Environment Variables

EUDIPLO is configured primarily through environment variables. This page documents all available configuration options organized by functional area.

Quick Reference

The complete environment variable reference is organized into the following sections:

Authentication — OAuth client credentials and token validation
Configuration — File-based tenant configuration import
Cryptography — Key generation and cryptographic defaults
Database — Database connection and type selection
Encryption — At-rest encryption for database-backed keys
General — Public URL, CORS, and operational settings
Issuer — Credential issuance flow defaults
Logging — Log level and structured logging
Observability — OpenTelemetry tracing configuration
Session — Session cleanup and retention policies
Status — Status list configuration
Storage — File storage provider (local/S3)
Verifier — Presentation verification defaults
Webhook — Outbound webhook security policies

Authentication

Key	Type	Notes
`OIDC`	`string`	Enable OIDC mode
`OIDC_INTERNAL_ISSUER_URL`	`string`	Internal issuer URL in OIDC mode [when OIDC is set → then default=undefined]
`OIDC_CLIENT_ID`	`any`	Client ID for OIDC [when OIDC is set → then required]
`OIDC_CLIENT_SECRET`	`any`	Client secret for OIDC [when OIDC is set → then required]
`OIDC_SUB`	`any`	Claim to use as subject [when OIDC is set → then default="tenant_id"]
`OIDC_ALGORITHM`	`any`	Expected JWT alg [when OIDC is set → then default="RS256"]
`MASTER_SECRET`	`any`	Master secret for JWT signing and encryption key derivation - required, minimum 32 characters [when OIDC is set → otherwise required]
`JWT_ISSUER`	`any`	Local JWT issuer [when OIDC is set → otherwise default="eudiplo-service"]
`JWT_EXPIRES_IN`	`any`	Local JWT expiration [when OIDC is set → otherwise default="24h"]
`AUTH_CLIENT_SECRET`	`any`	Client secret (local auth). In OIDC mode, optional bootstrap secret used to create/update a Keycloak admin/root client when AUTH_CLIENT_ID is also set [when OIDC is set → otherwise required]
`AUTH_CLIENT_ID`	`any`	Client ID (local auth). In OIDC mode, optional bootstrap client ID used to create/update a Keycloak admin/root client when AUTH_CLIENT_SECRET is also set [when OIDC is set → otherwise required]
`OIDC_UI_CLIENT_ID`	`any`	Public client ID for the Angular UI in OIDC mode. Used to register a public Keycloak client for Authorization Code + PKCE login. [when OIDC is set → then default="eudiplo-ui"]

Configuration

Key	Type	Notes
`CONFIG_IMPORT_MODE`	`string`	Startup configuration reconciliation mode. Replaces CONFIG_IMPORT and CONFIG_IMPORT_FORCE.
`CONFIG_IMPORT`	`boolean`	Deprecated: enable startup config import when CONFIG_IMPORT_MODE is unset (default: `false`)
`CONFIG_IMPORT_FORCE`	`boolean`	Deprecated: select upsert instead of create when CONFIG_IMPORT_MODE is unset (default: `false`)
`CONFIG_FOLDER`	`string`	Path to config import folder (default: `/path/to/config/folder`)
`CONFIG_VARIABLE_STRICT`	`alternatives`	Strict mode for config import. (default: `skip`)

Cryptography

Key	Type	Notes
`CRYPTO_ALG`	`string`	The signing algorithm to use (default: `ES256`)
`CRYPTO_TOLERANCE`	`number`	Clock tolerance in seconds for JWT verification (default: `5`)

Database

Key	Type	Notes
`DB_TYPE`	`string`	Database type (default: `sqlite`)
`DB_HOST`	`string`	Database host [when DB_TYPE is {"override":true} \| "sqlite" → otherwise required]
`DB_PORT`	`number`	Database port [when DB_TYPE is {"override":true} \| "sqlite" → otherwise required]
`DB_USERNAME`	`string`	Database username [when DB_TYPE is {"override":true} \| "sqlite" → otherwise required]
`DB_PASSWORD`	`string`	Database password [when DB_TYPE is {"override":true} \| "sqlite" → otherwise required]
`DB_DATABASE`	`string`	Database name [when DB_TYPE is {"override":true} \| "sqlite" → otherwise required]
`DB_SSL`	`boolean`	Enable SSL/TLS for PostgreSQL database connections (default: `false`)
`DB_SSL_REJECT_UNAUTHORIZED`	`boolean`	Reject PostgreSQL TLS certificates that cannot be validated against trusted CAs (default: `true`)
`DB_SSL_CA_PATH`	`string`	Path to CA certificate file used to validate PostgreSQL TLS certificates [optional]
`DB_SSL_CERT_PATH`	`string`	Path to client certificate file for PostgreSQL TLS [optional]
`DB_SSL_KEY_PATH`	`string`	Path to client private key file for PostgreSQL TLS [optional]
`DB_SSL_KEY_PASSPHRASE`	`string`	Passphrase for encrypted DB_SSL_KEY_PATH private key [optional]
`DB_SYNCHRONIZE`	`boolean`	Enable TypeORM schema synchronization. Set to false in production after initial setup and rely on migrations instead. (default: `true`)
`DB_MIGRATIONS_RUN`	`boolean`	Run pending database migrations automatically on startup (default: `true`)

