aisquared Helm chart, current as of chart 0.118.0. For the version you’re installing, the chart’s values.yaml is the source of truth.
How to read the tables
- Value: the key in your values file. Every table names its parent key, such as
platformConfig. - Env var: the environment variable the value becomes inside the containers. This is the name to search for in logs or when you’re using Docker Compose.
- Secret group: set when the value is sensitive. If you turn that group on under
secretsStore, put the value in the AWS Secrets Manager secret (using the same key name) instead of your values file. See Secrets.
Security and authentication
platformConfig
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
secretKeyBase | SECRET_KEY_BASE | "" | app | Rails signing and encryption key. Required in production. Generate with openssl rand -hex 64. |
jwtSecret | JWT_SECRET | "" | app | Signs user session tokens. Always set this. If it’s empty, the server falls back to a key built into the source code. Generate with openssl rand -hex 64. |
allowedHost | ALLOWED_HOST | "" | An extra hostname the API accepts requests for, beyond apiHost. | |
allowedSourceIP | n/a (ingress annotation) | 0.0.0.0/0 | CIDR range allowed through the NGINX ingress. | |
userEmailVerification | USER_EMAIL_VERIFICATION | "false" | Require new users to verify their email. Needs working SMTP. | |
codeExecSigningSecret | CODE_EXEC_SIGNING_SECRET | "" | app | Shared secret that signs requests to the remote code-execution service. Required if workflows use code nodes. |
Set both
secretKeyBase and jwtSecret to unique random values for every installation, and don’t change them afterwards. Changing secretKeyBase makes encrypted data unreadable, and changing jwtSecret signs everyone out.Hostnames and ingress
platformConfig and lightningConfig
| Value | Env var | Default | Description |
|---|---|---|---|
platformConfig.uiHost | UI_HOST | app.example.com | Web app hostname. |
platformConfig.apiHost | API_HOST | api.example.com | API hostname. |
platformConfig.viteApiHost | VITE_API_HOST | api.example.com | API host the browser calls. Usually the same as apiHost. |
platformConfig.workerHost | n/a (ingress) | worker.example.com | Hostname for the worker’s health endpoint. |
platformConfig.solidWorkerHost | n/a (ingress) | solid.example.com | Hostname for the solid worker’s health endpoint. |
platformConfig.temporalUiHost | n/a (ingress) | temporal.example.com | Temporal UI hostname (in-cluster Temporal only). |
lightningConfig.lightningHealthHost | n/a (ingress) | lightning.example.com | Hostname for Lightning’s /health and /model_status_check endpoints. |
platformConfig.tlsAdminEmail | n/a (Issuer) | admin@example.com | Let’s Encrypt account email. |
platformConfig.tlsCertIssuer | n/a (ingress) | letsencrypt-staging | letsencrypt-staging or letsencrypt-prod. |
platformConfig.nginxProxyBodySize | n/a (ingress) | 2m | Maximum request body size through NGINX. |
| Value | Default | Description |
|---|---|---|
nginxIngress.enabled | true | Use the NGINX ingress class with cert-manager TLS. |
nginxIngress.proxyReadTimeout / proxySendTimeout | 300 | Proxy timeouts, in seconds. |
nginxIngress.proxyBuffering | "on" | NGINX proxy buffering. |
nginxIngress.enableMetrics | false | When false, /metrics is blocked at the ingress. |
awsIngress.enabled | false | Use an AWS Application Load Balancer. |
awsIngress.acmCertificateArn | "" | ACM certificate for the ALB. |
awsIngress.albScheme | internet-facing | internet-facing or internal. |
awsIngress.sslPolicy | ELBSecurityPolicy-2016-08 | ALB TLS policy. |
awsIngress.groupName | "" | Shares one ALB across several Ingresses. |
awsIngress.groupOrder | "10" | Rule priority within the group. Keep it lower than appbuilderIngress.groupOrder. |
awsIngress.extraAnnotations | {} | Raw alb.ingress.kubernetes.io/* annotations. |
kongIngress.enabled | false | Use the Kong ingress class. |
kongIngress.plugins.prometheus.enabled | false | Attach Kong’s Prometheus plugin. |
externalDNS.enabled | false | Add ExternalDNS hostname annotations to the Ingresses. |
Platform database
platformConfig
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
dbHost | DB_HOST | "" | PostgreSQL host. Leave empty to use the in-cluster database. | |
dbPort | DB_PORT | "5432" | PostgreSQL port. | |
dbName | DB_NAME | aisquared_server_production | Database name. | |
dbUsername | DB_USERNAME | aisquared | Platform database (u) | Database user. |
dbPassword | DB_PASSWORD | password | Platform database (p) | Database password. Change this. |
skipDbMigration | SKIP_DB_MIGRATION | false | Skip schema and data migrations when the server starts. |
multipleDbHosts.enabled: true and multipleDbHosts.platformDBHost/platformDBName, temporalDbHost/temporalDbName and temporalVisibilityDbHost/temporalVisibilityDbName.
