Configuration

All configuration is done through environment variables. In Docker Compose deployments, set them in the .env file. In orchestrated deployments, use your platform's secret manager and environment configuration.

Platform

Derived URLs

From ROOT_DOMAIN, the platform automatically configures:

• API: *.api.<ROOT_DOMAIN> (e.g., admin.api.example.com, acme.api.example.com)
• SSO: sso.<ROOT_DOMAIN> (Keycloak login pages)
• UI: <ROOT_DOMAIN>, app.<ROOT_DOMAIN>, <company>.<ROOT_DOMAIN>

Database

Using an external database

By default, Openfuse bundles a PostgreSQL container. For production, use a managed database service (Amazon RDS, Google Cloud SQL, Azure Database for PostgreSQL).

1. Create two databases on your PostgreSQL server: openfuse and keycloak
2. Remove the bundled database profile in .env:

   #COMPOSE_PROFILES=bundled-db

3. Set the connection variables:

   DATABASE_HOST=your-rds-endpoint.amazonaws.com
   DATABASE_PORT=5432
   DATABASE_USER=openfuse
   DATABASE_PASSWORD=your-password
   DATABASE_SSL=true
   
   # If Keycloak uses the same server (recommended):
   KC_DB_HOST=your-rds-endpoint.amazonaws.com
   KC_DB_USERNAME=openfuse
   KC_DB_PASSWORD=your-password

The database user must have permission to create schemas and tables in the openfuse database. The API creates the meta schema on first run — no additional SQL setup needed.

SSL for managed databases

The API uses DATABASE_SSL=true to enable SSL. Keycloak uses JDBC, where SSL is configured in the connection URL. For manual setup with SSL, set KC_DB_URL:

KC_DB_URL=jdbc:postgresql://your-host:5432/keycloak?sslmode=require

Common sslmode values: require (encrypted, no cert verification), verify-ca, verify-full.

API / Sessions

Keycloak

Openfuse uses Keycloak for authentication.

Client secrets

Each Keycloak client requires a unique secret. Generate with openssl rand -hex 24.

Root user

Email (SMTP)

SMTP is optional. Without it, the platform works but team invites and password reset emails won't be sent. Configure it for production use.

Social login

Social login providers are disabled by default. Enable by setting the _ENABLED flag and providing OAuth credentials.

Logging

Orchestrator-specific variables

These variables are set automatically by the Docker Compose files. In orchestrated deployments (Kubernetes, ECS, Cloud Run), you need to set them explicitly. See the platform guides (Kubernetes, AWS ECS, Cloud Run, Azure Container Apps) for details.

API

Keycloak

Config Importer

The ghcr.io/openfuseio/openfuse-config-importer image has realm YAML files baked in — no file mounting needed. Set the environment variables and run as a one-time task.

The Config Importer also requires all five KC_*_CLIENT_SECRET variables and the SMTP variables (set SMTP_HOST=disabled to skip email configuration).

UI

Secrets management

For production, store secrets in your platform's secret manager instead of .env files.

Generate all secrets with openssl rand -hex <length> — use 24 for client secrets, 32 for session secret.