> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squared.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Helm Configuration Reference

> Every value in the aisquared Helm chart: what it sets, its default, and whether it belongs in a secret.

This page lists the values you can set in the [`aisquared` Helm chart](/deployment-and-security/setup/helm), current as of chart **0.118.0**. For the version you're installing, the chart's [`values.yaml`](https://github.com/Multiwoven/helm-charts/blob/main/charts/aisquared/values.yaml) is the source of truth.

**How to read the tables**

* **Value:** the key in your values file. Every table names its parent key, such as `platformConfig`.
* **Env var:** the environment variable the value becomes inside the containers. This is the name to search for in logs or when you're using Docker Compose.
* **Secret group:** set when the value is sensitive. If you turn that group on under `secretsStore`, put the value in the AWS Secrets Manager secret (using the same key name) instead of your values file. See [Secrets](/deployment-and-security/setup/helm#secrets).

## Security and authentication

`platformConfig`

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `secretKeyBase` | `SECRET_KEY_BASE` | `""` | `app` | Rails signing and encryption key. **Required in production.** Generate with `openssl rand -hex 64`. |
| `jwtSecret` | `JWT_SECRET` | `""` | `app` | Signs user session tokens. **Always set this.** If it's empty, the server falls back to a key built into the source code. Generate with `openssl rand -hex 64`. |
| `allowedHost` | `ALLOWED_HOST` | `""` | | An extra hostname the API accepts requests for, beyond `apiHost`. |
| `allowedSourceIP` | n/a (ingress annotation) | `0.0.0.0/0` | | CIDR range allowed through the NGINX ingress. |
| `userEmailVerification` | `USER_EMAIL_VERIFICATION` | `"false"` | | Require new users to verify their email. Needs working SMTP. |
| `codeExecSigningSecret` | `CODE_EXEC_SIGNING_SECRET` | `""` | `app` | Shared secret that signs requests to the remote code-execution service. Required if workflows use code nodes. |

<Warning>
  Set both `secretKeyBase` and `jwtSecret` to unique random values for every installation, and don't change them afterwards. Changing `secretKeyBase` makes encrypted data unreadable, and changing `jwtSecret` signs everyone out.
</Warning>

## Hostnames and ingress

`platformConfig` and `lightningConfig`

| Value | Env var | Default | Description |
| - | - | - | - |
| `platformConfig.uiHost` | `UI_HOST` | `app.example.com` | Web app hostname. |
| `platformConfig.apiHost` | `API_HOST` | `api.example.com` | API hostname. |
| `platformConfig.viteApiHost` | `VITE_API_HOST` | `api.example.com` | API host the browser calls. Usually the same as `apiHost`. |
| `platformConfig.workerHost` | n/a (ingress) | `worker.example.com` | Hostname for the worker's health endpoint. |
| `platformConfig.solidWorkerHost` | n/a (ingress) | `solid.example.com` | Hostname for the solid worker's health endpoint. |
| `platformConfig.temporalUiHost` | n/a (ingress) | `temporal.example.com` | Temporal UI hostname (in-cluster Temporal only). |
| `lightningConfig.lightningHealthHost` | n/a (ingress) | `lightning.example.com` | Hostname for Lightning's `/health` and `/model_status_check` endpoints. |
| `platformConfig.tlsAdminEmail` | n/a (Issuer) | `admin@example.com` | Let's Encrypt account email. |
| `platformConfig.tlsCertIssuer` | n/a (ingress) | `letsencrypt-staging` | `letsencrypt-staging` or `letsencrypt-prod`. |
| `platformConfig.nginxProxyBodySize` | n/a (ingress) | `2m` | Maximum request body size through NGINX. |

Ingress controller settings:

| Value | Default | Description |
| - | - | - |
| `nginxIngress.enabled` | `true` | Use the NGINX ingress class with cert-manager TLS. |
| `nginxIngress.proxyReadTimeout` / `proxySendTimeout` | `300` | Proxy timeouts, in seconds. |
| `nginxIngress.proxyBuffering` | `"on"` | NGINX proxy buffering. |
| `nginxIngress.enableMetrics` | `false` | When `false`, `/metrics` is blocked at the ingress. |
| `awsIngress.enabled` | `false` | Use an AWS Application Load Balancer. |
| `awsIngress.acmCertificateArn` | `""` | ACM certificate for the ALB. |
| `awsIngress.albScheme` | `internet-facing` | `internet-facing` or `internal`. |
| `awsIngress.sslPolicy` | `ELBSecurityPolicy-2016-08` | ALB TLS policy. |
| `awsIngress.groupName` | `""` | Shares one ALB across several Ingresses. |
| `awsIngress.groupOrder` | `"10"` | Rule priority within the group. Keep it lower than `appbuilderIngress.groupOrder`. |
| `awsIngress.extraAnnotations` | `{}` | Raw `alb.ingress.kubernetes.io/*` annotations. |
| `kongIngress.enabled` | `false` | Use the Kong ingress class. |
| `kongIngress.plugins.prometheus.enabled` | `false` | Attach Kong's Prometheus plugin. |
| `externalDNS.enabled` | `false` | Add ExternalDNS hostname annotations to the Ingresses. |