Temporal
platformConfig
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
temporalHost | TEMPORAL_HOST | "" | Temporal host. Leave empty for in-cluster Temporal; set it to your Temporal Cloud endpoint otherwise. | |
temporalPort | TEMPORAL_PORT | "7233" | Temporal port. | |
temporalNamespace | TEMPORAL_NAMESPACE | aisquared-dev | Temporal namespace. | |
temporalTaskQueue | TEMPORAL_TASK_QUEUE | sync-dev | Task queue for sync workflows. | |
temporalActivityThreadPoolSize | TEMPORAL_ACTIVITY_THREAD_POOL_SIZE | "20" | Worker activity threads. | |
temporalWorkflowThreadPoolSize | TEMPORAL_WORKFLOW_THREAD_POOL_SIZE | "10" | Worker workflow threads. | |
temporalRootCert / temporalClientKey / temporalClientChain | TEMPORAL_ROOT_CERT / TEMPORAL_CLIENT_KEY / TEMPORAL_CLIENT_CHAIN | /certs/... | Paths to the Temporal Cloud certificates mounted from the temporal-cloud secret. | |
temporalPostgresUser | TEMPORAL_POSTGRES_USER | aisquared | Temporal database (u) | In-cluster Temporal’s database user. |
temporalPostgresPassword | TEMPORAL_POSTGRES_PASSWORD | password | Temporal database (p) | In-cluster Temporal’s database password. |
temporalVisibilityPostgresUser / Password | TEMPORAL_VISIBILITY_POSTGRES_USER / PASSWORD | "" | Temporal visibility database | Credentials for the visibility database, if it’s separate. |
temporalPostgresDefaultPort | TEMPORAL_POSTGRES_DEFAULT_PORT | "5432" | Temporal database port. | |
temporalPostgresSsl | n/a | false | Connect to Temporal’s database over TLS. | |
temporalPostgresTlsDisableHostVerification | n/a | false | Skip TLS hostname verification for that connection. |
Email (SMTP)
platformConfig
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
smtpAddress | SMTP_ADDRESS | smtp.yourdomain.com | SMTP server address, such as smtp.gmail.com or your SES endpoint. | |
smtpHost | SMTP_HOST | yourdomain.com | Hostname used to build links in emails (for example password-reset links). Usually your uiHost. | |
smtpPort | SMTP_PORT | "587" | SMTP port. | |
smtpUsername | SMTP_USERNAME | yourusername | app | SMTP username. |
smtpPassword | SMTP_PASSWORD | yourpassword | app | SMTP password. |
smtpSenderEmail | SMTP_SENDER_EMAIL | admin@yourdomain.com | ”From” address. | |
smtpBrandName | BRAND_NAME | AI Squared | ”From” display name. |
File storage
platformConfig
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
activeStorageService | ACTIVE_STORAGE_SERVICE | microsoft | Where uploaded files are stored: amazon (S3), microsoft (Azure Blob) or local. | |
awsS3Bucket | AWS_S3_BUCKET | "" | S3 bucket when amazon is used. | |
awsRegion | AWS_REGION | "" | AWS region. | |
awsAccessKeyId | AWS_ACCESS_KEY_ID | "" | app | AWS access key. Leave empty when using IRSA. |
awsSecretAccessKey | AWS_SECRET_ACCESS_KEY | "" | app | AWS secret key. Leave empty when using IRSA. |