Encryption

Key	Type	Notes
`ENCRYPTION_KEY_SOURCE`	`string`	Source for encryption key: env (dev), vault/aws/azure (prod - key only in RAM) (default: `env`)
`VAULT_ENCRYPTION_KEY_PATH`	`string`	Path to encryption key in Vault KV secrets engine [when ENCRYPTION_KEY_SOURCE is {"override":true} \| "vault" → then default="secret/data/eudiplo/encryption-key"]
`AWS_ENCRYPTION_SECRET_NAME`	`string`	Name of the encryption key secret in AWS Secrets Manager [when ENCRYPTION_KEY_SOURCE is {"override":true} \| "aws" → then required]
`AWS_ENCRYPTION_SECRET_KEY`	`string`	JSON key within the AWS secret (if secret is JSON) [when ENCRYPTION_KEY_SOURCE is {"override":true} \| "aws" → then default="key"]
`AZURE_KEYVAULT_URL`	`string`	Azure Key Vault URL (e.g., https://myvault.vault.azure.net) [when ENCRYPTION_KEY_SOURCE is {"override":true} \| "azure" → then required]
`AZURE_ENCRYPTION_SECRET_NAME`	`string`	Name of the encryption key secret in Azure Key Vault [when ENCRYPTION_KEY_SOURCE is {"override":true} \| "azure" → then required]

General

Key	Type	Notes
`FOLDER`	`string`	Root working folder for temp files (default: `../../tmp`)
`PUBLIC_URL`	`string`	The public URL of the issuer (default: `http://localhost:3000`)

Issuer

Key	Type	Notes
`ISSUER_MULTI_CONSUMPTION`	`boolean`	Enable or disable multi-consumption for the issuer (default: `false`)

Logging

Key	Type	Notes
`LOG_LEVEL`	`string`	Application log level (default: `debug`)
`LOG_ENABLE_HTTP_LOGGER`	`boolean`	Enable HTTP request logging (default: `false`)
`LOG_HTTP_RESPONSE_BODY`	`boolean`	Capture and log HTTP response bodies (buffered up to LOG_HTTP_RESPONSE_BODY_MAX_LENGTH bytes). Disabled by default because response bodies may contain access tokens, credentials, or other sensitive data. (default: `false`)
`LOG_HTTP_RESPONSE_BODY_MAX_LENGTH`	`number`	Maximum number of bytes to capture for HTTP response bodies. Set to 0 to disable truncation. (default: `4096`)
`LOG_REDACT_SENSITIVE_DATA`	`boolean`	Redact sensitive request/response fields from logs. Disable only for debugging. (default: `true`)
`LOG_ENABLE_SESSION_LOGGER`	`boolean`	Enable session flow logging (default: `false`)
`LOG_SESSION_STORE`	`string`	Controls whether session log entries are persisted to the database. 'off' disables storage, 'errors' stores only warn/error entries, 'all' stores everything, 'verbose' stores everything including full request/response bodies and error stacks. (default: `off`)
`LOG_TO_FILE`	`boolean`	Enable logging to file in addition to console (default: `false`)
`LOG_FILE_PATH`	`string`	File path for log output when LOG_TO_FILE is enabled (default: `./logs/session.log`)
`AUDIT_LOG_RETENTION_DAYS`	`number`	Delete tenant activity audit log entries older than N days. Set to 0 to disable time-based pruning. (default: `0`)
`OTEL_SDK_DISABLED`	`boolean`	Disable OpenTelemetry SDK (and OTel log forwarding) (default: `false`)
`AUDIT_LOG_MAX_ENTRIES_PER_TENANT`	`number`	Keep only the newest N tenant activity audit log entries per tenant. Set to 0 to disable count-based pruning. (default: `0`)

