Every TMI configuration key, grouped by category. See [[Configuration-Model]] for what the categories and columns mean.
A setting's value can come from a YAML config file, an environment variable, or a row in the system_settings database table. Only one source wins:
| config explicit? | DB row explicit? | winner |
|---|---|---|
| no | no | database |
| no | yes | database |
| yes | no | config/env |
| yes | yes | database |
"Config explicit" means an operator actually supplied the value — the environment variable is set, or the key is written into the YAML file — as opposed to the value being the struct default every key carries. "DB explicit" means the row was deliberately set through the admin API or a dbtool --import-config run, as opposed to having been seeded with a registry default the first time the server started.
Bootstrap settings are never database-backed: config/env is their only source, and the table above does not apply to them. Operational settings follow the table above — the database wins whenever either side is silent (the common case, since it is hot-reloadable), and config/env wins only when an operator has explicitly set it while the database row is still at its seeded default.
Exception: auth.oauth.providers.* (and the analogous auth.saml.providers.* and content_oauth.providers.*) is a keyed collection, not a scalar, so the table above doesn't apply to it directly. It merges per provider ID instead: a config/env entry shadows a database entry with the same ID, and the database contributes any IDs that config does not define.
File/env only, read once at startup. Cannot come from the database.
| Key | Env var | Type | Default | Required | Secret | Precedence | Description |
|---|---|---|---|---|---|---|---|
alerting.enabled |
TMI_ALERTING_ENABLED |
bool | false |
no | no | config/env only | Enable the operator-pinned audit alert sink webhook subscription (#395) |
alerting.webhook_secret |
TMI_ALERTING_WEBHOOK_SECRET |
string | (secret) | no | yes | config/env only | HMAC signing secret for the audit alert sink webhook (#395) |
alerting.webhook_url |
TMI_ALERTING_WEBHOOK_URL |
string | (none) | no | no | config/env only | URL of the audit alert sink webhook endpoint (#395) |
auth.build_mode |
TMI_BUILD_MODE |
string | (none) | yes | no | config/env only | Build mode (dev, test, production) |
auth.jwt.secret |
TMI_JWT_SECRET |
string | (secret) | yes | yes | config/env only | JWT signing secret |
auth.jwt.signing_method |
TMI_JWT_SIGNING_METHOD |
string | HS256 |
no | no | config/env only | JWT signing method |
content_token_encryption_key |
TMI_CONTENT_TOKEN_ENCRYPTION_KEY |
string | (secret) | no | yes | config/env only | Encryption key used to encrypt content provider OAuth tokens at rest |
database.connection_pool.conn_max_idle_time |
TMI_DB_CONN_MAX_IDLE_TIME |
int | 30 |
no | no | config/env only | Max connection idle time in seconds |
database.connection_pool.conn_max_lifetime |
TMI_DB_CONN_MAX_LIFETIME |
int | 240 |
no | no | config/env only | Max connection lifetime in seconds |
database.connection_pool.max_idle_conns |
TMI_DB_MAX_IDLE_CONNS |
int | 2 |
no | no | config/env only | Maximum idle database connections |
database.connection_pool.max_open_conns |
TMI_DB_MAX_OPEN_CONNS |
int | 10 |
no | no | config/env only | Maximum open database connections |
database.oracle_wallet_location |
TMI_ORACLE_WALLET_LOCATION |