## Platform database

`platformConfig`

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `dbHost` | `DB_HOST` | `""` | | PostgreSQL host. Leave empty to use the in-cluster database. |
| `dbPort` | `DB_PORT` | `"5432"` | | PostgreSQL port. |
| `dbName` | `DB_NAME` | `aisquared_server_production` | | Database name. |
| `dbUsername` | `DB_USERNAME` | `aisquared` | Platform database (`u`) | Database user. |
| `dbPassword` | `DB_PASSWORD` | `password` | Platform database (`p`) | Database password. **Change this.** |
| `skipDbMigration` | `SKIP_DB_MIGRATION` | `false` | | Skip schema and data migrations when the server starts. |

For databases on separate hosts, set `multipleDbHosts.enabled: true` and `multipleDbHosts.platformDBHost`/`platformDBName`, `temporalDbHost`/`temporalDbName` and `temporalVisibilityDbHost`/`temporalVisibilityDbName`.

## Temporal

`platformConfig`

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `temporalHost` | `TEMPORAL_HOST` | `""` | | Temporal host. Leave empty for in-cluster Temporal; set it to your Temporal Cloud endpoint otherwise. |
| `temporalPort` | `TEMPORAL_PORT` | `"7233"` | | Temporal port. |
| `temporalNamespace` | `TEMPORAL_NAMESPACE` | `aisquared-dev` | | Temporal namespace. |
| `temporalTaskQueue` | `TEMPORAL_TASK_QUEUE` | `sync-dev` | | Task queue for sync workflows. |
| `temporalActivityThreadPoolSize` | `TEMPORAL_ACTIVITY_THREAD_POOL_SIZE` | `"20"` | | Worker activity threads. |
| `temporalWorkflowThreadPoolSize` | `TEMPORAL_WORKFLOW_THREAD_POOL_SIZE` | `"10"` | | Worker workflow threads. |
| `temporalRootCert` / `temporalClientKey` / `temporalClientChain` | `TEMPORAL_ROOT_CERT` / `TEMPORAL_CLIENT_KEY` / `TEMPORAL_CLIENT_CHAIN` | `/certs/...` | | Paths to the Temporal Cloud certificates mounted from the `temporal-cloud` secret. |
| `temporalPostgresUser` | `TEMPORAL_POSTGRES_USER` | `aisquared` | Temporal database (`u`) | In-cluster Temporal's database user. |
| `temporalPostgresPassword` | `TEMPORAL_POSTGRES_PASSWORD` | `password` | Temporal database (`p`) | In-cluster Temporal's database password. |
| `temporalVisibilityPostgresUser` / `Password` | `TEMPORAL_VISIBILITY_POSTGRES_USER` / `PASSWORD` | `""` | Temporal visibility database | Credentials for the visibility database, if it's separate. |
| `temporalPostgresDefaultPort` | `TEMPORAL_POSTGRES_DEFAULT_PORT` | `"5432"` | | Temporal database port. |
| `temporalPostgresSsl` | n/a | `false` | | Connect to Temporal's database over TLS. |
| `temporalPostgresTlsDisableHostVerification` | n/a | `false` | | Skip TLS hostname verification for that connection. |

## Email (SMTP)

`platformConfig`

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `smtpAddress` | `SMTP_ADDRESS` | `smtp.yourdomain.com` | | SMTP server address, such as `smtp.gmail.com` or your SES endpoint. |
| `smtpHost` | `SMTP_HOST` | `yourdomain.com` | | Hostname used to build links in emails (for example password-reset links). Usually your `uiHost`. |
| `smtpPort` | `SMTP_PORT` | `"587"` | | SMTP port. |
| `smtpUsername` | `SMTP_USERNAME` | `yourusername` | `app` | SMTP username. |
| `smtpPassword` | `SMTP_PASSWORD` | `yourpassword` | `app` | SMTP password. |
| `smtpSenderEmail` | `SMTP_SENDER_EMAIL` | `admin@yourdomain.com` | | "From" address. |
| `smtpBrandName` | `BRAND_NAME` | `AI Squared` | | "From" display name. |

