Environment Variables

OpenFlows reads its runtime configuration from environment variables. The orchestrator is designed to run from a small .env file, a Docker Compose env_file, or a Kubernetes secret. This page lists every variable the orchestrator reads, grouped by subsystem, with required status, purpose, and examples.

A strict security rule applies: no secrets are forwarded into worker workspaces. Coder session tokens, LLM API keys, GitHub OAuth secrets, and OpenFlows API tokens live only in the orchestrator process. Workspaces inherit their GitHub identity from Coder external auth and their LLM access from the Coder AI Gateway, but they never see the underlying credentials.

Quick Reference

Variable	Required	Purpose
`CODER_URL`	Yes	Base URL of the self-hosted Coder deployment (e.g. `http://localhost:7080`). All workspace and chat API calls are made against this URL.
`CODER_SESSION_TOKEN`	Yes	API token for the Coder user that OpenFlows impersonates. Must be able to provision workspaces, read users, and call the Coder Chats API.
`GITHUB_REPOSITORY`	Yes	Default repository in `owner/repo` format. Used when a single-tenant deployment is configured or when a tenant does not specify its own repository.
`REDIS_URL`	No	Redis connection string for the SharedStore. Defaults to `redis://localhost:6379`.
`GITHUB_CLIENT_ID`	Yes	Client ID of the GitHub OAuth App used for Coder external authentication.
`GITHUB_CLIENT_SECRET`	Yes	Client secret of the GitHub OAuth App. Must be stored securely and never committed.
`GITHUB_OAUTH_REDIRECT_URL`	No	Redirect URL for the GitHub OAuth flow. Usually `https://coder.example.com/external-auth/callback`.
`GITHUB_OAUTH_SCOPES`	No	Comma-separated OAuth scopes. Defaults to `repo,read:user`.
`LITELLM_URL`	No	Base URL of the LiteLLM fallback proxy (e.g. `http://litellm.internal:4000/v1`). Used when `ai_gateway.fallback` is `"litellm"`.
`LITELLM_API_KEY`	No	API key for the LiteLLM proxy. Stored only in the orchestrator environment, never in workspaces.
`OPENAI_API_KEY`	No	Only needed if LiteLLM forwards directly to OpenAI without holding keys itself.
`ANTHROPIC_API_KEY`	No	Only needed if LiteLLM forwards directly to Anthropic without holding keys itself.
`OPENAI_BASE_URL`	No	Custom base URL for OpenAI-compatible providers when using the LiteLLM fallback.
`RUST_LOG`	No	Rust tracing log filter. Example: `info`, `openflows=debug`, or `openflows=trace,reqwest=warn`.
`LOG_LEVEL`	No	Alias for `RUST_LOG`. If both are set, `RUST_LOG` wins.
`OPENFLOWS_LOG_FORMAT`	No	`json` or `pretty`. Use `json` in production for structured logging.
`OPENFLOWS_LOG_OUTPUT`	No	Path to a log file. If unset, logs are written to stderr.
`OPENFLOWS_ENABLE_SENTINEL_SEGMENT_REVIEW`	No	`true` or `false`. Enables per-segment SENTINEL review. Default `true`.
`OPENFLOWS_ENABLE_LORE`	No	`true` or `false`. Enables automatic documentation after merge. Default `true`.
`OPENFLOWS_DRY_RUN`	No	`true` disables destructive actions (PR creation, merge, workspace teardown). Useful for testing.
`OPENFLOWS_SKIP_BOOTSTRAP_CHECKS`	No	`true` skips health checks during bootstrap. Not recommended for production.
`OPENFLOWS_DISABLE_TELEMETRY`	No	`true` disables anonymous version telemetry.
`OPENFLOWS_BASE_URL`	No	Base URL of the OpenFlows control-plane API. Default `http://localhost:8080`.
`OPENFLOWS_API_TOKEN`	No	Bearer token for the OpenFlows control-plane API. Generated by `openflows bootstrap` if not provided.
`OPENFLOWS_CONFIG_PATH`	No	Path to the orchestrator configuration file. Default `orchestration/config.yaml`.
`OPENFLOWS_REGISTRY_PATH`	No	Path to `registry.json`. Default `orchestration/agent/registry.json`.
`OPENFLOWS_TEMPLATES_DIR`	No	Directory containing Coder workspace templates. Default `orchestration/templates/`.
`OPENFLOWS_POLL_INTERVAL_SECONDS`	No	NEXUS poll interval. Default `30`.
`OPENFLOWS_MAX_RETRIES`	No	Maximum retry attempts for failed nodes and API calls. Default `3`.
`OPENFLOWS_WORKER_TIMEOUT_SECONDS`	No	Default timeout for a worker task. Default `1800` (30 minutes).
`OPENFLOWS_REDIS_NAMESPACE`	No	Redis key prefix. Default `openflows`. Multi-tenant deployments use per-tenant prefixes.

