required lowercase SHA-256 digest anchoring the complete extension supply document. |
LEAPVIEW_HOME |
string / .leapview |
serve,admin,client | supported | Instance state directory containing databases, artifacts, and runtime files. |
Workload
| Environment variable | Type / default | Scope | Lifecycle | Description |
|---|---|---|---|---|
LEAPVIEW_WORKLOAD_BACKGROUND_EXECUTION_TIMEOUT |
duration / 15m |
serve | supported | Maximum execution time for background work. |
LEAPVIEW_WORKLOAD_BACKGROUND_MAX_QUEUED |
integer / 16 |
serve | supported | Maximum queued background operations. |
LEAPVIEW_WORKLOAD_BACKGROUND_MAX_RUNNING |
integer / 1 |
serve | supported | Maximum concurrently running background operations. |
LEAPVIEW_WORKLOAD_BACKGROUND_QUEUE_TIMEOUT |
duration / 2m |
serve | supported | Maximum time background work may wait for admission. |
LEAPVIEW_WORKLOAD_BACKGROUND_RESERVED_RUNNING |
integer / 0 |
serve | supported | Capacity reserved for background work when background demand is queued. |
LEAPVIEW_WORKLOAD_CONTROL_EXECUTION_TIMEOUT |
duration / 15m |
serve | supported | Maximum execution time for control work. |
LEAPVIEW_WORKLOAD_CONTROL_MAX_QUEUED |
integer / 16 |
serve | supported | Maximum queued control operations. |
LEAPVIEW_WORKLOAD_CONTROL_MAX_RUNNING |
integer / 1 |
serve | supported | Maximum concurrently running control operations. |
LEAPVIEW_WORKLOAD_CONTROL_QUEUE_TIMEOUT |
duration / 2m |
serve | supported | Maximum time control work may wait for admission. |
LEAPVIEW_WORKLOAD_CONTROL_RESERVED_RUNNING |
integer / 1 |
serve | supported | Capacity reserved for node-scoped control work when control demand is queued. |
LEAPVIEW_WORKLOAD_INTERACTIVE_EXECUTION_TIMEOUT |
duration / 2m |
serve | supported | Maximum execution time for interactive work. |
LEAPVIEW_WORKLOAD_INTERACTIVE_MAX_QUEUED |
integer / 64 |
serve | supported | Maximum queued interactive operations. |
LEAPVIEW_WORKLOAD_INTERACTIVE_MAX_RUNNING |
integer / 4 |
serve | supported | Maximum concurrently running interactive operations. |
LEAPVIEW_WORKLOAD_INTERACTIVE_QUEUE_TIMEOUT |
duration / 30s |
serve | supported | Maximum time interactive work may wait for admission. |
LEAPVIEW_WORKLOAD_INTERACTIVE_RESERVED_RUNNING |
integer / 3 |
serve | supported | Capacity reserved for interactive work when interactive demand is queued. |
LEAPVIEW_WORKLOAD_MAINTENANCE_EXECUTION_TIMEOUT |
duration / 30m |
serve | supported | Maximum execution time for maintenance work. |
LEAPVIEW_WORKLOAD_MAINTENANCE_MAX_QUEUED |
integer / 0 |
serve | supported | Maximum queued maintenance operations; zero makes maintenance skip when saturated. |
LEAPVIEW_WORKLOAD_MAINTENANCE_MAX_RUNNING |
integer / 1 |
serve | supported | Maximum concurrently running maintenance operations. |
LEAPVIEW_WORKLOAD_MAINTENANCE_QUEUE_TIMEOUT |
duration / 0s |
serve | supported | Maximum time maintenance may wait; zero means no wait. |
LEAPVIEW_WORKLOAD_MAINTENANCE_RESERVED_RUNNING |
integer / 0 |
serve | supported | Capacity reserved for maintenance work when maintenance demand is queued. |
LEAPVIEW_WORKLOAD_MAX_QUEUED |
integer / 112 |
serve | supported | Maximum queued operations across all workload classes. |
LEAPVIEW_WORKLOAD_MAX_RUNNING |
integer / 5 |
serve | supported | Maximum operations running concurrently on this node. |
LEAPVIEW_WORKLOAD_REFRESH_EXECUTION_TIMEOUT |
duration / 0s |
serve | supported | Maximum execution time for refresh work; zero leaves the deadline to the workflow. |
LEAPVIEW_WORKLOAD_REFRESH_MAX_QUEUED |
integer / 16 |
serve | supported | Maximum queued refresh operations. |
LEAPVIEW_WORKLOAD_REFRESH_MAX_RUNNING |
integer / 1 |
serve | supported | Maximum concurrently running refresh operations. |
LEAPVIEW_WORKLOAD_REFRESH_QUEUE_TIMEOUT |
duration / 2m |
