Settings

CoDNA is configured through the environment and nothing else: the one mechanism that works the same in a shell, a Compose file, a Kubernetes ConfigMap and a systemd unit. These are all of its settings. .env.example sets them up for local development.

A duration is written like 90s, 30m or 720h. A size is a number of bytes, or a number with a suffix: KiB, MiB and GiB count in 1024s, KB, MB and GB in 1000s. A switch is on for true, 1, yes or on, and off for anything else.

Server

CODNA_ENV

Default: development

development logs text for a terminal and sets cookies without the Secure flag, for plain http on localhost. Anything else logs JSON and sets Secure cookies: use production wherever the instance is reached over https.

CODNA_LOG_LEVEL

Default: info

debug, info, warn or error. Anything else logs at info.

CODNA_ADDR

Default: :8080

Where the server listens. One listener serves the web UI, the REST API and the MCP endpoint.

CODNA_PUBLIC_URL

Default: http://localhost:8080

The address people and agents reach the instance at. Links handed to agents are built from it, agents are told the MCP endpoint is at <CODNA_PUBLIC_URL>/mcp, and the identity provider sends a browser back to <CODNA_PUBLIC_URL>/auth/callback.

CODNA_ORG_NAME

Who the instance serves. Shown in the web UI, and told to agents, so one connected to two CoDNA instances can tell them apart.

Database

DATABASE_URL

Required.

The Postgres connection string. Postgres is the source of truth: documents, their history, shares and the audit trail all live there.

Search

The index in Typesense is derived from Postgres. codna reindex rebuilds it.

TYPESENSE_URL

Default: http://localhost:8108

The Typesense server.

TYPESENSE_API_KEY

Required.

Typesense's API key.

CODNA_SEARCH_COLLECTION

The name of this instance's collection alias, codna_documents when unset. Give each instance its own to share one Typesense between several, without any of them seeing another's documents.

Identity

CoDNA validates tokens from an identity provider and issues none of its own. See Authentication.

CODNA_SESSION_SECRET

Required to serve.

Signs the short-lived cookie that carries a sign-in through the identity provider. At least 32 characters; generate one with openssl rand -hex 32.

CODNA_SESSION_TTL

Default: 336h

How long a sign-in to the web UI lasts, by password or through the identity provider; at least 5m. A session outlives the provider's say: someone it stops letting in keeps theirs until it runs out, so where people leave by losing their account at the provider, shorten this (12h, say). It counts from when a session was made, so a shorter value also ends the sessions made under a longer one; a longer value does not lengthen any. Agents' tokens come from the provider, and are not affected.

CODNA_OIDC_ISSUER

The identity provider's issuer URL; CoDNA discovers the rest from it. Without one there is no MCP endpoint, because nothing could verify an agent's token.

CODNA_OIDC_AUDIENCE

Default: codna-mcp

The audience a token must carry to be accepted at /mcp. With Dex it is the id of the client agents sign in as; with a provider that issues tokens for a resource, usually the public URL.

CODNA_OIDC_AUTO_PROVISION

Default: false

Create a person the first time someone the provider knows signs in, instead of requiring them to exist already. Leave it off if anyone outside your organisation has an account at the provider: every one of them could then sign in here, unless CODNA_OIDC_AUTO_PROVISION_DOMAINS narrows it.

CODNA_OIDC_AUTO_PROVISION_DOMAINS

Email domains, comma-separated (example.com,example.org), that CODNA_OIDC_AUTO_PROVISION creates people for: someone whose verified address is at another domain gets in only if they have an account already. Each domain matches itself, not its subdomains. Unset, auto-provisioning creates anyone the provider signs in. Needs CODNA_OIDC_AUTO_PROVISION=true.

CODNA_OIDC_TRUST_UNVERIFIED_EMAIL

Default: false

A first sign-in is matched to a person only by an address the provider marks email_verified. Turn this on only for a provider that never sends the claim (Microsoft Entra, for one) and whose addresses are all yours to give out.

CODNA_OIDC_EMAIL_CLAIM

Default: email

The claim a person's email is read from.

CODNA_OIDC_NAME_CLAIM

Default: name

The claim a person's name is read from.

CODNA_OIDC_WEB_CLIENT_ID

Offers Continue with SSO on the login page, signing people in as this client. Register it with the redirect URI <CODNA_PUBLIC_URL>/auth/callback, as a public client: CoDNA uses PKCE. Keep it a different client from the one agents use.

