Environment variables
Authoritative source: modules/commons/commons-config/src/main/java/org/eclipse/dirigible/commons/config/DirigibleConfig.java (the enum) plus Configuration.java (the allow-list). The list below covers everything you typically reach for.
For the install-oriented subset see /help/setup/environment-variables.
Server
| Variable | Default | Purpose |
|---|---|---|
DIRIGIBLE_SERVER_PORT | 8080 | HTTP listen port. |
DIRIGIBLE_HOME_URL | services/web/shell-ide/ | Where / redirects to. |
DIRIGIBLE_BASIC_USERNAME | admin | Default basic-auth user. |
DIRIGIBLE_BASIC_PASSWORD | admin | Default basic-auth password. |
Repository
| Variable | Default | Purpose |
|---|---|---|
DIRIGIBLE_REPOSITORY_LOCAL_ROOT_FOLDER | ./target/ | On-disk registry root. |
DIRIGIBLE_REPOSITORY_PROVIDER | local | Repository backend. |
DIRIGIBLE_REPOSITORY_MASTER_PROVIDER | Master / upstream repository. | |
DIRIGIBLE_REGISTRY_EXTERNAL_FOLDER | Mount an external folder into the registry. | |
DIRIGIBLE_REGISTRY_EXTERNAL_FOLDER_AS_SUBFOLDER | Mount under a sub-path. | |
DIRIGIBLE_REGISTRY_EXTERNAL_FOLDER_IGNORED_FOLDERS | Comma-separated ignore list. |
Data sources
| Variable | Default | Purpose |
|---|---|---|
DIRIGIBLE_DATASOURCE_DEFAULT_DRIVER | H2 file driver | JDBC driver class. |
DIRIGIBLE_DATASOURCE_DEFAULT_URL | local H2 | JDBC URL. |
DIRIGIBLE_DATASOURCE_DEFAULT_USERNAME | JDBC user. | |
DIRIGIBLE_DATASOURCE_DEFAULT_PASSWORD | JDBC password. | |
DIRIGIBLE_DATABASE_DATASOURCE_NAME_DEFAULT | DefaultDB | Default data source name. |
DIRIGIBLE_DATABASE_DATASOURCE_NAME_SYSTEM | SystemDB | System data source name. |
DIRIGIBLE_LEAKED_CONNECTIONS_CHECK_INTERVAL_SECONDS | JDBC leak-check cadence. | |
DIRIGIBLE_LEAKED_CONNECTIONS_CHECK_MAX_IN_USE_SECONDS | Threshold before logging a leak. |
Multi-tenancy
| Variable | Default | Purpose |
|---|---|---|
DIRIGIBLE_MULTI_TENANT_MODE | true | Multi-tenant switch. |
DIRIGIBLE_TENANT_RESOLUTION_STRATEGY | SUBDOMAIN | How a request's tenant is determined. SUBDOMAIN matches the host header against DIRIGIBLE_TENANT_SUBDOMAIN_REGEX, so each tenant needs a host of its own. TOKEN_GROUPS serves every tenant from one host and takes the tenant the signed-in user selected, out of those their identity provider groups grant. |
DIRIGIBLE_TENANT_SUBDOMAIN_REGEX | Host pattern the tenant subdomain is captured from, under the SUBDOMAIN strategy. Unused by TOKEN_GROUPS. | |
DIRIGIBLE_APP_ID | This deployment's application id, the middle part of the group names <tenantId>.<appId>.<role>. Groups naming another application are ignored, so one identity provider can serve several applications. Required under TOKEN_GROUPS, and it must not contain a dot. | |
DIRIGIBLE_TENANT_GROUPS_CLAIM | cognito:groups | The token claim the user's groups are read from. Set it explicitly on Keycloak - a claim that carries no groups is not an error, the user simply appears to have no tenants. |
DIRIGIBLE_TENANTS_PROVISIONING_FREQUENCY_SECONDS | 900 | Provisioning poll cadence, in seconds. |
DIRIGIBLE_TENANT_PROVISIONING_API_ENABLED | false | Exposes the tenant provisioning API under /services/tenant-provisioning/, through which an external service registers a tenant, registers its data source from credentials it created itself, and activates it. Off by default and off means absent: no endpoint answers and none of its beans exist. The API accepts database credentials over HTTP, so a deployment has to opt in. |
See Tenant resolution and Tenant provisioning API.
Synchronizers
| Variable | Purpose |
|---|---|
DIRIGIBLE_SYNCHRONIZER_FREQUENCY | Reconciliation cadence (seconds). |
DIRIGIBLE_SYNCHRONIZER_CROSS_RETRY_COUNT | Retry budget for cross-synchronizer dependencies. |
DIRIGIBLE_SYNCHRONIZER_CROSS_RETRY_INTERVAL_MILLIS | Retry interval. |
Dynamic dependencies
| Variable | Default | Purpose |
|---|---|---|
DIRIGIBLE_DEPENDENCIES_DYNAMIC | true | Runtime resolution of project.json maven declarations. Disable on immutable production images. |
DIRIGIBLE_DEPENDENCIES_FROZEN | false | Activate the lockfile's set only - checksum-verified, no re-mediation, network never consulted. |
DIRIGIBLE_DEPENDENCIES_DIR | ~/.dirigible/resolved-modules | Directory the resolved jars are linked into (the launch-classpath seed). |
DIRIGIBLE_DEPENDENCIES_LOCKFILE | project-lock.json in the dependencies dir | Lockfile location. |
DIRIGIBLE_MAVEN_REPOSITORIES | Maven Central | Comma-separated id=url pairs; an entry with id central overrides the default Central URL. |
DIRIGIBLE_MAVEN_[ID]_USERNAME / ..._PASSWORD | Credentials per repository id (uppercased, non-alphanumerics become _). | |
DIRIGIBLE_MAVEN_LOCAL_REPO | ~/.m2/repository when present | Local Maven repository the artifacts resolve into. |
DIRIGIBLE_MAVEN_OFFLINE | false | Resolve from the local repository only. |
See Maven dependencies and How dependency versions are decided.