## File storage

`platformConfig`

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `activeStorageService` | `ACTIVE_STORAGE_SERVICE` | `microsoft` | | Where uploaded files are stored: `amazon` (S3), `microsoft` (Azure Blob) or `local`. |
| `awsS3Bucket` | `AWS_S3_BUCKET` | `""` | | S3 bucket when `amazon` is used. |
| `awsRegion` | `AWS_REGION` | `""` | | AWS region. |
| `awsAccessKeyId` | `AWS_ACCESS_KEY_ID` | `""` | `app` | AWS access key. Leave empty when using IRSA. |
| `awsSecretAccessKey` | `AWS_SECRET_ACCESS_KEY` | `""` | `app` | AWS secret key. Leave empty when using IRSA. |
| `s3SseType` | `S3_SSE_TYPE` | `AES256` | | S3 server-side encryption: `AES256`, `aws:kms` or `none`. |
| `s3KmsKeyId` | `S3_KMS_KEY_ID` | `""` | | KMS key ARN when `s3SseType` is `aws:kms`. |
| `storageAccountName` | `STORAGE_ACCOUNT_NAME` | `""` | | Azure storage account when `microsoft` is used. |
| `storageAccessKey` | `STORAGE_ACCESS_KEY` | `""` | `app` | Azure storage access key. |

## AI models and workflows

`platformConfig`

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `openrouterApiKey` | `OPENROUTER_API_KEY` | `""` | `app` | OpenRouter key, used to look up model pricing for LLM cost tracking. |
| `openaiExcludeModels` | `OPENAI_EXCLUDE_MODELS` | `""` | | Comma-separated OpenAI model IDs to hide from model pickers. |
| `googleGeminiExcludeModels` | `GOOGLE_GEMINI_EXCLUDE_MODELS` | `""` | | Comma-separated Gemini model IDs to hide. |
| `anthropicExcludeModels` | `ANTHROPIC_EXCLUDE_MODELS` | `""` | | A single version, such as `4.5`. Claude models older than this are hidden. |
| `openRouterExcludeProviders` | `OPEN_ROUTER_EXCLUDE_PROVIDERS` | `""` | | Comma-separated OpenRouter providers to hide. |
| `p2wLlmProvider` | `P2W_LLM_PROVIDER` | `""` | | LLM for the Prompt-to-Workflow builder: `openai`, `anthropic`, `bedrock` or `sagemaker`. Falls back to `promptToWorkflowProvider`, then `openai`. |
| `p2wLlmModel` | `P2W_LLM_MODEL` | `""` | | Model for Prompt-to-Workflow. Falls back to `promptToWorkflowModel`, then `gpt-4o`. |
| `p2wLlmApiKey` | `P2W_LLM_API_KEY` | `""` | `app` | API key for Prompt-to-Workflow. Not used with `bedrock`/`sagemaker`, which use IAM. |
| `p2wLlmTemperature` | `P2W_LLM_TEMPERATURE` | `""` | | Sampling temperature. Defaults to `0`. |
| `promptToWorkflowProvider` | `PROMPT_TO_WORKFLOW_PROVIDER` | `""` | | `openai` or `anthropic`. Also the fallback for the `p2wLlm*` values. |
| `promptToWorkflowModel` | `PROMPT_TO_WORKFLOW_MODEL` | `""` | | Model ID. |
| `promptToWorkflowApiUrl` | `PROMPT_TO_WORKFLOW_API_URL` | `""` | | Full LLM API URL. |
| `promptToWorkflowApiKey` | `PROMPT_TO_WORKFLOW_API_KEY` | `""` | `app` | API key. |
| `remoteCodeExecutionProvider` | `REMOTE_CODE_EXECUTION_PROVIDER` | `""` | | Backend that runs workflow code nodes. Only `aws_lambda` is supported, and it's the default. |
| `awsLambdaApiUrl` | `AWS_LAMBDA_API_URL` | `""` | | Lambda endpoint for code nodes. Required when code nodes are used. |
| `hostedVectorDbHost` / `Port` / `Database` | `HOSTED_VECTOR_DB_*` | `""` / `"5432"` / `""` | | PostgreSQL (pgvector) server for platform-hosted vector stores. |
| `hostedVectorDbUsername` / `Password` | `HOSTED_VECTOR_DB_USERNAME` / `PASSWORD` | `""` | `app` | Credentials for that server. |
| `textractAccessKeyId` / `textractSecretAccessKey` / `textractBucketName` / `textractRegion` | `TEXTRACT_*` | `""` | `app` (keys) | Reserved. Not read by the current release. |

## Lightning (AI gateway)

`lightningConfig`

Lightning serves the platform's built-in AI capabilities. Each **model role** below has three values: `<role>ApiKey`, `<role>Endpoint` and `<role>Model`. For example, the chat role uses `chatApiKey`, `chatEndpoint` and `chatModel`, which become `CHAT_API_KEY`, `CHAT_ENDPOINT` and `CHAT_MODEL`.