s3SseType | S3_SSE_TYPE | AES256 | S3 server-side encryption: AES256, aws:kms or none. | |
s3KmsKeyId | S3_KMS_KEY_ID | "" | KMS key ARN when s3SseType is aws:kms. | |
storageAccountName | STORAGE_ACCOUNT_NAME | "" | Azure storage account when microsoft is used. | |
storageAccessKey | STORAGE_ACCESS_KEY | "" | app | Azure storage access key. |
AI models and workflows
platformConfig
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
openrouterApiKey | OPENROUTER_API_KEY | "" | app | OpenRouter key, used to look up model pricing for LLM cost tracking. |
openaiExcludeModels | OPENAI_EXCLUDE_MODELS | "" | Comma-separated OpenAI model IDs to hide from model pickers. | |
googleGeminiExcludeModels | GOOGLE_GEMINI_EXCLUDE_MODELS | "" | Comma-separated Gemini model IDs to hide. | |
anthropicExcludeModels | ANTHROPIC_EXCLUDE_MODELS | "" | A single version, such as 4.5. Claude models older than this are hidden. | |
openRouterExcludeProviders | OPEN_ROUTER_EXCLUDE_PROVIDERS | "" | Comma-separated OpenRouter providers to hide. | |
p2wLlmProvider | P2W_LLM_PROVIDER | "" | LLM for the Prompt-to-Workflow builder: openai, anthropic, bedrock or sagemaker. Falls back to promptToWorkflowProvider, then openai. | |
p2wLlmModel | P2W_LLM_MODEL | "" | Model for Prompt-to-Workflow. Falls back to promptToWorkflowModel, then gpt-4o. | |
p2wLlmApiKey | P2W_LLM_API_KEY | "" | app | API key for Prompt-to-Workflow. Not used with bedrock/sagemaker, which use IAM. |
p2wLlmTemperature | P2W_LLM_TEMPERATURE | "" | Sampling temperature. Defaults to 0. | |
promptToWorkflowProvider | PROMPT_TO_WORKFLOW_PROVIDER | "" | openai or anthropic. Also the fallback for the p2wLlm* values. | |
promptToWorkflowModel | PROMPT_TO_WORKFLOW_MODEL | "" | Model ID. | |
promptToWorkflowApiUrl | PROMPT_TO_WORKFLOW_API_URL | "" | Full LLM API URL. | |
promptToWorkflowApiKey | PROMPT_TO_WORKFLOW_API_KEY | "" | app | API key. |
remoteCodeExecutionProvider | REMOTE_CODE_EXECUTION_PROVIDER | "" | Backend that runs workflow code nodes. Only aws_lambda is supported, and it’s the default. | |
awsLambdaApiUrl | AWS_LAMBDA_API_URL | "" | Lambda endpoint for code nodes. Required when code nodes are used. | |
hostedVectorDbHost / Port / Database | HOSTED_VECTOR_DB_* | "" / "5432" / "" | PostgreSQL (pgvector) server for platform-hosted vector stores. | |
hostedVectorDbUsername / Password | HOSTED_VECTOR_DB_USERNAME / PASSWORD | "" | app | Credentials for that server. |
textractAccessKeyId / textractSecretAccessKey / textractBucketName / textractRegion | TEXTRACT_* | "" | app (keys) | Reserved. Not read by the current release. |
Lightning (AI gateway)
lightningConfig
Lightning serves the platform’s built-in AI capabilities. Each model role below has three values: <role>ApiKey, <role>Endpoint and <role>Model. For example, the chat role uses chatApiKey, chatEndpoint and chatModel, which become CHAT_API_KEY, CHAT_ENDPOINT and CHAT_MODEL.
