Configuration
tvaras is configured through two channels: environment variables in .env (static, set at startup) and the admin panel (dynamic, no restart required).
Environment Variables
These are set in the .env file on the host and read at container startup. Changes require a container restart.
Required
| Variable | Description |
|---|---|
APP_URL | Public URL of the bot (e.g. https://data-bot.acme.com) |
POSTGRES_PASSWORD | PostgreSQL password (auto-generated by bootstrap) |
JWT_SECRET | Session signing key (auto-generated) |
ADMIN_SECRET | Admin panel access key (auto-generated) |
ENTERPRISE_KEY | License key from tvaras.ai |
The Claude API key, Google OAuth client and company login domain are entered in the setup wizard and stored in the database; ANTHROPIC_API_KEY, OAUTH_GOOGLE_CLIENT_ID, OAUTH_GOOGLE_CLIENT_SECRET and PRIMARY_DOMAIN in .env remain supported for existing installations.
Optional
| Variable | Description | Default |
|---|---|---|
CLAUDE_MODEL | Default Claude model | claude-opus-4-6 |
REPO_ENCRYPTION_KEY | Fernet key for encrypting OAuth tokens and credentials (bootstrap generates one — back it up) | Temporary key, lost on restart |
GITHUB_CLIENT_ID | GitHub OAuth app for repository connections | — |
GITHUB_CLIENT_SECRET | GitHub OAuth secret | — |
GITLAB_CLIENT_ID | GitLab OAuth app | — |
GITLAB_CLIENT_SECRET | GitLab OAuth secret | — |
SLACK_BOT_TOKEN | Slack bot token (if not using OAuth) | — |
SLACK_SIGNING_SECRET | Slack signing secret | — |
DATA_EXPORT_API_KEY | API key for external data consumers | — |
Admin Panel Settings
These settings are stored in PostgreSQL and take precedence over environment variables. Changes apply immediately without a restart.
AI Settings
- Anthropic API Key — overrides the env var
- Model per role — assign different Claude models to chat, tasks, dashboards, etc.
Security Settings
- Allowed email domains — restrict login to specific domains
- Require approval — new users need admin approval before accessing the bot
- Allow all domains — disable domain restrictions
Feature Toggles
Enable or disable individual connectors (Google Ads, Slack, Jira, etc.) from the admin panel. Disabled connectors are hidden from the sidebar and their tools are not loaded.
dbt Configuration
- GCS bucket URL — sync dbt manifest/catalog from Google Cloud Storage
- Business context — custom documentation about your dbt layer naming conventions
Precedence Rules
When a setting exists in both .env and the admin panel, the admin panel always wins. Environment variables serve as fallbacks for initial setup or when the database is unavailable.
Admin Panel (DB) → Environment Variable → Default
Important Notes
REPO_ENCRYPTION_KEY— if not set, a temporary key is generated on each restart, meaning OAuth tokens and encrypted credentials are lost. Always set this in production.POSTGRES_PASSWORD— once PostgreSQL is initialized with a password, changing it in.envwill cause connection failures. To reset, delete thepostgres_datavolume.