* **Endpoints:** `*Endpoint` is the base URL of an OpenAI-compatible API (`/v1` is added if missing).
* **Secrets:** every `*ApiKey` belongs to the `lightning` secret group.

| Role | Purpose |
| - | - |
| `chat` | General chat assistant |
| `multimodalChat` | Chat with image input |
| `poly` | Translation |
| `babel` | Reserved. Translation uses `poly`. |
| `seemore` | Vision-language model for document ingestion and Q\&A. The model name goes in `seemoreVlm`, not `seemoreModel`. |
| `structuredExtraction` | Structured field extraction from documents |
| `sentinel` | Guardrails |
| `pathfinder` | Model routing |
| `judy` | LLM-as-a-judge evaluation |
| `embedding` | Embeddings |
| `xpert` | Reserved |

**Classifiers.** These use the bare server URL as the endpoint (no `/v1`), with each value set as `<classifier>ApiKey`, `<classifier>Endpoint`, `<classifier>Model` and, for the first three, `<classifier>Threshold`.

| Classifier | Purpose | Threshold default |
| - | - | - |
| `clsPii` | Optional fast PII pre-check for Sentinel. Skipped if no endpoint is set. | `0.10` |
| `clsContent` | Optional harmful-content pre-check for Sentinel. | `0.30` |
| `clsJailbreak` | Optional jailbreak pre-check for Sentinel. | `0.25` |
| `clsRouter` | Route classifier for Pathfinder. **Required for Pathfinder to start.** | n/a |

| Value | Env var | Default | Description |
| - | - | - | - |
| `clsClientTimeoutSeconds` | `CLS_CLIENT_TIMEOUT_SECONDS` | `10` | Timeout, in seconds, for each classifier call. |
| `clsClientMaxRetries` | `CLS_CLIENT_MAX_RETRIES` | `5` | Retries for each classifier call. |
| `inferenceBackend` | `INFERENCE_BACKEND` | `huggingface` | `huggingface` (OpenAI-compatible endpoints) or `sagemaker`. |
| `inferenceAwsRegion` | `INFERENCE_AWS_REGION` | `""` | AWS region for SageMaker. |
| `<role>SagemakerEndpoint` | `<ROLE>_SAGEMAKER_ENDPOINT` | `""` | SageMaker endpoint name for each role when `inferenceBackend` is `sagemaker`. |
| `lightningUrl` | `LIGHTNING_URL` | `""` | Lightning URL. Leave empty for the in-cluster service. |

## App Builder

`sandboxConfig`, `appbuilderIngress`. For setup instructions, see [App Builder](/deployment-and-security/setup/helm#app-builder).

**Coding agent**

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `codingAgentProvider` | `CODING_AGENT_PROVIDER` | `opencode` | | Coding agent. `opencode` is the only option. |
| `codingAgentModel` | `CODING_AGENT_MODEL` | `anthropic/claude-sonnet-4-20250514` | | `<provider>/<model>`. The prefix (`anthropic`, `openai`, `google`, `groq`, `amazon-bedrock`) selects the provider. |
| `codingAgentModelApiKey` | `CODING_AGENT_MODEL_API_KEY` | `""` | `sandbox`, `box` | API key for the provider in `codingAgentModel`. Required with Box. |
| `codingAgentBedrockModelId` | `CODING_AGENT_BEDROCK_MODEL_ID` | `us.anthropic.claude-opus-4-6-v1` | | Bedrock inference profile. Used only with an `amazon-bedrock/` model. |
| `codingAgentOpenaiApiKey` / `XaiApiKey` / `GoogleApiKey` | `CODING_AGENT_*_API_KEY` | `""` | `sandbox`, `box` | Reserved. Not read by the current release; use `codingAgentModelApiKey`. |
| `opencodeOtlpEndpoint` | `OPENCODE_OTLP_ENDPOINT` | `""` | | OTLP endpoint for coding-agent telemetry. Used only when `appsignalPushApiKey` is also set. |