string | (none) | no | no | config/env only | Path to Oracle wallet directory (Oracle ADB only) |
database.redis.db |
TMI_REDIS_DB |
int | 0 |
no | no | config/env only | Redis database number |
database.redis.host |
TMI_REDIS_HOST |
string | localhost |
no | no | config/env only | Redis host |
database.redis.password |
TMI_REDIS_PASSWORD |
string | (secret) | no | yes | config/env only | Redis password |
database.redis.port |
TMI_REDIS_PORT |
string | 6379 |
no | no | config/env only | Redis port |
database.redis.url |
TMI_REDIS_URL |
string | (secret) | no | yes | config/env only | Redis connection URL (password redacted) |
database.url |
TMI_DATABASE_URL |
string | (secret) | yes | yes | config/env only | Database connection URL (password redacted) |
logging.also_log_to_console |
TMI_LOG_ALSO_LOG_TO_CONSOLE |
bool | true |
no | no | config/env only | Also log to console |
logging.cloud_error_threshold |
TMI_LOG_CLOUD_ERROR_THRESHOLD |
int | 5 |
no | no | config/env only | Cloud sink consecutive-failure threshold for one-shot Warn alarm (0 disables) |
logging.is_dev |
TMI_LOG_IS_DEV |
bool | true |
no | no | config/env only | Development mode logging |
logging.is_test |
TMI_LOG_IS_TEST |
bool | false |
no | no | config/env only | Test mode logging |
logging.level |
TMI_LOG_LEVEL |
string | info |
no | no | config/env only | Log level |
logging.log_api_requests |
TMI_LOG_API_REQUESTS |
bool | false |
no | no | config/env only | Log API requests |
logging.log_api_responses |
TMI_LOG_API_RESPONSES |
bool | false |
no | no | config/env only | Log API responses |
logging.log_dir |
TMI_LOG_DIR |
string | logs |
no | no | config/env only | Log directory |
logging.log_websocket_messages |
TMI_LOG_WEBSOCKET_MESSAGES |
bool | false |
no | no | config/env only | Log WebSocket messages |
logging.max_age_days |
TMI_LOG_MAX_AGE_DAYS |
int | 7 |
no | no | config/env only | Log max age in days |
logging.max_backups |
TMI_LOG_MAX_BACKUPS |
int | 10 |
no | no | config/env only | Log max backup count |
logging.max_size_mb |
TMI_LOG_MAX_SIZE_MB |
int | 100 |
no | no | config/env only | Log max size in MB |
logging.redact_auth_tokens |
TMI_LOG_REDACT_AUTH_TOKENS |
bool | false |
no | no | config/env only | Redact auth tokens in logs |
logging.suppress_unauthenticated_logs |
TMI_LOG_SUPPRESS_UNAUTH_LOGS |
bool | true |
no | no | config/env only | Suppress unauthenticated request logs |
secrets.aws_region |
TMI_AWS_REGION |
string | (none) | no | no | config/env only | AWS region |
secrets.aws_secret_name |
TMI_AWS_SECRET_NAME |
string | (none) | no | no | config/env only | AWS secret name |
secrets.azure_vault_url |
TMI_AZURE_VAULT_URL |
string | (none) | no | no | config/env only | Azure Key Vault URL |
secrets.gcp_project_id |
TMI_GCP_PROJECT_ID |
string | (none) | no | no | config/env only | GCP project ID |
secrets.gcp_secret_name |
TMI_GCP_SECRET_NAME |
string | (none) | no | no | config/env only | GCP secret name |
secrets.oci_compartment_id |
TMI_OCI_COMPARTMENT_ID |
string | (none) | no | no | config/env only | OCI compartment ID |
secrets.oci_secret_name |
TMI_OCI_SECRET_NAME |
string | (none) | no | no | config/env only | OCI secret name |
secrets.oci_vault_id |
TMI_OCI_VAULT_ID |
string | (none) | no | no | config/env only | OCI vault ID |
secrets.provider |
TMI_SECRETS_PROVIDER |
string | env |
no | no | config/env only | Secret provider type |
secrets.vault_address |
TMI_VAULT_ADDRESS |
string | (none) | no | no | config/env only | HashiCorp Vault address |