Do not commit .env

The .env file contains secrets. Add it to .gitignore immediately. Use a secret manager or Docker secrets in production. The repository ships with an .env.example file that contains only placeholder values and is safe to commit.

Core Orchestrator Variables

These variables are required for any OpenFlows deployment. They tell the orchestrator where Coder is, which repository to monitor, and how to connect to the SharedStore.

Variable	Required	Purpose
`CODER_URL`	Yes	Base URL of the self-hosted Coder deployment (e.g. `http://localhost:7080`). All workspace and chat API calls are made against this URL.
`CODER_SESSION_TOKEN`	Yes	API token for the Coder user that OpenFlows impersonates. Must be able to provision workspaces, read users, and call the Coder Chats API.
`GITHUB_REPOSITORY`	Yes	Default repository in `owner/repo` format. Used when a single-tenant deployment is configured or when a tenant does not specify its own repository.
`REDIS_URL`	No	Redis connection string for the SharedStore. Defaults to `redis://localhost:6379`.

bash

# Minimum viable .env for the orchestrator
CODER_URL=http://localhost:7080
CODER_SESSION_TOKEN=coder-session-token-here
GITHUB_REPOSITORY=owner/repo
REDIS_URL=redis://localhost:6379

GitHub OAuth for Coder External Auth

GitHub authentication is handled entirely by Coder external auth. OpenFlows does not read or store a GitHub PAT. The OAuth app credentials are provided to the Coder deployment so that each workspace can obtain a short-lived GitHub token on behalf of the logged-in Coder user.

Variable	Required	Purpose
`GITHUB_CLIENT_ID`	Yes	Client ID of the GitHub OAuth App used for Coder external authentication.
`GITHUB_CLIENT_SECRET`	Yes	Client secret of the GitHub OAuth App. Must be stored securely and never committed.
`GITHUB_OAUTH_REDIRECT_URL`	No	Redirect URL for the GitHub OAuth flow. Usually `https://coder.example.com/external-auth/callback`.
`GITHUB_OAUTH_SCOPES`	No	Comma-separated OAuth scopes. Defaults to `repo,read:user`.

bash

# GitHub OAuth App used for Coder external auth
GITHUB_CLIENT_ID=Ov23lixxxxxxxxx
GITHUB_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
GITHUB_OAUTH_REDIRECT_URL=https://coder.example.com/external-auth/callback
GITHUB_OAUTH_SCOPES=repo,read:user

No GitHub token in OpenFlows

You will not find GITHUB_TOKEN or GITHUB_PERSONAL_ACCESS_TOKEN in the orchestrator configuration. The GitHub token is acquired by Coder and injected into workspaces via the git-config Coder module. OpenFlows GitHub operations use the same token through the Coder GitHub MCP server.

LLM Fallback Variables

The primary LLM path is always the Coder AI Gateway, which is configured in the Coder dashboard. The variables in this section only matter when the gateway is unavailable and the orchestrator falls back to a LiteLLM proxy configured in registry.json.