- Endpoints:
*Endpointis the base URL of an OpenAI-compatible API (/v1is added if missing). - Secrets: every
*ApiKeybelongs to thelightningsecret group.
| Role | Purpose |
|---|---|
chat | General chat assistant |
multimodalChat | Chat with image input |
poly | Translation |
babel | Reserved. Translation uses poly. |
seemore | Vision-language model for document ingestion and Q&A. The model name goes in seemoreVlm, not seemoreModel. |
structuredExtraction | Structured field extraction from documents |
sentinel | Guardrails |
pathfinder | Model routing |
judy | LLM-as-a-judge evaluation |
embedding | Embeddings |
xpert | Reserved |
/v1), with each value set as <classifier>ApiKey, <classifier>Endpoint, <classifier>Model and, for the first three, <classifier>Threshold.
| Classifier | Purpose | Threshold default |
|---|---|---|
clsPii | Optional fast PII pre-check for Sentinel. Skipped if no endpoint is set. | 0.10 |
clsContent | Optional harmful-content pre-check for Sentinel. | 0.30 |
clsJailbreak | Optional jailbreak pre-check for Sentinel. | 0.25 |
clsRouter | Route classifier for Pathfinder. Required for Pathfinder to start. | n/a |
| Value | Env var | Default | Description |
|---|---|---|---|
clsClientTimeoutSeconds | CLS_CLIENT_TIMEOUT_SECONDS | 10 | Timeout, in seconds, for each classifier call. |
clsClientMaxRetries | CLS_CLIENT_MAX_RETRIES | 5 | Retries for each classifier call. |
inferenceBackend | INFERENCE_BACKEND | huggingface | huggingface (OpenAI-compatible endpoints) or sagemaker. |
inferenceAwsRegion | INFERENCE_AWS_REGION | "" | AWS region for SageMaker. |
<role>SagemakerEndpoint | <ROLE>_SAGEMAKER_ENDPOINT | "" | SageMaker endpoint name for each role when inferenceBackend is sagemaker. |
lightningUrl | LIGHTNING_URL | "" | Lightning URL. Leave empty for the in-cluster service. |
App Builder
sandboxConfig, appbuilderIngress. For setup instructions, see App Builder.
Coding agent
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
codingAgentProvider | CODING_AGENT_PROVIDER | opencode | Coding agent. opencode is the only option. | |
codingAgentModel | CODING_AGENT_MODEL | anthropic/claude-sonnet-4-20250514 | <provider>/<model>. The prefix (anthropic, openai, google, groq, amazon-bedrock) selects the provider. | |
codingAgentModelApiKey | CODING_AGENT_MODEL_API_KEY | "" | sandbox, box | API key for the provider in codingAgentModel. Required with Box. |
codingAgentBedrockModelId | CODING_AGENT_BEDROCK_MODEL_ID | us.anthropic.claude-opus-4-6-v1 | Bedrock inference profile. Used only with an amazon-bedrock/ model. | |
codingAgentOpenaiApiKey / XaiApiKey / GoogleApiKey | CODING_AGENT_*_API_KEY | "" | sandbox, box | Reserved. Not read by the current release; use codingAgentModelApiKey. |
opencodeOtlpEndpoint | OPENCODE_OTLP_ENDPOINT | "" | OTLP endpoint for coding-agent telemetry. Used only when appsignalPushApiKey is also set. |
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
agenticCodingSandboxProvider | AGENTIC_CODING_SANDBOX_PROVIDER | modal | modal or box. | |
agenticCodingSandboxImage | AGENTIC_CODING_SANDBOX_IMAGE | "" | Sandbox image with Box. Defaults to multiwoven/ai-appgen-sandbox:latest. | |
agenticCodingSandboxDomain | AGENTIC_CODING_SANDBOX_DOMAIN | agentic-coding-sandbox.example.com | Custom domain for sandbox preview URLs. Modal only. | |