serve | supported | Maximum time refresh work may wait for admission. |
LEAPVIEW_WORKLOAD_REFRESH_RESERVED_RUNNING |
integer / 1 |
serve | supported | Capacity reserved for refresh work when refresh demand is queued. |
Relationships
- agent-reasoning-effort: Agent reasoning effort uses a supported API value. Failure:
LEAPVIEW_AGENT_REASONING_EFFORT must be none, low, medium, high, xhigh, or max. - production-dev-bypass: Production cannot bypass authentication. Failure:
production serve must not enable LEAPVIEW_DEV_AUTH_BYPASS. - production-oidc-complete: OIDC settings are all-or-none in production. Failure:
production OIDC auth requires LEAPVIEW_OIDC_ISSUER_URL, LEAPVIEW_OIDC_CLIENT_ID, LEAPVIEW_OIDC_CLIENT_SECRET, and LEAPVIEW_OIDC_CALLBACK_URL. - production-azure-complete: Azure settings are all-or-none in production. Failure:
production Azure auth requires LEAPVIEW_AZURE_CLIENT_ID, LEAPVIEW_AZURE_CLIENT_SECRET, and LEAPVIEW_AZURE_CALLBACK_URL. - production-auth-mode: Production requires local, API-token-only, OIDC, or Azure authentication. Failure:
production serve requires OIDC auth env vars, Azure auth env vars, LEAPVIEW_LOCAL_AUTH, or LEAPVIEW_API_TOKEN_ONLY_AUTH. - csrf-key: A CSRF key must contain at least 32 characters. Failure:
serve requires LEAPVIEW_CSRF_KEY with at least 32 characters. - production-metrics-token: Production requires a metrics bearer token with at least 32 characters. Failure:
production metrics scraping requires LEAPVIEW_METRICS_BEARER_TOKEN with at least 32 characters. - production-public-url: Production requires a canonical public URL. Failure:
production serve requires LEAPVIEW_PUBLIC_URL. - production-public-url-https: The production public URL must be an HTTPS origin without a path, query, fragment, or credentials. Failure:
production serve requires LEAPVIEW_PUBLIC_URL to be an https origin. - production-mcp-oauth-issuer-https: An external production MCP OAuth issuer must use HTTPS. Failure:
production serve requires LEAPVIEW_MCP_OAUTH_ISSUER_URL to be an https URL. - production-allowed-host: Production derives an allowed host from its public URL, explicit hosts, or a browser-auth callback host. Failure:
production serve requires LEAPVIEW_PUBLIC_URL, LEAPVIEW_ALLOWED_HOSTS, or an OIDC/Azure callback URL host. - production-secure-cookie: Production browser authentication requires secure cookies unless API-token-only mode is also enabled. Failure:
production browser auth requires LEAPVIEW_COOKIE_SECURE=true. - production-oidc-issuer-https: The production OIDC issuer must use HTTPS. Failure:
production serve requires LEAPVIEW_OIDC_ISSUER_URL to be an https URL. - production-oidc-callback-https: The production OIDC callback must use HTTPS. Failure:
production serve requires LEAPVIEW_OIDC_CALLBACK_URL to be an https URL. - production-oidc-provider-slug: The OIDC provider identifier must be route-safe. Failure:
LEAPVIEW_OIDC_PROVIDER_ID must be a route-safe slug containing only letters, numbers, dots, underscores, or dashes. - production-azure-callback-https: The production Azure callback must use HTTPS. Failure:
production serve requires LEAPVIEW_AZURE_CALLBACK_URL to be an https URL. - infisical-complete: The read-only Infisical target resolver is configured as one complete tuple. Failure:
Infisical resolution requires LEAPVIEW_INFISICAL_BASE_URL, LEAPVIEW_INFISICAL_UNIVERSAL_CLIENT_ID, LEAPVIEW_INFISICAL_UNIVERSAL_CLIENT_SECRET, and LEAPVIEW_INFISICAL_ALLOWED_SCOPES. - infisical-https: The Infisical backend is an HTTPS origin. Failure:
LEAPVIEW_INFISICAL_BASE_URL must be an https origin. - production-scim-token: A configured production SCIM token must contain at least 32 characters. Failure:
production SCIM provisioning requires LEAPVIEW_SCIM_BEARER_TOKEN with at least 32 characters. - managed-data-backend: Managed data uses a supported storage backend. Failure:
