Hosting settings
Information about Budibase hosting settings
You can run Budibase on your own infra using:
Every self-hosted Budibase platform comes by default with some settings which we recommend you familiarise yourself with as well as updating to suit your needs. All of these settings are passed to your cluster through the use of environment variables. In this section, we'll cover the purpose of each of these.
It should be noted that if you wish to modify any of these settings then you will need to restart your Budibase platform for it to recognise these new settings.
Rotating secrets
For single-image (runner.sh) deployments, you can rotate sensitive credentials by passing a new value as an environment variable when restarting the container. The runner detects if the runtime value differs from the previously persisted value in your .env file and will automatically update and persist the new secret. This applies to credentials such as COUCH_DB_USER, COUCH_DB_PASSWORD, MINIO_ACCESS_KEY, MINIO_SECRET_KEY, JWT_SECRET, and others.
Note that changing some of these settings may affect the user experience; for example, changing the JWT_SECRET will log everyone out.
The full set of variables can be found in our repo, in the file .env which should be included in your hosting solution:
| Variable | Description |
|---|---|
| HOSTING_KEY | To secure your app deployments we have introduced a key, which can be used to essentially password protect your Budibase platform. This means that only users with the key will be able to deploy from their builder. |
| JWT_SECRET | A secret used to secure the JSON Web Tokens (JWT) generated by the platform for user authentication. We recommend changing this to a UUID. |
| MINIO_ACCESS_KEY | The platform makes use of the open-source S3 alternative Minio for object storage, this specifies the access key used to secure the cluster. We recommend changing this. |
| MINIO_SECRET_KEY | This is another component used to secure Minio. We recommend changing this. |
| COUCH_DB_USER | The username used to secure your hosted CouchDB service. We recommend changing this. |
| COUCH_DB_PASSWORD | The password used to secure your hosted CouchDB service. We recommend changing this. |
| SESSION_EXPIRATION_SECONDS | The number of seconds an inactive user session will be kept alive before the user is logged out. The default is one week. |
| LOGIN_MAX_FAILED_ATTEMPTS | The number of consecutive failed login attempts allowed before an account (or email address) is temporarily locked. The default is 5. |
| LOGIN_LOCKOUT_SECONDS | The duration in seconds for which an account is locked after exceeding failed attempts. The default is 900 (15 minutes). |
| SQL_MAX_ROWS | By default the maximum number of rows returned by a SQL query is 5000, but you can use this variable to change that. Please note this limit includes any related rows returned, the total number of rows retrieved per query must be below this number. |
| HTTP_MB_LIMIT | The maximum file upload size in MB for attachments. The default is 20MB. |
| MAX_IMPORT_SIZE_MB | The default value for this variable is 100MB. You can increase it if you need to import an app export larger than 100MB. Additionally, this works alongside HTTP_MB_LIMIT to determine the maximum file upload size. If you need to allow uploads larger than 100MB, you must increase this variable as well. |
| AUTOMATION_MAX_LOG_SIZE_MB | The default valuable for this variable is 5MB. If an automation run's combined log output exceeds the configured value, the output will be removed. |
| BB_ADMIN_USER_EMAIL | If you have lost access to your self host installation, or wish to bring a new install online with a default administration account you can use this environment variable to configure their username. We recommend not leaving this set indefinitely, once the user has been created this should be removed. |
| BB_ADMIN_USER_PASSWORD | The password for the default administration account, used in conjunction with the BB_ADMIN_USER_EMAIL environment variable.We recommend not leaving this set indefinitely, once the user has been created this should be removed. |
| OIDC_ALLOW_UNVERIFIED_EMAIL_LINKING | A global override for OIDC email linking behavior. When set to 'true', Budibase will link SSO logins to existing local accounts even if the identity provider has not verified the email address. This overrides the per-provider setting in the UI. |
| SQL_LOGGING_ENABLE | This environment variable can be set on the apps service to log the queries that are being made to SQL databases. This can help diagnose if any issues are occurring. |
| API_REQ_LIMIT_PER_SEC | By default Budibase will limit the number of requests that can be made to the public API, this will be limited to 10 requests per second. This can be increased by setting this environment variable on the app service. |
| DISABLE_RATE_LIMITING | By default Budibase will protect its API from individual clients making too many requests and causing a degradation in performance for other users, this can be disabled via the app service with this environment variable. |
| PROXY_RATE_LIMIT_API_PER_SECOND | An advanced setting which can be set on the proxy service of Budibase, this defines the maximum requests per second that can be made to the API through the proxy - the default to 20. |
| PROXY_RATE_LIMIT_WEBHOOKS_PER_SECOND | Same as above setting, can be set on the proxy service, this defines how many automation webhook calls can be made per second - the default is 10. |
| QUERY_THREAD_TIMEOUT | Queries from the app service by default will timeout if they take more than 15000 milliseconds to complete. This environment variable can be set to a number of milliseconds to increase or decrease this timeout. |
| AUTOMATION_THREAD_TIMEOUT | Automation steps ran by the app service can take a maximum of 15000 milliseconds to complete before they will timeout. This environment variable can be set to increase or decrease this per step timeout. |
| PROXY_TIMEOUT_SECONDS | By setting PROXY_TIMEOUT_SECONDS, you can uniformly control how long Nginx will wait when:
|
| RESOLVER | The DNS resolver the internal nginx proxy uses to resolve upstreams. This MUST be an IP address. If left empty in the Helm chart, Budibase will attempt to auto-detect the kube-dns ClusterIP. |
| SMTP_USER | The username used to authenticate with the SMTP server. This environment variable is required for sending emails securely through the configured mail server. |
| SMTP_PASSWORD | The password associated with the SMTP user account. This environment variable is necessary for authenticating the connection to the mail server. |
| SMTP_HOST | The hostname or IP address of the SMTP server. This environment variable specifies the mail server used to send emails. |
| SMTP_PORT | The port number used to connect to the SMTP server. This environment variable defines the communication channel for the email service, typically 587 for TLS or 465 for SSL |
| SMTP_FROM_ADDRESS | The default email address that appears in the "From" field of emails sent by the application. This environment variable is used to specify the sender's identity in outbound emails. |
| SMTP_REJECT_UNAUTHORIZED | By default, Budibase verifies the TLS certificate of the SMTP server. If your mail server uses a self-signed certificate, you can set this variable to 'true' to disable certificate verification and allow unauthorized connections. |
| AUTOMATION_MAX_ITERATIONS | Allows you to override the default 200 iteration limit. |
| BLACKLIST_IPS | Controls which IP addresses/hostnames/CIDR subnets Budibase's outbound REST query integration is prevented from connecting to. This is an SSRF (Server-Side Request Forgery) protection mechanism. |
| BBAI_LITELLM_KEY | The virtual key used for Budibase AI services. This key is required for self-hosted agents to function correctly, particularly when executed within automations. Ensure this key is available to both the app service and the automation worker. |
Other settings in the file do not need to be changed but are simply provided in case you wish to change the port a service is made available on, we provide access to all the various services our cluster uses directly on a port number for administration purposes (e.g. logging into Fauxton on CouchDB).
Updated 23 days ago