agenticCodingSandboxCpu | AGENTIC_CODING_SANDBOX_CPU | "2000" | CPU per sandbox, in millicores. | |
agenticCodingSandboxMemory | AGENTIC_CODING_SANDBOX_MEMORY | "4096" | Memory per sandbox, in MB. | |
agenticCodingSandboxTimeout | AGENTIC_CODING_SANDBOX_TIMEOUT | "3600" | Maximum sandbox lifetime, in seconds. | |
agenticCodingSandboxIdleTimeout | AGENTIC_CODING_SANDBOX_IDLE_TIMEOUT | "1200" | Idle time before a sandbox stops, in seconds. | |
agenticCodingIdleThreshold | AGENTIC_CODING_IDLE_THRESHOLD | "10" | Inactivity before a session is snapshotted and suspended, in minutes. | |
agenticCodingSnapshotInterval | AGENTIC_CODING_SNAPSHOT_INTERVAL | */10 * * * * | Cron schedule for the snapshot-and-suspend job. | |
agenticCodingDeployCpu | AGENTIC_CODING_DEPLOY_CPU | "1000" | CPU for deployed apps, in millicores. Modal only. | |
agenticCodingDeployMemory | AGENTIC_CODING_DEPLOY_MEMORY | "2048" | Memory for deployed apps, in MB. Modal only. | |
agenticCodingDeployRotateEnabled | AGENTIC_CODING_DEPLOY_ROTATE_ENABLED | "false" | Rotate deployed Modal sandboxes before Modal’s 24-hour limit. Turn this on with Modal. | |
agenticCodingDeploymentEnv | AGENTIC_CODING_DEPLOYMENT_ENV | staging | Environment tag on coding-agent telemetry. | |
agenticCodingBuildToken | AGENTIC_CODING_BUILD_TOKEN | "" | sandbox | Bearer token for the internal sandbox-image build callback. |
modalTokenId / modalTokenSecret | MODAL_TOKEN_ID / MODAL_TOKEN_SECRET | "" | sandbox | Modal API token. |
modalEnvironment | MODAL_ENVIRONMENT | "" | Modal environment. Defaults to main. | |
dockerHubRegistryUsername / Password | DOCKER_HUB_REGISTRY_* | "" | sandbox | Docker Hub credentials Modal uses to pull private sandbox images. |
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
agenticCodingStorageProvider | AGENTIC_CODING_STORAGE_PROVIDER | aws | aws (S3) or none. | |
agenticCodingS3Bucket | AGENTIC_CODING_S3_BUCKET | "" | Bucket for app files. | |
agenticCodingS3Region | AGENTIC_CODING_S3_REGION | us-east-1 | Bucket and STS region. | |
agenticCodingStsRoleName | AGENTIC_CODING_STS_ROLE_NAME | "" | IAM role name (not ARN) assumed to create scoped credentials for each app. | |
agenticCodingStsDuration | AGENTIC_CODING_STS_DURATION | "43200" | Credential lifetime, in seconds. | |
agenticCodingDbProvider | AGENTIC_CODING_DB_PROVIDER | "" | neon (default when empty) or none. | |
platformConfig.neonApiKey | NEON_API_KEY | "" | app | Neon API key. |
platformConfig.neonApiBaseUrl | NEON_API_BASE_URL | "" | Defaults to https://console.neon.tech/api/v2. | |
platformConfig.neonDefaultRegion | NEON_DEFAULT_REGION | "" | Defaults to aws-us-east-1. |
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
agenticCodingGithubAppSlug | AGENTIC_CODING_GITHUB_APP_SLUG | "" | GitHub App URL slug. | |
agenticCodingGithubAppId | AGENTIC_CODING_GITHUB_APP_ID | "" | GitHub App ID. | |
agenticCodingGithubAppClientId | AGENTIC_CODING_GITHUB_APP_CLIENT_ID | "" | OAuth client ID. | |
agenticCodingGithubAppClientSecret | AGENTIC_CODING_GITHUB_APP_CLIENT_SECRET | "" | sandbox | OAuth client secret. |
agenticCodingGithubWebhookSecret | AGENTIC_CODING_GITHUB_WEBHOOK_SECRET | "" | sandbox | Verifies webhook payloads. |
