Configuration

Configure Atomic Reactor through environment variables in your .env file.

Required variables

Variable	Description	Example
`DATABASE_URL`	PostgreSQL connection string	`postgresql://user:pass@localhost/db`
`SESSION_SECRET`	Session secret (at least 32 characters)	Generate: `openssl rand -hex 32`
`JWT_SECRET`	JWT signing secret (at least 32 characters)	Generate: `openssl rand -hex 32`
`ENCRYPTION_MASTER_KEY`	Base64 encryption key	Generate: `openssl rand -base64 32`
`PUBLIC_URL`	Public server URL	`https://example.com`

Common optional variables

Variable	Description	Default
`PORT`	Server port	`8555` (code default); `.env.example` and Docker set `8080`
`RUST_LOG`	Log level	`atomic_reactor=debug,tower_http=debug,axum=trace`
`DATABASE_MAX_CONNECTIONS`	Connection pool size	`10`
`REDIS_URL`	Redis connection (features degrade gracefully without it)	None
`OPENAI_API_KEY`	OpenAI API key for AI features	None
`OPENAI_MODEL`	OpenAI model to use	None
`BOOTSTRAP_ADMIN_EMAILS`	Comma-separated admin emails	None
`ENVIRONMENT`	Runtime environment	`development`
`CORS_ALLOWED_ORIGINS`	Comma-separated allowed origins	`http://localhost:8080,http://localhost:5173`

Port configuration

The application code defaults to port 8555 if PORT is not set.

Docker deployments: The Dockerfile sets ENV PORT=8080 to match its EXPOSE 8080 and healthcheck. No action needed.
Bare metal / reverse proxy: If running without Docker, the app listens on 8555 by default. Nginx/Apache reverse-proxy examples in the TLS guide target port 8555.
Development: .env.example sets PORT=8080. Copy it to .env and adjust as needed.

Redis (optional)

Redis is used for session caching and real-time features. If REDIS_URL is unset, the application starts normally with those features disabled. Redis is not required for basic operation but is recommended for production, and is required for SAML SSO (replay-attack prevention).

SESSION_COOKIE_DOMAIN controls whether the session cookie is host-only or shared across sibling subdomains.

Unset (default): the cookie is scoped to the exact host that issued it. Different subdomains have independent sessions — suitable for single-host deployments.
Set to a leading-dot apex (e.g. .example.com): the cookie is shared across all subdomains under that apex. Required for deployments that span multiple subdomains in a single user flow, such as portal-host login to a tenant-host dashboard, or an LTI launch where the authorize endpoint and launch initiation are on different subdomains.

Generating security keys

# Session secret (64 hex chars = 32 bytes)
openssl rand -hex 32

# Encryption key (Base64)
openssl rand -base64 32

# RSA key pair for JWT
openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.pem

CORS configuration

CORS_ALLOWED_ORIGINS=http://localhost:8080,https://example.com
CORS_MAX_AGE=3600

Example production `.env`

# Database
DATABASE_URL=postgresql://user:pass@prod-db:5432/atomic_reactor
DATABASE_MAX_CONNECTIONS=10

# Security
SESSION_SECRET=your-secure-32-character-session-secret
JWT_SECRET=your-secure-jwt-secret-key
ENCRYPTION_MASTER_KEY=your-secure-base64-encoded-key

# Server
PUBLIC_URL=https://reactor.yourdomain.com
PORT=8080
ENVIRONMENT=production

# Redis (recommended for production)
REDIS_URL=redis://your-redis-host:6379

# CORS
CORS_ALLOWED_ORIGINS=https://yourdomain.com

# Logging
RUST_LOG=atomic_reactor=info,sqlx=warn

Monitoring

Prometheus metrics are exposed at /metrics on the application’s HTTP port.
A dedicated metrics endpoint listens on the port set by METRICS_PORT (default 9100).
The Grafana admin password is set via GF_SECURITY_ADMIN_PASSWORD in docker-compose.monitoring.yml, not in .env.

Validation

make db-console                       # test database connection
curl http://localhost:8080/health     # verify health endpoint
curl http://localhost:8080/metrics    # check metrics endpoint