This page catalogues the environment variables CM Box reads, grouped by
function — the variables in the shipped env.example file plus additional
variables set by the Compose and Kubernetes manifests or read by individual
services (see deployment and processing). Set them per service in your Compose file,
Kubernetes manifest, or .env file (a .env file in the working directory
is loaded automatically).
Values shown as <placeholder> are secrets or environment-specific IDs —
substitute your own.
| Name |
Description |
Default / example |
CMBOX_ENVIRONMENT |
Selects the WorkOS environment. Any of prod, production (case variants included) selects the production WorkOS environment; anything else selects development. Set to prod for production deployments. |
dev |
WORKOS_ORGANIZATION_ID |
The WorkOS organization ID allowed to sign in to this instance. Sign-ins whose token carries a different organization are rejected by the middleware. |
<org_...> |
WORKOS_DIRECTORY_ID |
The WorkOS Directory Sync directory ID used when synchronizing users and groups into CM Box. User sync is skipped if unset. |
<directory_...> |
AUTH_REDIRECT_URI |
Sign-in callback URL. Present in env.example for local development (http://localhost:4321/callback); current builds derive the callback URL from the instance hostname configured during instance setup instead of reading this variable. |
http://localhost:4321/callback |
| Name |
Description |
Default / example |
JWT_SECRET_KEY |
Base64-encoded key used to sign and verify the JWTs that carry user and service-account sessions. Must be identical on the app and graphql services. Generate a unique value per instance (for example openssl rand -base64 32); the OCI Marketplace setup script does this for you. |
<base64 key> |
| Name |
Description |
Default / example |
GRAPHQL_SERVER_ENDPOINT |
Internal URL of the GraphQL service. The app’s /api/graphql/:repo proxy forwards requests to <GRAPHQL_SERVER_ENDPOINT>/graphql/:repo. |
http://localhost:4000 (Compose: http://graphql:4000) |
GRAPHQL_ENDPOINT |
External URL of the GraphQL API proxy (/api/graphql/). Listed in env.example and the Kubernetes manifest, but not referenced by the current application code. |
http://localhost:4321/api/graphql/ |
PORT |
Listen port. On the graphql service the server defaults to 4000; the app image sets PORT=4321 for the Astro server. |
4000 / 4321 |
| Name |
Description |
Default / example |
REDIS_URL |
Connection URL for the primary Redis database (Redis 8+ with Search/JSON). Required by the app, graphql, and process services. |
redis://db |
BULLMQ_REDIS_HOST |
Hostname of the dedicated queue Redis instance. |
localhost (Compose: queue) |
BULLMQ_REDIS_PORT |
Port of the queue Redis instance. |
6410 |
BULLMQ_CONCURRENT_WORKERS |
Number of concurrent BullMQ workers on the process service. |
5 |
AUTO_ARCHIVE_CRON |
Cron pattern for the auto-archive scheduled-task scan on the process service. |
*/15 * * * * |
AUTO_PUBLISH_CRON |
Cron pattern for the auto-publish scheduled-task scan on the process service. |
*/15 * * * * |
Repository-level scheduled-task rules that these scans execute are described
in Repositories; queue monitoring is covered in
Queues.
Variables read by individual services and typically set in the Compose files
or Kubernetes manifest rather than env.example:
| Name |
Description |
Default / example |
HOST |
Bind address for the app server. Set to 0.0.0.0 in the app image so the server is reachable from outside the container. |
0.0.0.0 |
EXTRACTION_URL |
URL of the Apache Tika text-extraction endpoint used during content processing. |
http://extraction:9998/tika/text |
PANDOC |
Path to the pandoc binary used for document conversion on the process service. |
pandoc |
LIBREOFFICE |
Path to the LibreOffice soffice binary used for document conversion on the process service. |
soffice |
CONFIG_ID |
Repository configuration ID consumed by the standalone content sync process. Only needed when running that process directly. |
— |
APPLICATIONINSIGHTS_CONNECTION_STRING |
Azure Application Insights connection string. When set, enables telemetry export from each service. |
— |
CONTAINER_APP_REPLICA_NAME |
Instance ID reported to monitoring (populated automatically on Azure Container Apps). Falls back to a generated local ID. |
— |