Deployment
Configuration
All environment variables for QANATIX.
All QANATIX settings via environment variables.
| Variable | Description | Default |
|---|
ENV | Environment (development, production) | development |
DEBUG | Enable debug mode | false |
API_V1_PREFIX | API route prefix | /api/v1 |
DEPLOYMENT_MODE | cloud or self_hosted | self_hosted |
| Variable | Description | Default |
|---|
DATABASE_URL | Async Postgres connection string | postgresql+asyncpg://qanatix:qanatix@localhost:5434/qanatix |
DB_POOL_SIZE | SQLAlchemy connection pool size per process | 5 |
DB_MAX_OVERFLOW | Max overflow connections | 5 |
DB_POOL_TIMEOUT | Seconds to wait for a connection | 10 |
REDIS_URL | Redis connection string | redis://localhost:6380/0 |
REDIS_MAX_CONNECTIONS | Redis connection pool size | 20 |
QANATIX uses self-contained auth — no external auth provider required. Users sign in via the developer portal (email + password or OAuth), and receive a JWT.
| Variable | Description | Default |
|---|
SECRET_KEY | Secret for signing JWTs and other tokens. Must change in production. Generate with openssl rand -hex 32 | change-me-to-a-random-64-char-string |
JWT_ALGORITHM | JWT signing algorithm | HS256 |
JWT_EXPIRE_MINUTES | JWT token lifetime in minutes | 1440 (24 hours) |
FRONTEND_URL | URL of the developer portal (used in email links) | http://localhost:5173 |
REQUIRE_EMAIL_VERIFICATION | Require email verification before login. Set false if no SMTP configured. | true |
MAX_LOGIN_ATTEMPTS | Failed logins before account lockout | 5 |
LOCKOUT_DURATION_MINUTES | Lockout duration after too many failed attempts | 15 |
Required for email verification and password reset. If not configured, set REQUIRE_EMAIL_VERIFICATION=false.
| Variable | Description | Default |
|---|
SMTP_HOST | SMTP server hostname | — |
SMTP_PORT | SMTP server port | 587 |
SMTP_USER | SMTP username | — |
SMTP_PASSWORD | SMTP password | — |
SMTP_USE_TLS | Use STARTTLS | true |
EMAIL_FROM | Sender address | Qanatix <noreply@qanatix.com> |
RESEND_API_KEY | Resend API key (alternative to SMTP, cloud mode) | — |
Enable social login by configuring one or more providers. Users can always sign in with email + password even without OAuth.
| Variable | Description |
|---|
OAUTH_GOOGLE_CLIENT_ID | Google OAuth client ID |
OAUTH_GOOGLE_CLIENT_SECRET | Google OAuth client secret |
OAUTH_GITHUB_CLIENT_ID | GitHub OAuth App client ID |
OAUTH_GITHUB_CLIENT_SECRET | GitHub OAuth App client secret |
OAUTH_GITLAB_CLIENT_ID | GitLab OAuth application ID |
OAUTH_GITLAB_CLIENT_SECRET | GitLab OAuth application secret |
To set up OAuth:
- Register an OAuth application with the provider
- Set the callback URL to
https://your-api-domain/api/v1/auth/oauth/{provider}/callback
- Add the client ID and secret to your environment
| Variable | Description | Default |
|---|
API_KEY_SALT | Salt for API key hashing (must change in production) | change-me-to-a-random-string |
CONNECTOR_ENCRYPTION_KEY | Fernet key for connector credential encryption (comma-separated for key rotation via MultiFernet) | Auto-generated in dev |
WEBHOOK_SECRET | HMAC-SHA256 secret for webhook verification | — |
CORS_ORIGINS | Allowed origins (comma-separated, must not be * in production) | * |
| Variable | Description | Default |
|---|
INGESTION_MAX_FILE_SIZE | Max upload file size in bytes | 52428800 (50 MB) |
INGESTION_BATCH_SIZE | Max records per batch | 5000 |
INGESTION_ERROR_THRESHOLD | Circuit breaker error ratio | 0.1 (10%) |
INGESTION_MAX_ERRORS | Max errors before circuit break | 1000 |
| Variable | Description | Default |
|---|
SEARCH_MAX_QUERY_LENGTH | Max query string length | 500 |
SEARCH_MAX_FILTERS | Max filters per query | 20 |
SEARCH_MAX_LIMIT | Max results per query | 100 |
| Variable | Description | Default |
|---|
RATE_LIMIT_ENABLED | Enable rate limiting | true |
| Variable | Description | Default |
|---|
LOG_LEVEL | Logging level | INFO |
WEB_CONCURRENCY | Uvicorn worker count | 1 |
The included docker-compose.yml overrides several defaults for production:
| Setting | Code default | Docker Compose |
|---|
DB_POOL_SIZE | 5 | 20 (API), 10 (worker) |
| API workers | 1 | 4 |
| Service | Default port |
|---|
| QANATIX API | 8000 |
| Postgres | 5432 (dev: 5434) |
| Redis | 6379 (dev: 6380) |
In production (ENV=production), QANATIX validates:
SECRET_KEY must not be the default valueAPI_KEY_SALT must not be the default valueCORS_ORIGINS must not be wildcard ["*"]WEBHOOK_SECRET must be set