CODNA_OIDC_WEB_CLIENT_SECRET

Only for a provider that refuses public clients: the web client's secret.

Connecting an agent

For an identity provider that cannot register clients by itself (it has no Dynamic Client Registration, as with Dex or Google). The web UI's Connect an AI agent shows people a command built from these; nothing else reads them.

CODNA_MCP_CLIENT_ID

The client set up at the provider for agents.

CODNA_MCP_CLIENT_SECRET_REQUIRED

Default: false

Whether that client needs a secret. CoDNA never holds or shows one: people get it from whoever runs the provider.

CODNA_MCP_CALLBACK_PORT

The loopback port the client's redirect URIs allow, 1 to 65535.

Storage

Ingested files are converted to markdown, which lives in Postgres; the originals are kept here.

CODNA_STORAGE_DRIVER

Default: local

local, the only driver: files on disk under CODNA_STORAGE_PATH.

CODNA_STORAGE_PATH

Default: ./storage

The directory originals are kept in.

CODNA_MAX_UPLOAD

Default: 64MiB

The largest file that can be ingested. Originals are held in memory while they are converted, so this bounds what one request can take.

CODNA_MAX_IMPORT

Default: 512MiB

The largest export archive that can be imported (a zip from Notion, Confluence, a markdown folder or Google Drive). It is read from disk, not memory, and each page in it is held to CODNA_MAX_UPLOAD. A proxy in front of CoDNA must accept a request this large on /api/imports.

CODNA_MAX_RECORDING

Default: 4GiB

The largest recording (audio or video) that can be uploaded or recorded. A recording arrives in pieces of at most 32 MiB, so a proxy in front of CoDNA needs to accept no more than that on /api/recordings; it is put together on disk, never in memory.

Transcription

Recordings become raw transcripts through a transcription service, which CoDNA calls and which does the transcribing: see Transcription for the contract it follows. Without one, recordings are kept and their pages say they were not transcribed.

CODNA_TRANSCRIBE_URL

The transcription service's base URL, such as https://scribe.example.com. CoDNA appends /v1/… to it. Unset, nothing is transcribed.

CODNA_TRANSCRIBE_TOKEN

The bearer token CoDNA sends the service, which tells it which instance is calling.

Meetings

People hold online meetings through a meetings service, which runs the calls and records each person's audio; CoDNA files each meeting in raw and has it transcribed with who said what. See Meetings for the contract it follows. Without one, there is no Meeting button.

CODNA_MEET_URL

The meetings service's base URL, such as https://meet.example.com. CoDNA appends /v1/… to it. Unset, no meetings are held.

CODNA_MEET_TOKEN

The bearer token CoDNA sends the service, which tells it which instance is calling.

Retention

Revision history is kept forever, and that is deliberately not configurable. Only these are time-bounded.

CODNA_PURGE_AFTER

Default: 720h

How long a deleted document can be restored before it is purged. One that a link decision still waits on is kept until somebody makes it. See Linking.

CODNA_EVENT_RETENTION

Default: 168h

How long processed outbox events are kept.

Automations

The limits on one run of a script. See Automations.

CODNA_AUTOMATION_TIMEOUT

Default: 100ms

How long a run may take. One that takes longer applies nothing.

CODNA_AUTOMATION_MEMORY_LIMIT

Default: 16MiB

The script's heap.

CODNA_AUTOMATION_MAX_ACTIONS

Default: 50

How many actions a run may propose. A run that proposes more is rejected whole.

CODNA_AUTOMATION_MAX_READS

Default: 20

How many read calls a run may make.

People

Used only by the commands that create people and set their passwords.

CODNA_BOOTSTRAP_EMAIL

The first person codna bootstrap creates, when no email is given on the command line. Formerly CODNA_ADMIN_EMAIL, which is still read when this is unset.

CODNA_BOOTSTRAP_NAME

That person's name. Formerly CODNA_ADMIN_NAME, which is still read when this is unset.

CODNA_BOOTSTRAP_PASSWORD

That person's password, for unattended setup. Otherwise codna bootstrap asks for it. Formerly CODNA_ADMIN_PASSWORD, which is still read when this is unset.

CODNA_PERSON_PASSWORD

The password for codna people create and codna people set-password, for unattended use. Otherwise they ask for it.