agenticCodingGithubAppPrivateKeyPath | AGENTIC_CODING_GITHUB_APP_PRIVATE_KEY_PATH | "" | Name of a Kubernetes secret that holds private-key.pem. The chart mounts it and sets the path. | |
agenticCodingGithubBotName / BotEmail | AGENTIC_CODING_GITHUB_BOT_* | AppBuilder Bot / appbuilder-bot@example.com | Commit author for the bot. |
appbuilderIngress)
| Value | Env var | Default | Description |
|---|---|---|---|
enabled | n/a | false | Create the wildcard Ingress for published apps. |
appgenPublishedDomain | APPGEN_PUBLISHED_DOMAIN | appbuilder.qa.squared.ai | Base domain for published apps (<app>.<domain>). Set this to your own domain, or to "" if you don’t use App Builder. |
tlsSecretName | n/a | appbuilder-wildcard-tls | Wildcard TLS secret (NGINX). |
proxyBodySize / proxyReadTimeout / proxySendTimeout / proxyBuffering | n/a | 100m / 3600 / 3600 / "off" | NGINX settings for streaming responses. |
groupOrder | n/a | "20" | ALB rule priority. Must be higher than awsIngress.groupOrder. |
extraAnnotations | n/a | {} | Extra ALB annotations. |
AGENTIC_CODING_ASK_QUESTIONS_ENABLED, AGENTIC_CODING_SUGGESTIONS_ENABLED, AGENTIC_CODING_SECURITY_SCAN_ENABLED, AGENTIC_CODING_CONNECTOR_MANAGE_ENABLED and AGENTIC_CODING_CUSTOM_TOOLS_ENABLED.
Box
boxConfig, plus box for the deployment itself. Used only when box.enabled: true.
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
boxApiKey | BOX_API_KEY | "" | box | API key for Box. Must equal platformConfig.boxApiKey, which is in the app group. |
boxEncryptionKey | BOX_ENCRYPTION_KEY | "" | box | Exactly 64 hex characters. Encrypts secrets in Box’s database. Generate with openssl rand -hex 32 and never change it. |
dbHost / dbPort / boxDbName / dbSslMode | DB_HOST / DB_PORT / BOX_DB_NAME / DB_SSLMODE | "" / "5432" / box_production / disable | Box’s PostgreSQL database. | |
dbUsername / dbPassword | DB_USERNAME / DB_PASSWORD | "" | box | Box database credentials. |
boxK8sNamespace | BOX_K8S_NAMESPACE | box-sandboxes | Namespace for sandbox pods. Created by the chart. | |
boxReleasesNamespace | BOX_RELEASES_NAMESPACE | box-releases | Namespace for released apps. Not created by the chart yet. | |
boxIngressDomain | BOX_INGRESS_DOMAIN | "" | Base domain for sandbox and release URLs. Needs wildcard DNS. | |
boxIngressClass | BOX_INGRESS_CLASS | nginx | Ingress class for the Ingresses Box creates. | |
boxIngressNamespace | BOX_INGRESS_NAMESPACE | ingress-nginx | Ingress controller namespace, which Box’s network policies allow. | |
boxStorageClass | BOX_STORAGE_CLASS | standard | StorageClass for sandbox volumes. | |
boxSnapshotClass | BOX_SNAPSHOT_CLASS | csi-hostpath-snapclass | VolumeSnapshotClass for sandbox snapshots. | |
boxPvcSize | BOX_PVC_SIZE | 10Gi | Volume size for each sandbox. | |
boxImagePullSecret | BOX_IMAGE_PULL_SECRET | "" | Existing pull secret added to sandbox pods. | |
boxSandboxBaseImage | BOX_SANDBOX_BASE_IMAGE | "" | Image used when a request names none. | |
boxDevCpuRequest / boxDevCpuLimit | BOX_DEV_CPU_* | "2000" / "4000" | Sandbox CPU, in millicores. | |
boxDevMemoryRequestMb / boxDevMemoryLimitMb | BOX_DEV_MEMORY_* | "4096" / "6144" | Sandbox memory, in MB. | |
boxReleaseCpuRequest / boxReleaseCpuLimit | BOX_RELEASE_CPU_* | "1000" / "2000" | Released-app CPU, in millicores. | |
boxReleaseMemoryRequestMb / boxReleaseMemoryLimitMb | BOX_RELEASE_MEMORY_* | "1024" / "2048" | Released-app memory, in MB. | |