**Sandboxes**

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `agenticCodingSandboxProvider` | `AGENTIC_CODING_SANDBOX_PROVIDER` | `modal` | | `modal` or `box`. |
| `agenticCodingSandboxImage` | `AGENTIC_CODING_SANDBOX_IMAGE` | `""` | | Sandbox image with Box. Defaults to `multiwoven/ai-appgen-sandbox:latest`. |
| `agenticCodingSandboxDomain` | `AGENTIC_CODING_SANDBOX_DOMAIN` | `agentic-coding-sandbox.example.com` | | Custom domain for sandbox preview URLs. Modal only. |
| `agenticCodingSandboxCpu` | `AGENTIC_CODING_SANDBOX_CPU` | `"2000"` | | CPU per sandbox, in millicores. |
| `agenticCodingSandboxMemory` | `AGENTIC_CODING_SANDBOX_MEMORY` | `"4096"` | | Memory per sandbox, in MB. |
| `agenticCodingSandboxTimeout` | `AGENTIC_CODING_SANDBOX_TIMEOUT` | `"3600"` | | Maximum sandbox lifetime, in seconds. |
| `agenticCodingSandboxIdleTimeout` | `AGENTIC_CODING_SANDBOX_IDLE_TIMEOUT` | `"1200"` | | Idle time before a sandbox stops, in seconds. |
| `agenticCodingIdleThreshold` | `AGENTIC_CODING_IDLE_THRESHOLD` | `"10"` | | Inactivity before a session is snapshotted and suspended, in minutes. |
| `agenticCodingSnapshotInterval` | `AGENTIC_CODING_SNAPSHOT_INTERVAL` | `*/10 * * * *` | | Cron schedule for the snapshot-and-suspend job. |
| `agenticCodingDeployCpu` | `AGENTIC_CODING_DEPLOY_CPU` | `"1000"` | | CPU for deployed apps, in millicores. Modal only. |
| `agenticCodingDeployMemory` | `AGENTIC_CODING_DEPLOY_MEMORY` | `"2048"` | | Memory for deployed apps, in MB. Modal only. |
| `agenticCodingDeployRotateEnabled` | `AGENTIC_CODING_DEPLOY_ROTATE_ENABLED` | `"false"` | | Rotate deployed Modal sandboxes before Modal's 24-hour limit. Turn this on with Modal. |
| `agenticCodingDeploymentEnv` | `AGENTIC_CODING_DEPLOYMENT_ENV` | `staging` | | Environment tag on coding-agent telemetry. |
| `agenticCodingBuildToken` | `AGENTIC_CODING_BUILD_TOKEN` | `""` | `sandbox` | Bearer token for the internal sandbox-image build callback. |
| `modalTokenId` / `modalTokenSecret` | `MODAL_TOKEN_ID` / `MODAL_TOKEN_SECRET` | `""` | `sandbox` | Modal API token. |
| `modalEnvironment` | `MODAL_ENVIRONMENT` | `""` | | Modal environment. Defaults to `main`. |
| `dockerHubRegistryUsername` / `Password` | `DOCKER_HUB_REGISTRY_*` | `""` | `sandbox` | Docker Hub credentials Modal uses to pull private sandbox images. |

**Generated-app storage and databases**

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `agenticCodingStorageProvider` | `AGENTIC_CODING_STORAGE_PROVIDER` | `aws` | | `aws` (S3) or `none`. |
| `agenticCodingS3Bucket` | `AGENTIC_CODING_S3_BUCKET` | `""` | | Bucket for app files. |
| `agenticCodingS3Region` | `AGENTIC_CODING_S3_REGION` | `us-east-1` | | Bucket and STS region. |
| `agenticCodingStsRoleName` | `AGENTIC_CODING_STS_ROLE_NAME` | `""` | | IAM role **name** (not ARN) assumed to create scoped credentials for each app. |
| `agenticCodingStsDuration` | `AGENTIC_CODING_STS_DURATION` | `"43200"` | | Credential lifetime, in seconds. |
| `agenticCodingDbProvider` | `AGENTIC_CODING_DB_PROVIDER` | `""` | | `neon` (default when empty) or `none`. |
| `platformConfig.neonApiKey` | `NEON_API_KEY` | `""` | `app` | Neon API key. |
| `platformConfig.neonApiBaseUrl` | `NEON_API_BASE_URL` | `""` | | Defaults to `https://console.neon.tech/api/v2`. |
| `platformConfig.neonDefaultRegion` | `NEON_DEFAULT_REGION` | `""` | | Defaults to `aws-us-east-1`. |

**GitHub integration**

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `agenticCodingGithubAppSlug` | `AGENTIC_CODING_GITHUB_APP_SLUG` | `""` | | GitHub App URL slug. |
| `agenticCodingGithubAppId` | `AGENTIC_CODING_GITHUB_APP_ID` | `""` | | GitHub App ID. |
| `agenticCodingGithubAppClientId` | `AGENTIC_CODING_GITHUB_APP_CLIENT_ID` | `""` | | OAuth client ID. |
| `agenticCodingGithubAppClientSecret` | `AGENTIC_CODING_GITHUB_APP_CLIENT_SECRET` | `""` | `sandbox` | OAuth client secret. |
| `agenticCodingGithubWebhookSecret` | `AGENTIC_CODING_GITHUB_WEBHOOK_SECRET` | `""` | `sandbox` | Verifies webhook payloads. |
| `agenticCodingGithubAppPrivateKeyPath` | `AGENTIC_CODING_GITHUB_APP_PRIVATE_KEY_PATH` | `""` | | **Name of a Kubernetes secret** that holds `private-key.pem`. The chart mounts it and sets the path. |
| `agenticCodingGithubBotName` / `BotEmail` | `AGENTIC_CODING_GITHUB_BOT_*` | `AppBuilder Bot` / `appbuilder-bot@example.com` | | Commit author for the bot. |