Observability

Key	Type	Notes
`GRAFANA_URL`	`string`	Base URL of the Grafana instance for deep linking from the dashboard UI [optional]
`GRAFANA_DATASOURCE_TEMPO_UID`	`string`	UID of the Tempo data source in Grafana (default: `tempo`)
`GRAFANA_DATASOURCE_LOKI_UID`	`string`	UID of the Loki data source in Grafana (default: `loki`)

Session

Key	Type	Notes
`SESSION_TIDY_UP_INTERVAL`	`number`	Interval in seconds to run session tidy up (default: `3600`)
`SESSION_TTL`	`number`	Default time to live for sessions in seconds. Can be overridden per tenant. (default: `86400`)
`SESSION_CLEANUP_MODE`	`string`	Default cleanup mode when sessions expire. 'full' deletes the entire session, 'anonymize' keeps metadata but removes personal data. Can be overridden per tenant. (default: `full`)

Status

Key	Type	Notes
`STATUS_CAPACITY`	`number`	The default capacity of the status list. Can be overridden per tenant. (default: `10000`)
`STATUS_BITS`	`number`	The default number of bits used per status entry. Can be overridden per tenant. (default: `1`)
`STATUS_TTL`	`number`	The default TTL in seconds for status list JWTs. Verifiers can cache the JWT until expiration. Can be overridden per tenant. (default: `3600`)
`STATUS_IMMEDIATE_UPDATE`	`boolean`	If true, regenerate status list JWT immediately on every status change. If false (default), use lazy regeneration when TTL expires. Can be overridden per tenant. (default: `false`)
`STATUS_ENABLE_AGGREGATION`	`boolean`	If true (default), include aggregation_uri in status list JWTs. This allows relying parties to pre-fetch all status lists for offline validation per RFC draft-ietf-oauth-status-list Section 9. Can be overridden per tenant. (default: `true`)

Storage

Key	Type	Notes
`STORAGE_DRIVER`	`string`	The storage driver to use (default: `local`)
`LOCAL_STORAGE_DIR`	`string`	The directory to store files in when using local storage [when STORAGE_DRIVER is {"override":true} \| "local" → then default=undefined]
`S3_REGION`	`string`	The AWS region for the S3 bucket [when STORAGE_DRIVER is {"override":true} \| "s3" → then required]
`S3_BUCKET`	`string`	The name of the S3 bucket [when STORAGE_DRIVER is {"override":true} \| "s3" → then required]
`S3_ACCESS_KEY_ID`	`string`	The access key ID for the S3 bucket [when STORAGE_DRIVER is {"override":true} \| "s3" → then required]
`S3_SECRET_ACCESS_KEY`	`string`	The secret access key for the S3 bucket [when STORAGE_DRIVER is {"override":true} \| "s3" → then required]
`S3_ENDPOINT`	`string`	The endpoint URL for the S3 service (for S3-compatible services) [when STORAGE_DRIVER is {"override":true} \| "s3"]
`S3_FORCE_PATH_STYLE`	`boolean`	Whether to force path-style URLs for S3 [when STORAGE_DRIVER is {"override":true} \| "s3" → then default=false]

Verifier

Key	Type	Notes
`VP_REMOVE_TA`	`boolean`	If true, strip trusted_authorities from the DCQL query sent to wallets in OID4VP authorization requests. Use this as an escape hatch for wallets that do not yet handle trusted_authorities correctly. (default: `false`)

Webhook

Key	Type	Notes
`OUTBOUND_URL_ALLOW_HTTP`	`boolean`	Allow HTTP (non-TLS) for outbound webhook calls [optional]
`OUTBOUND_URL_ALLOW_PRIVATE_NETWORK`	`boolean`	Allow outbound webhook calls to private, loopback, or link-local IP ranges [optional]
`OUTBOUND_URL_ALLOWED_HOSTS`	`string`	Comma-separated hostname allowlist for outbound webhook calls (supports exact host and subdomains) [optional]

info

Key Management System (KMS) and Registrar provider settings are configured via JSON files (kms.json, registrar.json), not environment variables — see Key Management System (KMS) and Registrar.

Quick Reference​

Authentication​

Configuration​

Cryptography​

Database​

Encryption​

General​

Issuer​

Logging​

Observability​

Session​

Status​

Storage​

Verifier​

Webhook​