boxSandboxPriorityClassName / boxReleasePriorityClassName | n/a | box-critical | PriorityClass for sandbox and release pods. | |
boxReleaseReadyTimeout | BOX_RELEASE_READY_TIMEOUT | 180s | How long to wait for a release to become ready. | |
boxProvisioningTimeout | BOX_PROVISIONING_TIMEOUT | 90s | How long to wait for a sandbox to provision. | |
boxReaperInterval | BOX_REAPER_INTERVAL | 60s | How often expired sandboxes are cleaned up. | |
boxSnapshotMaxAgeHours | BOX_SNAPSHOT_MAX_AGE_HOURS | "0" | Minimum age before orphaned snapshots are deleted. 0 turns off the age check; Box’s own default is 72. | |
boxStaleSecretMaxAge | BOX_STALE_SECRET_MAX_AGE | 24h | Age at which unreferenced secrets are deleted. | |
boxAdminEnabled | BOX_ADMIN_ENABLED | "true" | Serve Box’s admin UI at /admin (log in with boxApiKey). The admin API stays on either way. | |
boxLogLevel | BOX_LOG_LEVEL | info | Log level. | |
boxDbMaxOpenConns / boxDbMaxIdleConns / boxDbConnMaxLifetime | BOX_DB_* | "25" / "10" / 5m | Connection pool settings. |
boxConfig values (boxAgentPort, boxVitePort, boxDefaultTimeout, boxDefaultIdleTimeout, boxDefaultCpu, boxDefaultMemoryMb, boxDeployDefaultTimeoutSecs, boxSnapshotFsDefaultTimeoutSecs, boxShutdownTimeout, boxReapSnapshotTimeout, boxReleaseStartupProbeFailureThreshold) are internal tuning settings and rarely need changing.
| Value | Default | Description |
|---|---|---|
box.enabled | false | Deploy Box. |
box.serviceAccount.annotations | {} | Annotations for Box’s own service account, such as an IRSA role. |
box.rbac.create | true | Create Box’s ClusterRole and RoleBinding. |
box.namespaces.create | true | Create the sandbox namespace. |
box.priorityClass.create | true | Create the box-critical PriorityClass. |
Monitoring and analytics
platformConfig
| Value | Env var | Default | Secret group | Description |
|---|---|---|---|---|
appEnv | APP_ENV, APPSIGNAL_APP_ENV | community | Environment name reported to AppSignal. | |
appRevision | APP_REVISION | unknown | Revision identifier for this deployment. | |
appsignalPushApiKey | APPSIGNAL_PUSH_API_KEY | yourkey | app | AppSignal API key for the server. |
viteAppsignalMonitoringKey | VITE_APPSIGNAL_MONITORING_KEY | yourkey | AppSignal frontend key. | |
newRelicKey | NEW_RELIC_KEY | yourkey | app | New Relic license key. |
prometheusMetricsUsername / Password | PROMETHEUS_METRICS_* | "" | app | Basic-auth credentials for the server’s /metrics. If either is empty, /metrics is off. |
vitePublicPosthogKey / Host | VITE_PUBLIC_POSTHOG_* | "" | PostHog key and host for UI analytics. | |
track | TRACK | "no" | Set to no to turn off anonymous usage telemetry. | |
enableGeoSubscriber | ENABLE_GEO_SUBSCRIBER | "false" | Turn on GeoIP lookup. Needs MaxMind credentials. | |
maxmindAccountId | MAXMIND_ACCOUNT_ID | "" | MaxMind account ID. | |
maxmindLicenseKey | MAXMIND_LICENSE_KEY | "" | app | MaxMind license key. |
leadCaptureEnabled, hubspotApiKey, slackSignupChannelEmail | LEAD_CAPTURE_ENABLED, HUBSPOT_API_KEY, SLACK_SIGNUP_CHANNEL_EMAIL | "false", "", "" | app (hubspotApiKey) | Sign-up notifications used by AI Squared’s hosted service. Leave these off. |
Branding
platformConfig
| Value | Env var | Default | Description |
