Environment Variables

Configure AnsibleForms with environment variables

For administrators who deploy AnsibleForms: every environment variable the server reads, grouped by topic.

AnsibleForms is tuned with environment variables, whether it runs with Docker Compose, on Kubernetes or from source.

Where the values come from

The server reads each variable from the first of these sources that sets it, so a value higher in the list always wins:

  1. The process environment: environment: and env_file: in docker-compose (the project’s .env is passed this way), env and envFrom on Kubernetes, or the shell that starts node.
  2. persistent/.env, the file the settings pages write (data/.env in the docker-compose project, another path with MANAGED_ENV_PATH). It is read at every start, in production too, and never overrides a variable that is already set.
  3. server/.env.<NODE_ENV>, for example .env.development. Only read when NODE_ENV is not production (or with FORCE_DOTENV=1), in practice when running from source in development mode.
  4. The built-in default, shown in the tables of each group.

The settings pages, under Settings > General, show the value in force and save changes to persistent/.env. Many variables apply as soon as they are saved; the others are saved but need a restart, and the page lists them after the save. A variable set in the process environment cannot be changed there: the page shows it as Set in the environment, so it cannot be changed here. A few variables, such as ENCRYPTION_SECRET and ACCESS_TOKEN_SECRET, can never be changed from the page.

With ALLOW_ENV_EDIT=0 the pages only show the values and the save is refused. Use it when the environment is declared in a manifest, as described in Editing and audit.

The config seed sets no environment variables. It declares objects that are stored in the database, and the ${ENV_VAR} references in it are resolved from the environment of the running server.

Variables marked Secret hold a password, token or key: keep them out of version control, for example in a Kubernetes Secret or a .env file that is not committed.

In this section

The variables are grouped by topic, with one page per group:

Page What it covers
Server and database The web server, trusted proxies, the MySQL connection, the admin account, and what each process runs (app or RTE)
Paths Where the configuration, forms, playbooks, workflows, uploads and backups live
Backups and retention The backup commands, the backup before an upgrade, and how long backups, jobs and audit records are kept
Features The designer, MCP, chat, launch validation, the jobs list, metrics, the AWX API and query logging
Configuration The config seed, where the configuration is kept, git and ytt
Security variables Sign-in limits, passwords, single sign-on, tokens, encryption, the browser policy, outbound REST hosts, masking, and the VAULT_* variables, read once to import a secret store
Logging Log levels, the log format, files and how long they are kept, syslog and console colours

Other variables

The following variables are not yet assigned to a group:

Variable Choices/Defaults Comments
AZURE_AUTHORITY_URI
string
added in version 7.0.4
Default:
https://login.microsoftonline.com

Entra ID sign-in authority
a valid base URI without slash on the end

The Microsoft identity platform the server sends an Entra ID sign-in to, with the tenant id of the provider after it (<authority>/<tenant>/v2.0). Change it for a national cloud, e.g. https://login.microsoftonline.us (US Government) or https://login.chinacloudapi.cn (China), together with AZURE_GRAPH_URI. Read when the Entra ID provider is enabled or saved. Only HTTPS is accepted, except with NODE_ENV=development, for a local test provider.