secrets.vault_path |
TMI_VAULT_PATH |
string | (none) | no | no | config/env only | HashiCorp Vault path |
secrets.vault_token |
TMI_VAULT_TOKEN |
string | (secret) | no | yes | config/env only | HashiCorp Vault token |
server.base_url |
TMI_SERVER_BASE_URL |
string | (none) | no | no | config/env only | Public base URL for callbacks |
server.cors.allowed_origins |
TMI_CORS_ALLOWED_ORIGINS |
json | null |
no | no | config/env only | CORS allowed origins |
server.http_to_https_redirect |
TMI_SERVER_HTTP_TO_HTTPS_REDIRECT |
bool | true |
no | no | config/env only | HTTP to HTTPS redirect |
server.idle_timeout |
TMI_SERVER_IDLE_TIMEOUT |
string | 1m0s |
no | no | config/env only | HTTP idle timeout |
server.interface |
TMI_SERVER_INTERFACE |
string | 0.0.0.0 |
yes | no | config/env only | Network interface to bind to |
server.port |
TMI_SERVER_PORT |
string | 8080 |
yes | no | config/env only | HTTP server port |
server.read_timeout |
TMI_SERVER_READ_TIMEOUT |
string | 5s |
no | no | config/env only | HTTP read timeout |
server.tls_cert_file |
TMI_SERVER_TLS_CERT_FILE |
string | (none) | no | no | config/env only | TLS certificate file path |
server.tls_enabled |
TMI_SERVER_TLS_ENABLED |
bool | false |
no | no | config/env only | TLS enabled |
server.tls_key_file |
TMI_SERVER_TLS_KEY_FILE |
string | (secret) | no | yes | config/env only | TLS key file path |
server.tls_subject_name |
TMI_SERVER_TLS_SUBJECT_NAME |
string | localhost |
no | no | config/env only | TLS certificate subject name |
server.trusted_proxies |
TMI_TRUSTED_PROXIES |
json | null |
no | no | config/env only | Comma-separated CIDRs/IPs for X-Forwarded-For trusted-proxy validation |
server.write_timeout |
TMI_SERVER_WRITE_TIMEOUT |
string | 10s |
no | no | config/env only | HTTP write timeout |
DB-backed, seeded from defaults on first run, editable at runtime via /admin/settings. A setting with an env var is Transitional: still config/env-eligible during migration (see [[Configuration-Model]]) — most operational settings have no env var at all, since they exist only in the database.
| Key | Env var | Type | Default | Mutability | Visibility | Secret | Precedence | Description |
|---|---|---|---|---|---|---|---|---|
administrators |
— | json | [] |
static | admin-only | no | db unless config explicit | Configured administrators |
auth.auto_promote_first_user |
TMI_AUTH_AUTO_PROMOTE_FIRST_USER |
bool | false |
static | admin-only | no | db unless config explicit | Auto-promote first user to admin |
auth.cookie.domain |
TMI_COOKIE_DOMAIN |
string | (none) | static | admin-only | no | db unless config explicit | Cookie domain |
auth.cookie.enabled |
TMI_COOKIE_ENABLED |
bool | true |
static | admin-only | no | db unless config explicit | HttpOnly cookie-based auth enabled |
auth.cookie.secure |
TMI_COOKIE_SECURE |
bool | false |
static | admin-only | no | db unless config explicit | Require HTTPS for cookies |
auth.everyone_is_a_reviewer |
TMI_AUTH_EVERYONE_IS_A_REVIEWER |
bool | false |
hot | admin-only | no | db unless config explicit | Auto-add all users to Security Reviewers group |
auth.jwt.expiration_seconds |
TMI_JWT_EXPIRATION_SECONDS |
int | 3600 |
static | admin-only | no | db unless config explicit | JWT token expiration in seconds |
auth.jwt.refresh_token_days |
TMI_REFRESH_TOKEN_DAYS |
int | 7 |
static | admin-only | no | db unless config explicit | Refresh token TTL in days |