LEAPVIEW_MANAGED_DATA_BACKEND must be local or s3. - managed-data-runtime-dir: Every managed-data backend requires a private local runtime and staging directory. Failure:
managed-data storage requires LEAPVIEW_MANAGED_DATA_DIR. - managed-data-s3-location: The S3 managed-data backend requires a bucket and region. Failure:
S3 managed-data storage requires LEAPVIEW_MANAGED_DATA_S3_BUCKET and LEAPVIEW_MANAGED_DATA_S3_REGION. - production-managed-data-s3-endpoint: Production custom managed-data S3 endpoints must use encrypted transport. Failure:
production managed-data S3 custom endpoints must use HTTPS. - production-managed-data-s3-observation-profile: Production managed-data S3 writes require an explicit provider observation profile. Failure:
production managed-data S3 requires LEAPVIEW_MANAGED_DATA_S3_OBSERVATION_ACCOUNT and LEAPVIEW_MANAGED_DATA_S3_OBSERVATION_PROFILE_ID. - managed-data-s3-credentials: Managed-data S3 credentials are either omitted or configured as a complete key pair. Failure:
managed-data S3 credentials require both LEAPVIEW_MANAGED_DATA_S3_ACCESS_KEY_ID and LEAPVIEW_MANAGED_DATA_S3_SECRET_ACCESS_KEY; a session token also requires that pair. - managed-data-positive-limits: Managed-data upload, session, garbage-collection, and free-space limits are positive. Failure:
managed-data limits, durations, and free-space thresholds must be positive. - ducklake-retention-positive-limits: DuckLake catalog retention interval and file grace period are positive. Failure:
production DuckLake retention interval and file grace period must be positive. - managed-data-revision-limit: The managed-data revision limit is at least the per-file limit. Failure:
LEAPVIEW_MANAGED_DATA_MAX_REVISION_BYTES must be at least LEAPVIEW_MANAGED_DATA_MAX_FILE_BYTES. - object-store-backend: Immutable project sources and serving artifacts use a supported object-store backend. Failure:
LEAPVIEW_OBJECT_STORE_BACKEND must be filesystem or s3. - object-store-s3-location: The immutable S3 object store requires a bucket and region. Failure:
S3 object storage requires LEAPVIEW_OBJECT_STORE_S3_BUCKET and LEAPVIEW_OBJECT_STORE_S3_REGION. - production-object-store-s3-endpoint: Production custom immutable-object S3 endpoints must use encrypted transport. Failure:
production object-store S3 custom endpoints must use HTTPS. - object-store-s3-credentials: Immutable object-store S3 credentials are omitted for ambient AWS credentials or configured as a complete static pair. Failure:
S3 object-store credentials require both LEAPVIEW_OBJECT_STORE_S3_ACCESS_KEY_ID and LEAPVIEW_OBJECT_STORE_S3_SECRET_ACCESS_KEY; a session token also requires that pair. - object-store-s3-encryption-mode: Immutable object-store S3 encryption is explicit and supported. Failure:
LEAPVIEW_OBJECT_STORE_S3_ENCRYPTION_MODE must be AES256 (SSE-S3), aws:kms (SSE-KMS), or sse-c (SSE-C). - object-store-s3-sse-s3-keys: SSE-S3 does not accept encryption key identities. Failure:
SSE-S3 object storage must not set encryption key references, provider keys, or customer keys. - object-store-s3-sse-kms-keys: SSE-KMS requires both opaque and resolved provider key identities and no customer key. Failure:
SSE-KMS object storage requires an opaque key reference and resolved provider key, and must not set a customer key. - object-store-s3-sse-c-keys: SSE-C requires an opaque key epoch and customer key without a provider key. Failure:
SSE-C object storage requires LEAPVIEW_OBJECT_STORE_S3_ENCRYPTION_KEY_REF and LEAPVIEW_OBJECT_STORE_S3_ENCRYPTION_CUSTOMER_KEY, and must not set a provider key. - object-store-s3-sse-c-endpoint: A configured SSE-C custom endpoint must use HTTPS; the AWS default endpoint is also supported. Failure:
SSE-C object storage custom endpoints must use HTTPS.