**Published apps** (`appbuilderIngress`)

| Value | Env var | Default | Description |
| - | - | - | - |
| `enabled` | n/a | `false` | Create the wildcard Ingress for published apps. |
| `appgenPublishedDomain` | `APPGEN_PUBLISHED_DOMAIN` | `appbuilder.qa.squared.ai` | Base domain for published apps (`<app>.<domain>`). **Set this to your own domain**, or to `""` if you don't use App Builder. |
| `tlsSecretName` | n/a | `appbuilder-wildcard-tls` | Wildcard TLS secret (NGINX). |
| `proxyBodySize` / `proxyReadTimeout` / `proxySendTimeout` / `proxyBuffering` | n/a | `100m` / `3600` / `3600` / `"off"` | NGINX settings for streaming responses. |
| `groupOrder` | n/a | `"20"` | ALB rule priority. Must be higher than `awsIngress.groupOrder`. |
| `extraAnnotations` | n/a | `{}` | Extra ALB annotations. |

**Toggles that aren't chart values yet.** The server reads these, but the chart can't set them yet. They all default to on: `AGENTIC_CODING_ASK_QUESTIONS_ENABLED`, `AGENTIC_CODING_SUGGESTIONS_ENABLED`, `AGENTIC_CODING_SECURITY_SCAN_ENABLED`, `AGENTIC_CODING_CONNECTOR_MANAGE_ENABLED` and `AGENTIC_CODING_CUSTOM_TOOLS_ENABLED`.

## Box

`boxConfig`, plus `box` for the deployment itself. Used only when `box.enabled: true`.

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `boxApiKey` | `BOX_API_KEY` | `""` | `box` | API key for Box. Must equal `platformConfig.boxApiKey`, which is in the `app` group. |
| `boxEncryptionKey` | `BOX_ENCRYPTION_KEY` | `""` | `box` | **Exactly 64 hex characters.** Encrypts secrets in Box's database. Generate with `openssl rand -hex 32` and never change it. |
| `dbHost` / `dbPort` / `boxDbName` / `dbSslMode` | `DB_HOST` / `DB_PORT` / `BOX_DB_NAME` / `DB_SSLMODE` | `""` / `"5432"` / `box_production` / `disable` | | Box's PostgreSQL database. |
| `dbUsername` / `dbPassword` | `DB_USERNAME` / `DB_PASSWORD` | `""` | `box` | Box database credentials. |
| `boxK8sNamespace` | `BOX_K8S_NAMESPACE` | `box-sandboxes` | | Namespace for sandbox pods. Created by the chart. |
| `boxReleasesNamespace` | `BOX_RELEASES_NAMESPACE` | `box-releases` | | Namespace for released apps. **Not created by the chart yet.** |
| `boxIngressDomain` | `BOX_INGRESS_DOMAIN` | `""` | | Base domain for sandbox and release URLs. Needs wildcard DNS. |
| `boxIngressClass` | `BOX_INGRESS_CLASS` | `nginx` | | Ingress class for the Ingresses Box creates. |
| `boxIngressNamespace` | `BOX_INGRESS_NAMESPACE` | `ingress-nginx` | | Ingress controller namespace, which Box's network policies allow. |
| `boxStorageClass` | `BOX_STORAGE_CLASS` | `standard` | | StorageClass for sandbox volumes. |
| `boxSnapshotClass` | `BOX_SNAPSHOT_CLASS` | `csi-hostpath-snapclass` | | VolumeSnapshotClass for sandbox snapshots. |
| `boxPvcSize` | `BOX_PVC_SIZE` | `10Gi` | | Volume size for each sandbox. |
| `boxImagePullSecret` | `BOX_IMAGE_PULL_SECRET` | `""` | | Existing pull secret added to sandbox pods. |
| `boxSandboxBaseImage` | `BOX_SANDBOX_BASE_IMAGE` | `""` | | Image used when a request names none. |
| `boxDevCpuRequest` / `boxDevCpuLimit` | `BOX_DEV_CPU_*` | `"2000"` / `"4000"` | | Sandbox CPU, in millicores. |
| `boxDevMemoryRequestMb` / `boxDevMemoryLimitMb` | `BOX_DEV_MEMORY_*` | `"4096"` / `"6144"` | | Sandbox memory, in MB. |
| `boxReleaseCpuRequest` / `boxReleaseCpuLimit` | `BOX_RELEASE_CPU_*` | `"1000"` / `"2000"` | | Released-app CPU, in millicores. |
| `boxReleaseMemoryRequestMb` / `boxReleaseMemoryLimitMb` | `BOX_RELEASE_MEMORY_*` | `"1024"` / `"2048"` | | Released-app memory, in MB. |
| `boxSandboxPriorityClassName` / `boxReleasePriorityClassName` | n/a | `box-critical` | | PriorityClass for sandbox and release pods. |
| `boxReleaseReadyTimeout` | `BOX_RELEASE_READY_TIMEOUT` | `180s` | | How long to wait for a release to become ready. |
| `boxProvisioningTimeout` | `BOX_PROVISIONING_TIMEOUT` | `90s` | | How long to wait for a sandbox to provision. |
| `boxReaperInterval` | `BOX_REAPER_INTERVAL` | `60s` | | How often expired sandboxes are cleaned up. |
| `boxSnapshotMaxAgeHours` | `BOX_SNAPSHOT_MAX_AGE_HOURS` | `"0"` | | Minimum age before orphaned snapshots are deleted. `0` turns off the age check; Box's own default is `72`. |
| `boxStaleSecretMaxAge` | `BOX_STALE_SECRET_MAX_AGE` | `24h` | | Age at which unreferenced secrets are deleted. |
| `boxAdminEnabled` | `BOX_ADMIN_ENABLED` | `"true"` | | Serve Box's admin UI at `/admin` (log in with `boxApiKey`). The admin API stays on either way. |
| `boxLogLevel` | `BOX_LOG_LEVEL` | `info` | | Log level. |
| `boxDbMaxOpenConns` / `boxDbMaxIdleConns` / `boxDbConnMaxLifetime` | `BOX_DB_*` | `"25"` / `"10"` / `5m` | | Connection pool settings. |

