Configuration
| Env var | Default |
|---|---|
MDM_LAKE_URI | s3://lake (or a local folder without spaces) |
MDM_S3_ENDPOINT | http://localhost:9000 |
MDM_S3_ACCESS_KEY / MDM_S3_SECRET_KEY | minioadmin / minioadmin |
MDM_DATABASE_URL | postgresql://mdm:mdm@localhost:5432/mdm (Docker: the bundled postgres service) |
POSTGRES_USER / POSTGRES_PASSWORD / POSTGRES_DB | mdm / mdm / mdm, for the bundled PostgreSQL |
MDM_DB_PATH | mdm_meta.db in the project folder (Docker: /data/mdm_meta.db): mdm-secret.key is kept next to it, and a SQLite database found there is imported once |
MDM_LAKE_REFRESH_SECONDS | 2: how often a cached table checks storage for commits made by other tools |
MDM_API_URL / MDM_API_KEY | used by the CLI and SDK |
MDM_PUBLIC_URL | http://localhost:8000, where people open the app (SSO redirect, secure cookies on https) |
MDM_SESSION_HOURS | 12 |
MDM_DB_POOL_SIZE | 10 (most PostgreSQL connections the app holds at once) |
MDM_PASSWORD_LOGIN | true; set false to allow single sign-on only |
MDM_OIDC_ISSUER | e.g. https://login.microsoftonline.com/<tenant-id>/v2.0 (SSO is off when empty) |
MDM_OIDC_CLIENT_ID / MDM_OIDC_CLIENT_SECRET | from your identity provider's app registration |
MDM_OIDC_NAME | button label, e.g. Microsoft |
MDM_OIDC_AUTO_CREATE | false |
MDM_LOG_FORMAT | json (or text) |
MDM_METRICS_TOKEN | required bearer token for /metrics; when empty, /metrics is off if MDM_ENVIRONMENT=production (open otherwise) |
MDM_SENTRY_DSN / MDM_SENTRY_TRACES / MDM_ENVIRONMENT | error tracking (off when empty) / share of requests traced (0) / production |
MDM_RATE_LIMIT / MDM_LOGIN_RATE_LIMIT | 1200 requests per minute per person / 20 sign-in attempts per minute per address |
MDM_SECRET_KEY_PREVIOUS | during key rotation: the old passphrase(s), comma separated |
MDM_MAX_UPLOAD_MB | 50: larger requests and files are refused |
MDM_ALLOW_PRIVATE_URLS | false: webhooks can't point at private, loopback or cloud-metadata addresses |
FORWARDED_ALLOW_IPS | 127.0.0.1: the reverse proxy's address or network, so the app sees each client's real address |
Moving to AWS S3 is a config change (MDM_LAKE_URI=s3://your-bucket, MDM_S3_ENDPOINT= empty; leave the keys empty to use the server's IAM role), as deploy/aws does. Azure/GCS need their own storage_options keys in mdm_core/config.py.