Debuggers and language tooling
| Variable | Default | Purpose |
|---|---|---|
DIRIGIBLE_JAVASCRIPT_GRAALVM_DEBUGGER_PORT | 8081 | Graalium JS debugger port. |
DIRIGIBLE_GRAALIUM_ENABLE_DEBUG | true (in Docker) | Toggle JS debug. |
DIRIGIBLE_JAVA_DEBUG_JDWP_PORT | 8000 | JDWP for the Java debugger view. |
DIRIGIBLE_JAVA_LSP_ENABLED | Toggle JDT.LS. | |
DIRIGIBLE_JAVA_LSP_INSTALL_DIR | JDT.LS install directory. |
Mail
| Variable | Purpose |
|---|---|
DIRIGIBLE_MAIL_USERNAME | SMTP username. |
DIRIGIBLE_MAIL_PASSWORD | SMTP password. |
DIRIGIBLE_MAIL_TRANSPORT_PROTOCOL | smtp or smtps. |
DIRIGIBLE_MAIL_SMTPS_HOST / DIRIGIBLE_MAIL_SMTP_HOST | SMTP host. |
DIRIGIBLE_MAIL_SMTPS_PORT / DIRIGIBLE_MAIL_SMTP_PORT | SMTP port. |
DIRIGIBLE_MAIL_SMTPS_AUTH / DIRIGIBLE_MAIL_SMTP_AUTH | Auth toggle. |
Flowable
| Variable | Purpose |
|---|---|
DIRIGIBLE_FLOWABLE_DATABASE_* | Flowable's own data source. |
DIRIGIBLE_FLOWABLE_MAIL_* | Flowable mail settings. |
Messaging
| Variable | Default | Purpose |
|---|---|---|
DIRIGIBLE_MESSAGING_BROKER_URL | Connect to an external ActiveMQ broker instead of the embedded one - tcp://activemq:61616, ssl://b-....mq.eu-central-1.amazonaws.com:61617, failover:(tcp://one:61616,tcp://two:61616). Unset or blank starts the embedded broker and attaches over vm://localhost. | |
DIRIGIBLE_MESSAGING_BROKER_USERNAME | Broker username. Unset connects anonymously. | |
DIRIGIBLE_MESSAGING_BROKER_PASSWORD | Broker password. | |
DIRIGIBLE_MESSAGING_USE_DEFAULT_DATABASE | true | Persist the embedded broker's messages in the system database. Ignored (and logged as such) when a broker URL is set - an external broker owns its own persistence. |
Setting a broker URL replaces the in-process broker entirely: nothing is started locally, and every producer and consumer - .listener artefacts, @Component listeners, the messaging SDK - connects to the configured broker. Two consequences to plan for:
- The Messaging perspective goes dark. It reads the in-process broker object, so its endpoints are not registered against an external broker and return
404. Administer that broker from its own console. - An unreachable broker fails startup, deliberately, rather than leaving messaging silently inoperative.
See Message listeners.
CMS / S3 / SharePoint
| Variable | Purpose |
|---|---|
DIRIGIBLE_CMS_INTERNAL_ROOT_FOLDER | Internal CMIS root. |
DIRIGIBLE_S3_PROVIDER | aws or localstack. |
DIRIGIBLE_MS_SHAREPOINT_* | SharePoint CMS credentials. |
Authentication providers
| Variable | Purpose |
|---|---|
DIRIGIBLE_GITHUB_CLIENT_ID / _CLIENT_SECRET / _SCOPE | GitHub OAuth (github profile). |
DIRIGIBLE_KEYCLOAK_* | Keycloak. |
DIRIGIBLE_COGNITO_* | AWS Cognito. |
DIRIGIBLE_SNOWFLAKE_* | Snowflake OAuth. |
Encryption
| Variable | Purpose |
|---|---|
DIRIGIBLE_ENCRYPTION_KEY | Base64 master key. |
DIRIGIBLE_ENCRYPTION_KEYSTORE_* | Java keystore alternative. |
Misc
| Variable | Purpose |
|---|---|
DIRIGIBLE_EXEC_COMMAND_LOGGING_ENABLED | Audit shell-exec calls. |
DIRIGIBLE_TRIAL_ENABLED | Trial-mode flag. |
SPRING_PROFILES_ACTIVE | Spring profile selector (github, keycloak, cognito, snowflake, ...). |
The platform reads variables only through DirigibleConfig / Configuration. New tunables are added to those classes - don't introduce ad-hoc System.getProperty reads.