|---|---|---|---|
viteBrandName | VITE_BRAND_NAME | AI Squared | Product name in the UI. |
viteLogoUrl | VITE_LOGO_URL | "" | Logo URL. |
viteFavIconUrl | VITE_FAV_ICON_URL | "" | Favicon URL. |
viteBrandColor / viteBrandHoverColor | VITE_BRAND_COLOR / VITE_BRAND_HOVER_COLOR | "" | Theme colors. |
Data sync tuning and drivers
platformConfig
| Value | Env var | Default | Description |
|---|---|---|---|
syncExtractorBatchSize | SYNC_EXTRACTOR_BATCH_SIZE | "1000" | Records read per batch. |
syncExtractorThreadPoolSize | SYNC_EXTRACTOR_THREAD_POOL_SIZE | "10" | Extractor threads. |
syncLoaderBatchSize | SYNC_LOADER_BATCH_SIZE | "1000" | Records written per batch. |
syncLoaderThreadPoolSize | SYNC_LOADER_THREAD_POOL_SIZE | "10" | Loader threads. |
snowflakeDriverPath | SNOWFLAKE_DRIVER_PATH | /usr/lib/snowflake/odbc/lib/libSnowflake.so | Snowflake ODBC driver path in the image. |
databricksDriverPath | DATABRICKS_DRIVER_PATH | /opt/simba/spark/lib/64/libsparkodbc_sb64.so | Databricks ODBC driver path in the image. |
grpcEnableForkSupport | GRPC_ENABLE_FORK_SUPPORT | 1 | gRPC fork support. Leave as is. |
railsEnv | RAILS_ENV | development | Rails environment. |
railsLogLevel | RAILS_LOG_LEVEL | info | Server log level. |
Kubernetes and components
| Value | Default | Description |
|---|---|---|
nameOverride | "" | Prefix for resource names. Set it to multiwoven only when upgrading from the old chart. |
kubernetesNamespace | aisquared | Namespace the chart creates and deploys into. |
kubernetesClusterDomain | cluster.local | Cluster DNS domain. |
globalImagePullPolicy | IfNotPresent | Image pull policy for all containers. |
platformConfig.privateRepo | false | Use registrySecretName to pull images. |
platformConfig.registrySecretName | mwregistrysecret | Image pull secret name. |
serviceAccount.create | false | Create the platform service account. |
serviceAccount.name | aisquared-service-account | Platform service account name. |
serviceAccount.annotations | {} | Annotations for that service account, such as an IRSA role ARN. |
automountServiceAccountToken.enabled | true | Mount service-account tokens into pods. |
securityContext.readOnlyRootFilesystem | false | Run containers with a read-only root filesystem. |
pvc.pvc.storageRequest | 100Mi | Size of the in-cluster PostgreSQL volume. Increase this for real use. |
pvc.pvc.storageClassName | default | StorageClass for that volume. |
hpa.enabled | true | Create HorizontalPodAutoscalers. |
hpa.<component>.minReplicas / maxReplicas | 1 / 10 | Autoscaling bounds for server, ui, worker, solidWorker, lightning and box. |
hpa.<component>.cpuAverageUtilizationPercentageThreshold / memoryAverageUtilizationPercentageThreshold | varies | Scale-out thresholds, in percent. |
server, ui, worker, solidWorker, lightning, box, postgresql, temporal, temporalUi) supports:
| Value | Description |
|---|---|
<component>.enabled | Deploy it. Applies to postgresql, temporal, lightning and box. |
<component>.replicas | Replica count when HPA is off. |
<component>.annotations | Extra pod annotations. |
<component>.<component>.image.repository / .tag | Container image. |
<component>.<component>.resources | CPU and memory requests and limits. |
<component>.type | Service type. Default ClusterIP. |
secretsStore settings, see Secrets.