auth.jwt.session_lifetime_days |
TMI_SESSION_LIFETIME_DAYS |
int | 7 |
static | admin-only | no | db unless config explicit | Absolute session lifetime in days |
auth.oauth.client_callback_allowlist |
TMI_OAUTH_CLIENT_CALLBACK_ALLOWLIST |
json | [] |
hot | admin-only | no | db unless config explicit | Allowlist of client_callback URLs for /oauth2/authorize and /oauth2/step_up (exact URL or wildcard pattern ending in '*') |
auth.oauth_callback_url |
TMI_OAUTH_CALLBACK_URL |
string | http://localhost:8080/oauth2/callback |
hot | admin-only | no | db unless config explicit | OAuth callback URL |
auth.step_up_window_seconds |
TMI_AUTH_STEP_UP_WINDOW_SECONDS |
int | 300 |
static | admin-only | no | db unless config explicit | Step-up auth_time freshness window in seconds for /admin/* writes (#355); minimum 60 |
content_extractors.compressed_size_bytes |
TMI_CONTENT_EXTRACTORS_COMPRESSED_SIZE_BYTES |
int | 20971520 |
static | admin-only | no | db unless config explicit | Max compressed upload size in bytes |
content_extractors.decompressed_size_bytes |
TMI_CONTENT_EXTRACTORS_DECOMPRESSED_SIZE_BYTES |
int | 52428800 |
static | admin-only | no | db unless config explicit | Max decompressed content size in bytes |
content_extractors.markdown_size_bytes |
TMI_CONTENT_EXTRACTORS_MARKDOWN_SIZE_BYTES |
int | 131072 |
static | admin-only | no | db unless config explicit | Max markdown output size in bytes |
content_extractors.part_size_bytes |
TMI_CONTENT_EXTRACTORS_PART_SIZE_BYTES |
int | 20971520 |
static | admin-only | no | db unless config explicit | Max size of a single archive part in bytes |
content_extractors.per_user_concurrency_default |
TMI_CONTENT_EXTRACTORS_PER_USER_CONCURRENCY_DEFAULT |
int | 2 |
static | admin-only | no | db unless config explicit | Default max concurrent extractions per user |
content_extractors.pptx_slides |
TMI_CONTENT_EXTRACTORS_PPTX_SLIDES |
int | 100 |
static | admin-only | no | db unless config explicit | Max number of PowerPoint slides to extract |
content_extractors.wall_clock_budget |
TMI_CONTENT_EXTRACTORS_WALL_CLOCK_BUDGET |
string | 30s |
static | admin-only | no | db unless config explicit | Max wall-clock time for a single extraction |
content_extractors.xlsx_cells |
TMI_CONTENT_EXTRACTORS_XLSX_CELLS |
int | 1000 |
static | admin-only | no | db unless config explicit | Max number of Excel cells to extract |
content_oauth.callback_url |
TMI_CONTENT_OAUTH_CALLBACK_URL |
string | (none) | static | admin-only | no | db unless config explicit | Content OAuth callback URL |
content_sources.confluence.enabled |
TMI_CONTENT_SOURCE_CONFLUENCE_ENABLED |
bool | false |
static | admin-only | no | db unless config explicit | Confluence content source enabled |
content_sources.google_drive.browser_oauth_client_id |
TMI_CONTENT_SOURCE_GOOGLE_DRIVE_BROWSER_OAUTH_CLIENT_ID |
string | (none) | static | admin-only | no | db unless config explicit | Google Drive browser OAuth client ID (public) |
content_sources.google_drive.credentials_file |
TMI_CONTENT_SOURCE_GOOGLE_DRIVE_CREDENTIALS_FILE |
string | (none) | static | admin-only | no | db unless config explicit | Google Drive service account credentials file path |
content_sources.google_drive.enabled |
TMI_CONTENT_SOURCE_GOOGLE_DRIVE_ENABLED |
bool | false |
static | admin-only | no | db unless config explicit | Google Drive content source enabled |
content_sources.google_drive.picker_app_id |
TMI_CONTENT_SOURCE_GOOGLE_DRIVE_PICKER_APP_ID |