Other `boxConfig` values (`boxAgentPort`, `boxVitePort`, `boxDefaultTimeout`, `boxDefaultIdleTimeout`, `boxDefaultCpu`, `boxDefaultMemoryMb`, `boxDeployDefaultTimeoutSecs`, `boxSnapshotFsDefaultTimeoutSecs`, `boxShutdownTimeout`, `boxReapSnapshotTimeout`, `boxReleaseStartupProbeFailureThreshold`) are internal tuning settings and rarely need changing.

| Value | Default | Description |
| - | - | - |
| `box.enabled` | `false` | Deploy Box. |
| `box.serviceAccount.annotations` | `{}` | Annotations for Box's own service account, such as an IRSA role. |
| `box.rbac.create` | `true` | Create Box's ClusterRole and RoleBinding. |
| `box.namespaces.create` | `true` | Create the sandbox namespace. |
| `box.priorityClass.create` | `true` | Create the `box-critical` PriorityClass. |

## Monitoring and analytics

`platformConfig`

| Value | Env var | Default | Secret group | Description |
| - | - | - | - | - |
| `appEnv` | `APP_ENV`, `APPSIGNAL_APP_ENV` | `community` | | Environment name reported to AppSignal. |
| `appRevision` | `APP_REVISION` | `unknown` | | Revision identifier for this deployment. |
| `appsignalPushApiKey` | `APPSIGNAL_PUSH_API_KEY` | `yourkey` | `app` | AppSignal API key for the server. |
| `viteAppsignalMonitoringKey` | `VITE_APPSIGNAL_MONITORING_KEY` | `yourkey` | | AppSignal frontend key. |
| `newRelicKey` | `NEW_RELIC_KEY` | `yourkey` | `app` | New Relic license key. |
| `prometheusMetricsUsername` / `Password` | `PROMETHEUS_METRICS_*` | `""` | `app` | Basic-auth credentials for the server's `/metrics`. If either is empty, `/metrics` is off. |
| `vitePublicPosthogKey` / `Host` | `VITE_PUBLIC_POSTHOG_*` | `""` | | PostHog key and host for UI analytics. |
| `track` | `TRACK` | `"no"` | | Set to `no` to turn off anonymous usage telemetry. |
| `enableGeoSubscriber` | `ENABLE_GEO_SUBSCRIBER` | `"false"` | | Turn on GeoIP lookup. Needs MaxMind credentials. |
| `maxmindAccountId` | `MAXMIND_ACCOUNT_ID` | `""` | | MaxMind account ID. |
| `maxmindLicenseKey` | `MAXMIND_LICENSE_KEY` | `""` | `app` | MaxMind license key. |
| `leadCaptureEnabled`, `hubspotApiKey`, `slackSignupChannelEmail` | `LEAD_CAPTURE_ENABLED`, `HUBSPOT_API_KEY`, `SLACK_SIGNUP_CHANNEL_EMAIL` | `"false"`, `""`, `""` | `app` (`hubspotApiKey`) | Sign-up notifications used by AI Squared's hosted service. Leave these off. |