Variable	Required	Purpose
`LITELLM_URL`	No	Base URL of the LiteLLM fallback proxy (e.g. `http://litellm.internal:4000/v1`). Used when `ai_gateway.fallback` is `"litellm"`.
`LITELLM_API_KEY`	No	API key for the LiteLLM proxy. Stored only in the orchestrator environment, never in workspaces.
`OPENAI_API_KEY`	No	Only needed if LiteLLM forwards directly to OpenAI without holding keys itself.
`ANTHROPIC_API_KEY`	No	Only needed if LiteLLM forwards directly to Anthropic without holding keys itself.
`OPENAI_BASE_URL`	No	Custom base URL for OpenAI-compatible providers when using the LiteLLM fallback.

bash

# LiteLLM fallback (orchestrator only)
LITELLM_URL=http://litellm.internal:4000/v1
LITELLM_API_KEY=sk-litellm-...

# Direct provider keys, only if LiteLLM does not manage them
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
OPENAI_BASE_URL=http://litellm.internal:4000/v1

No keys in workspaces

Even when using the LiteLLM fallback, these variables are only present in the orchestrator environment. Worker workspaces have no LLM keys and no AI software. They make no direct API calls to model providers.

Logging Variables

OpenFlows uses the Rust tracing ecosystem. Log output is controlled by a filter string that supports per-crate levels, formatting options, and an optional output file.

Variable	Required	Purpose
`RUST_LOG`	No	Rust tracing log filter. Example: `info`, `openflows=debug`, or `openflows=trace,reqwest=warn`.
`LOG_LEVEL`	No	Alias for `RUST_LOG`. If both are set, `RUST_LOG` wins.
`OPENFLOWS_LOG_FORMAT`	No	`json` or `pretty`. Use `json` in production for structured logging.
`OPENFLOWS_LOG_OUTPUT`	No	Path to a log file. If unset, logs are written to stderr.

bash

# Development: pretty, colored logs
RUST_LOG=openflows=debug,info

# Production: structured JSON logs to stderr
RUST_LOG=openflows=info
OPENFLOWS_LOG_FORMAT=json

# Production: structured JSON logs to a file
RUST_LOG=openflows=info
OPENFLOWS_LOG_FORMAT=json
OPENFLOWS_LOG_OUTPUT=/var/log/openflows.log

The RUST_LOG syntax follows the standard Rust tracing directive format. Common examples include info for general operation, openflows=debug for orchestrator details, and openflows=trace,reqwest=warn to trace OpenFlows while silencing HTTP client noise.

Feature Flags

Feature flags are boolean environment variables that toggle major workflow behaviors. They are useful for incremental rollouts, cost control, and testing.

Variable	Required	Purpose
`OPENFLOWS_ENABLE_SENTINEL_SEGMENT_REVIEW`	No	`true` or `false`. Enables per-segment SENTINEL review. Default `true`.
`OPENFLOWS_ENABLE_LORE`	No	`true` or `false`. Enables automatic documentation after merge. Default `true`.
`OPENFLOWS_DRY_RUN`	No	`true` disables destructive actions (PR creation, merge, workspace teardown). Useful for testing.
`OPENFLOWS_SKIP_BOOTSTRAP_CHECKS`	No	`true` skips health checks during bootstrap. Not recommended for production.
`OPENFLOWS_DISABLE_TELEMETRY`	No	`true` disables anonymous version telemetry.

bash

# Disable automatic documentation for a dry-run or cost-sensitive deployment
OPENFLOWS_ENABLE_LORE=false

# Disable per-segment review to reduce cost on small repositories
OPENFLOWS_ENABLE_SENTINEL_SEGMENT_REVIEW=false

# Test the full flow without creating real PRs or merging
OPENFLOWS_DRY_RUN=true

Dry run does not clean up workspaces

When OPENFLOWS_DRY_RUN=true, the orchestrator still provisions Coder workspaces to validate the flow, but it will not open PRs, merge, or tear down workspaces automatically. You must delete dry-run workspaces manually through the Coder dashboard.

Operational Tuning Variables

These variables control the orchestrator's API server, file paths, polling cadence, and retry behavior. They are optional in most deployments but essential for production hardening and multi-tenant setups.