string | (none) | static | admin-only | no | db unless config explicit | Google Drive Picker app ID (public) |
content_sources.google_drive.picker_developer_key |
TMI_CONTENT_SOURCE_GOOGLE_DRIVE_PICKER_DEVELOPER_KEY |
string | (none) | static | admin-only | no | db unless config explicit | Google Drive Picker developer key (public) |
content_sources.google_drive.service_account_email |
TMI_CONTENT_SOURCE_GOOGLE_DRIVE_SERVICE_ACCOUNT_EMAIL |
string | (none) | static | admin-only | no | db unless config explicit | Google Drive service account email |
content_sources.google_workspace.enabled |
TMI_CONTENT_SOURCE_GOOGLE_WORKSPACE_ENABLED |
bool | false |
static | admin-only | no | db unless config explicit | Google Workspace content source enabled |
content_sources.google_workspace.picker_app_id |
TMI_CONTENT_SOURCE_GOOGLE_WORKSPACE_PICKER_APP_ID |
string | (none) | static | admin-only | no | db unless config explicit | Google Workspace Picker app ID (public) |
content_sources.google_workspace.picker_developer_key |
TMI_CONTENT_SOURCE_GOOGLE_WORKSPACE_PICKER_DEVELOPER_KEY |
string | (none) | static | admin-only | no | db unless config explicit | Google Workspace Picker developer key (public) |
content_sources.microsoft.application_object_id |
TMI_CONTENT_SOURCE_MICROSOFT_APPLICATION_OBJECT_ID |
string | (none) | static | admin-only | no | db unless config explicit | Microsoft Entra application object ID |
content_sources.microsoft.client_id |
TMI_CONTENT_SOURCE_MICROSOFT_CLIENT_ID |
string | (none) | static | admin-only | no | db unless config explicit | Microsoft Entra app client ID (public) |
content_sources.microsoft.enabled |
TMI_CONTENT_SOURCE_MICROSOFT_ENABLED |
bool | false |
static | admin-only | no | db unless config explicit | Microsoft content source enabled |
content_sources.microsoft.picker_origin |
TMI_CONTENT_SOURCE_MICROSOFT_PICKER_ORIGIN |
string | (none) | static | admin-only | no | db unless config explicit | Microsoft Picker allowed origin URL |
content_sources.microsoft.tenant_id |
TMI_CONTENT_SOURCE_MICROSOFT_TENANT_ID |
string | (none) | static | admin-only | no | db unless config explicit | Microsoft Entra tenant ID |
extraction.async_enabled |
TMI_EXTRACTION_ASYNC_ENABLED |
bool | false |
hot | admin-only | no | db unless config explicit | Route document extraction through the async worker pipeline instead of inline (default false; requires NATS) |
features.saml_enabled |
TMI_SAML_ENABLED |
bool | false |
static | public | no | db unless config explicit | Enable SAML authentication |
observability.enabled |
TMI_OTEL_ENABLED |
bool | false |
static | admin-only | no | db unless config explicit | OpenTelemetry tracing enabled |
observability.prometheus_port |
TMI_OTEL_PROMETHEUS_PORT |
int | 0 |
static | admin-only | no | db unless config explicit | Prometheus metrics port (0 = disabled) |
observability.sampling_rate |
TMI_OTEL_SAMPLING_RATE |
float | 1 |
static | admin-only | no | db unless config explicit | OpenTelemetry trace sampling rate (0.0–1.0) |
operator.contact |
TMI_OPERATOR_CONTACT |
string | (none) | hot | public | no | db unless config explicit | Operator contact information |
operator.jurisdiction |
TMI_OPERATOR_JURISDICTION |
string | (none) | hot | public | no | db unless config explicit | Legal jurisdiction under which the service operates |
operator.name |
TMI_OPERATOR_NAME |
string | (none) | hot | public | no | db unless config explicit | Operator/maintainer name |
