# Settings CoDNA is configured through the environment and nothing else: the one mechanism that works the same in a shell, a Compose file, a Kubernetes ConfigMap and a systemd unit. These are all of its settings. `.env.example` sets them up for local development. A duration is written like `90s`, `30m` or `720h`. A size is a number of bytes, or a number with a suffix: `KiB`, `MiB` and `GiB` count in 1024s, `KB`, `MB` and `GB` in 1000s. A switch is on for `true`, `1`, `yes` or `on`, and off for anything else. ## Server ### `CODNA_ENV` Default: `development` `development` logs text for a terminal and sets cookies without the Secure flag, for plain http on localhost. Anything else logs JSON and sets Secure cookies: use `production` wherever the instance is reached over https. ### `CODNA_LOG_LEVEL` Default: `info` `debug`, `info`, `warn` or `error`. Anything else logs at `info`. ### `CODNA_ADDR` Default: `:8080` Where the server listens. One listener serves the web UI, the REST API and the MCP endpoint. ### `CODNA_PUBLIC_URL` Default: `http://localhost:8080` The address people and agents reach the instance at. Links handed to agents are built from it, agents are told the MCP endpoint is at `/mcp`, and the identity provider sends a browser back to `/auth/callback`. ### `CODNA_ORG_NAME` Who the instance serves. Shown in the web UI, and told to agents, so one connected to two CoDNA instances can tell them apart. ## Database ### `DATABASE_URL` Required. The Postgres connection string. Postgres is the source of truth: documents, their history, shares and the audit trail all live there. ## Search The index in Typesense is derived from Postgres. `codna reindex` rebuilds it. ### `TYPESENSE_URL` Default: `http://localhost:8108` The Typesense server. ### `TYPESENSE_API_KEY` Required. Typesense's API key. ### `CODNA_SEARCH_COLLECTION` The name of this instance's collection alias, `codna_documents` when unset. Give each instance its own to share one Typesense between several, without any of them seeing another's documents. ## Identity CoDNA validates tokens from an identity provider and issues none of its own. See [Authentication](https://codna.me/docs/mcp.md#authentication). ### `CODNA_SESSION_SECRET` Required to serve. Signs the short-lived cookie that carries a sign-in through the identity provider. At least 32 characters; generate one with `openssl rand -hex 32`. ### `CODNA_SESSION_TTL` Default: `336h` How long a sign-in to the web UI lasts, by password or through the identity provider; at least `5m`. A session outlives the provider's say: someone it stops letting in keeps theirs until it runs out, so where people leave by losing their account at the provider, shorten this (`12h`, say). It counts from when a session was made, so a shorter value also ends the sessions made under a longer one; a longer value does not lengthen any. Agents' tokens come from the provider, and are not affected. ### `CODNA_OIDC_ISSUER` The identity provider's issuer URL; CoDNA discovers the rest from it. Without one there is no MCP endpoint, because nothing could verify an agent's token. ### `CODNA_OIDC_AUDIENCE` Default: `codna-mcp` The audience a token must carry to be accepted at `/mcp`. With Dex it is the id of the client agents sign in as; with a provider that issues tokens for a resource, usually the public URL. ### `CODNA_OIDC_AUTO_PROVISION` Default: `false` Create a person the first time someone the provider knows signs in, instead of requiring them to exist already. Leave it off if anyone outside your organisation has an account at the provider: every one of them could then sign in here, unless `CODNA_OIDC_AUTO_PROVISION_DOMAINS` narrows it. ### `CODNA_OIDC_AUTO_PROVISION_DOMAINS` Email domains, comma-separated (`example.com,example.org`), that `CODNA_OIDC_AUTO_PROVISION` creates people for: someone whose verified address is at another domain gets in only if they have an account already. Each domain matches itself, not its subdomains. Unset, auto-provisioning creates anyone the provider signs in. Needs `CODNA_OIDC_AUTO_PROVISION=true`. ### `CODNA_OIDC_TRUST_UNVERIFIED_EMAIL` Default: `false` A first sign-in is matched to a person only by an address the provider marks `email_verified`. Turn this on only for a provider that never sends the claim (Microsoft Entra, for one) and whose addresses are all yours to give out. ### `CODNA_OIDC_EMAIL_CLAIM` Default: `email` The claim a person's email is read from. ### `CODNA_OIDC_NAME_CLAIM` Default: `name` The claim a person's name is read from. ### `CODNA_OIDC_WEB_CLIENT_ID` Offers **Continue with SSO** on the login page, signing people in as this client. Register it with the redirect URI `/auth/callback`, as a public client: CoDNA uses PKCE. Keep it a different client from the one agents use. ### `CODNA_OIDC_WEB_CLIENT_SECRET` Only for a provider that refuses public clients: the web client's secret. ## Connecting an agent For an identity provider that cannot register clients by itself (it has no Dynamic Client Registration, as with Dex or Google). The web UI's **Connect an AI agent** shows people a command built from these; nothing else reads them. ### `CODNA_MCP_CLIENT_ID` The client set up at the provider for agents. ### `CODNA_MCP_CLIENT_SECRET_REQUIRED` Default: `false` Whether that client needs a secret. CoDNA never holds or shows one: people get it from whoever runs the provider. ### `CODNA_MCP_CALLBACK_PORT` The loopback port the client's redirect URIs allow, 1 to 65535. ## Storage Ingested files are converted to markdown, which lives in Postgres; the originals are kept here. ### `CODNA_STORAGE_DRIVER` Default: `local` `local`, the only driver: files on disk under `CODNA_STORAGE_PATH`. ### `CODNA_STORAGE_PATH` Default: `./storage` The directory originals are kept in. ### `CODNA_MAX_UPLOAD` Default: `64MiB` The largest file that can be ingested. Originals are held in memory while they are converted, so this bounds what one request can take. ### `CODNA_MAX_IMPORT` Default: `512MiB` The largest export archive that can be imported (a zip from Notion, Confluence, a markdown folder or Google Drive). It is read from disk, not memory, and each page in it is held to `CODNA_MAX_UPLOAD`. A proxy in front of CoDNA must accept a request this large on `/api/imports`. ### `CODNA_MAX_RECORDING` Default: `4GiB` The largest recording (audio or video) that can be uploaded or recorded. A recording arrives in pieces of at most 32 MiB, so a proxy in front of CoDNA needs to accept no more than that on `/api/recordings`; it is put together on disk, never in memory. ## Transcription Recordings become raw transcripts through a transcription service, which CoDNA calls and which does the transcribing: see [Transcription](https://codna.me/docs/transcription.md) for the contract it follows. Without one, recordings are kept and their pages say they were not transcribed. ### `CODNA_TRANSCRIBE_URL` The transcription service's base URL, such as `https://scribe.example.com`. CoDNA appends `/v1/…` to it. Unset, nothing is transcribed. ### `CODNA_TRANSCRIBE_TOKEN` The bearer token CoDNA sends the service, which tells it which instance is calling. ## Meetings People hold online meetings through a meetings service, which runs the calls and records each person's audio; CoDNA files each meeting in raw and has it transcribed with who said what. See [Meetings](https://codna.me/docs/meetings.md) for the contract it follows. Without one, there is no Meeting button. ### `CODNA_MEET_URL` The meetings service's base URL, such as `https://meet.example.com`. CoDNA appends `/v1/…` to it. Unset, no meetings are held. ### `CODNA_MEET_TOKEN` The bearer token CoDNA sends the service, which tells it which instance is calling. ## Retention Revision history is kept forever, and that is deliberately not configurable. Only these are time-bounded. ### `CODNA_PURGE_AFTER` Default: `720h` How long a deleted document can be restored before it is purged. One that a link decision still waits on is kept until somebody makes it. See [Linking](https://codna.me/docs/linking.md). ### `CODNA_EVENT_RETENTION` Default: `168h` How long processed outbox events are kept. ## Automations The limits on one run of a script. See [Automations](https://codna.me/docs/automations.md). ### `CODNA_AUTOMATION_TIMEOUT` Default: `100ms` How long a run may take. One that takes longer applies nothing. ### `CODNA_AUTOMATION_MEMORY_LIMIT` Default: `16MiB` The script's heap. ### `CODNA_AUTOMATION_MAX_ACTIONS` Default: `50` How many actions a run may propose. A run that proposes more is rejected whole. ### `CODNA_AUTOMATION_MAX_READS` Default: `20` How many read calls a run may make. ## People Used only by the commands that create people and set their passwords. ### `CODNA_BOOTSTRAP_EMAIL` The first person `codna bootstrap` creates, when no email is given on the command line. Formerly `CODNA_ADMIN_EMAIL`, which is still read when this is unset. ### `CODNA_BOOTSTRAP_NAME` That person's name. Formerly `CODNA_ADMIN_NAME`, which is still read when this is unset. ### `CODNA_BOOTSTRAP_PASSWORD` That person's password, for unattended setup. Otherwise `codna bootstrap` asks for it. Formerly `CODNA_ADMIN_PASSWORD`, which is still read when this is unset. ### `CODNA_PERSON_PASSWORD` The password for `codna people create` and `codna people set-password`, for unattended use. Otherwise they ask for it.