Variable	Required	Purpose
`OPENFLOWS_BASE_URL`	No	Base URL of the OpenFlows control-plane API. Default `http://localhost:8080`.
`OPENFLOWS_API_TOKEN`	No	Bearer token for the OpenFlows control-plane API. Generated by `openflows bootstrap` if not provided.
`OPENFLOWS_CONFIG_PATH`	No	Path to the orchestrator configuration file. Default `orchestration/config.yaml`.
`OPENFLOWS_REGISTRY_PATH`	No	Path to `registry.json`. Default `orchestration/agent/registry.json`.
`OPENFLOWS_TEMPLATES_DIR`	No	Directory containing Coder workspace templates. Default `orchestration/templates/`.
`OPENFLOWS_POLL_INTERVAL_SECONDS`	No	NEXUS poll interval. Default `30`.
`OPENFLOWS_MAX_RETRIES`	No	Maximum retry attempts for failed nodes and API calls. Default `3`.
`OPENFLOWS_WORKER_TIMEOUT_SECONDS`	No	Default timeout for a worker task. Default `1800` (30 minutes).
`OPENFLOWS_REDIS_NAMESPACE`	No	Redis key prefix. Default `openflows`. Multi-tenant deployments use per-tenant prefixes.

bash

# Production tuning
OPENFLOWS_BASE_URL=https://openflows.internal.example.com
OPENFLOWS_API_TOKEN=ofk_live_xxxxxxxxxxxxxxxxxxxxxxxx
OPENFLOWS_POLL_INTERVAL_SECONDS=30
OPENFLOWS_MAX_RETRIES=3
OPENFLOWS_WORKER_TIMEOUT_SECONDS=1800
OPENFLOWS_REDIS_NAMESPACE=prod

# File paths
OPENFLOWS_CONFIG_PATH=/etc/openflows/config.yaml
OPENFLOWS_REGISTRY_PATH=/etc/openflows/registry.json
OPENFLOWS_TEMPLATES_DIR=/etc/openflows/templates

Website-Only Variables

The OpenFlows documentation website (this site) reads a separate set of variables for its content backend and build configuration. These are not used by the orchestrator. They are included here for completeness because the website repository shares the same .env.example file.

Variable	Required	Purpose
`VITE_SUPABASE_URL`	No	Supabase project URL for the website content backend. Only needed for the website, not the orchestrator.
`VITE_SUPABASE_ANON_KEY`	No	Supabase anon key for the website content backend.
`SUPABASE_SERVICE_ROLE_KEY`	No	Supabase service role key for server-side admin operations on the website.
`PUBLIC_SITE_URL`	No	Canonical URL of the website (e.g. `https://openflows.dev`).

Complete Example .env

The following example is suitable for a Docker Compose development stack. It includes all orchestrator variables and omits the website-only variables. Do not use this file verbatim in production; rotate secrets and use a secret manager.

bash

# Coder control plane
CODER_URL=http://localhost:7080
CODER_SESSION_TOKEN=coder-session-token-here

# GitHub repository and OAuth
GITHUB_REPOSITORY=owner/repo
GITHUB_CLIENT_ID=Ov23lixxxxxxxxx
GITHUB_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
GITHUB_OAUTH_REDIRECT_URL=http://localhost:7080/external-auth/callback
GITHUB_OAUTH_SCOPES=repo,read:user

# SharedStore
REDIS_URL=redis://localhost:6379

# LiteLLM fallback (optional)
LITELLM_URL=http://litellm:4000/v1
LITELLM_API_KEY=sk-litellm-...

# Logging
RUST_LOG=openflows=info
OPENFLOWS_LOG_FORMAT=json

# Feature flags
OPENFLOWS_ENABLE_LORE=true
OPENFLOWS_ENABLE_SENTINEL_SEGMENT_REVIEW=true
OPENFLOWS_DRY_RUN=false

# Operational tuning
OPENFLOWS_POLL_INTERVAL_SECONDS=30
OPENFLOWS_MAX_RETRIES=3
OPENFLOWS_WORKER_TIMEOUT_SECONDS=1800

Reloading environment variables

The orchestrator reads environment variables at startup. Some operational values, such as RUST_LOG, can be changed at runtime by sending a configuration reload signal. For values that require a restart, restart the openflows container or process; existing in-flight tasks are not interrupted.