## Branding

`platformConfig`

| Value | Env var | Default | Description |
| - | - | - | - |
| `viteBrandName` | `VITE_BRAND_NAME` | `AI Squared` | Product name in the UI. |
| `viteLogoUrl` | `VITE_LOGO_URL` | `""` | Logo URL. |
| `viteFavIconUrl` | `VITE_FAV_ICON_URL` | `""` | Favicon URL. |
| `viteBrandColor` / `viteBrandHoverColor` | `VITE_BRAND_COLOR` / `VITE_BRAND_HOVER_COLOR` | `""` | Theme colors. |

## Data sync tuning and drivers

`platformConfig`

| Value | Env var | Default | Description |
| - | - | - | - |
| `syncExtractorBatchSize` | `SYNC_EXTRACTOR_BATCH_SIZE` | `"1000"` | Records read per batch. |
| `syncExtractorThreadPoolSize` | `SYNC_EXTRACTOR_THREAD_POOL_SIZE` | `"10"` | Extractor threads. |
| `syncLoaderBatchSize` | `SYNC_LOADER_BATCH_SIZE` | `"1000"` | Records written per batch. |
| `syncLoaderThreadPoolSize` | `SYNC_LOADER_THREAD_POOL_SIZE` | `"10"` | Loader threads. |
| `snowflakeDriverPath` | `SNOWFLAKE_DRIVER_PATH` | `/usr/lib/snowflake/odbc/lib/libSnowflake.so` | Snowflake ODBC driver path in the image. |
| `databricksDriverPath` | `DATABRICKS_DRIVER_PATH` | `/opt/simba/spark/lib/64/libsparkodbc_sb64.so` | Databricks ODBC driver path in the image. |
| `grpcEnableForkSupport` | `GRPC_ENABLE_FORK_SUPPORT` | `1` | gRPC fork support. Leave as is. |
| `railsEnv` | `RAILS_ENV` | `development` | Rails environment. |
| `railsLogLevel` | `RAILS_LOG_LEVEL` | `info` | Server log level. |

## Kubernetes and components

| Value | Default | Description |
| - | - | - |
| `nameOverride` | `""` | Prefix for resource names. Set it to `multiwoven` only when upgrading from the old chart. |
| `kubernetesNamespace` | `aisquared` | Namespace the chart creates and deploys into. |
| `kubernetesClusterDomain` | `cluster.local` | Cluster DNS domain. |
| `globalImagePullPolicy` | `IfNotPresent` | Image pull policy for all containers. |
| `platformConfig.privateRepo` | `false` | Use `registrySecretName` to pull images. |
| `platformConfig.registrySecretName` | `mwregistrysecret` | Image pull secret name. |
| `serviceAccount.create` | `false` | Create the platform service account. |
| `serviceAccount.name` | `aisquared-service-account` | Platform service account name. |
| `serviceAccount.annotations` | `{}` | Annotations for that service account, such as an IRSA role ARN. |
| `automountServiceAccountToken.enabled` | `true` | Mount service-account tokens into pods. |
| `securityContext.readOnlyRootFilesystem` | `false` | Run containers with a read-only root filesystem. |
| `pvc.pvc.storageRequest` | `100Mi` | Size of the in-cluster PostgreSQL volume. Increase this for real use. |
| `pvc.pvc.storageClassName` | `default` | StorageClass for that volume. |
| `hpa.enabled` | `true` | Create HorizontalPodAutoscalers. |
| `hpa.<component>.minReplicas` / `maxReplicas` | `1` / `10` | Autoscaling bounds for `server`, `ui`, `worker`, `solidWorker`, `lightning` and `box`. |
| `hpa.<component>.cpuAverageUtilizationPercentageThreshold` / `memoryAverageUtilizationPercentageThreshold` | varies | Scale-out thresholds, in percent. |

Each component (`server`, `ui`, `worker`, `solidWorker`, `lightning`, `box`, `postgresql`, `temporal`, `temporalUi`) supports:

| Value | Description |
| - | - |
| `<component>.enabled` | Deploy it. Applies to `postgresql`, `temporal`, `lightning` and `box`. |
| `<component>.replicas` | Replica count when HPA is off. |
| `<component>.annotations` | Extra pod annotations. |
| `<component>.<component>.image.repository` / `.tag` | Container image. |
| `<component>.<component>.resources` | CPU and memory requests and limits. |
| `<component>.type` | Service type. Default `ClusterIP`. |

For `secretsStore` settings, see [Secrets](/deployment-and-security/setup/helm#secrets).