server.disable_rate_limiting |
TMI_DISABLE_RATE_LIMITING |
bool | false |
static | admin-only | no | db unless config explicit | Disable all rate limiting (dev/test only) |
server.ratelimit_public_rpm |
TMI_RATELIMIT_PUBLIC_RPM |
int | 0 |
static | admin-only | no | db unless config explicit | Requests per minute per IP for public endpoints |
server.require_if_match |
TMI_REQUIRE_IF_MATCH |
bool | false |
static | admin-only | no | db unless config explicit | Return 428 when If-Match header is missing on PUT/PATCH |
session.timeout_minutes |
TMI_JWT_EXPIRATION_SECONDS |
int | 60 |
static | admin-only | no | db unless config explicit | JWT token expiration in minutes |
ssrf.document_uri.allowlist |
— | string | (none) | static | admin-only | no | db unless config explicit | SSRF allowlist for ssrf.document_uri (comma-separated host patterns) |
ssrf.document_uri.schemes |
— | string | (none) | static | admin-only | no | db unless config explicit | Permitted URI schemes for ssrf.document_uri (comma-separated, e.g. https) |
ssrf.issue_uri.allowlist |
— | string | (none) | static | admin-only | no | db unless config explicit | SSRF allowlist for ssrf.issue_uri (comma-separated host patterns) |
ssrf.issue_uri.schemes |
— | string | (none) | static | admin-only | no | db unless config explicit | Permitted URI schemes for ssrf.issue_uri (comma-separated, e.g. https) |
ssrf.repository_uri.allowlist |
— | string | (none) | static | admin-only | no | db unless config explicit | SSRF allowlist for ssrf.repository_uri (comma-separated host patterns) |
ssrf.repository_uri.schemes |
— | string | (none) | static | admin-only | no | db unless config explicit | Permitted URI schemes for ssrf.repository_uri (comma-separated, e.g. https) |
ssrf.timmy.allowlist |
— | string | (none) | static | admin-only | no | db unless config explicit | SSRF allowlist for ssrf.timmy (comma-separated host patterns) |
ssrf.timmy.schemes |
— | string | (none) | static | admin-only | no | db unless config explicit | Permitted URI schemes for ssrf.timmy (comma-separated, e.g. https) |
ssrf.webhook.allowlist |
— | string | (none) | static | admin-only | no | db unless config explicit | SSRF allowlist for ssrf.webhook (comma-separated host patterns) |
ssrf.webhook.schemes |
— | string | (none) | static | admin-only | no | db unless config explicit | Permitted URI schemes for ssrf.webhook (comma-separated, e.g. https) |
timmy.chunk_overlap |
TMI_TIMMY_CHUNK_OVERLAP |
int | 50 |
static | admin-only | no | db unless config explicit | Embedding chunk overlap |
timmy.chunk_size |
TMI_TIMMY_CHUNK_SIZE |
int | 512 |
static | admin-only | no | db unless config explicit | Embedding chunk size |
timmy.code_embedding_api_key |
TMI_TIMMY_CODE_EMBEDDING_API_KEY |
string | (secret) | static | admin-only | yes | db unless config explicit | Code embedding API key |
timmy.code_embedding_base_url |
TMI_TIMMY_CODE_EMBEDDING_BASE_URL |
string | (none) | static | admin-only | no | db unless config explicit | Code embedding API base URL |
timmy.code_embedding_model |
TMI_TIMMY_CODE_EMBEDDING_MODEL |
string | (none) | static | admin-only | no | db unless config explicit | Code embedding model |
timmy.code_embedding_provider |
TMI_TIMMY_CODE_EMBEDDING_PROVIDER |
string | (none) | static | admin-only | no | db unless config explicit | Code embedding provider |
timmy.code_retrieval_top_k |
TMI_TIMMY_CODE_RETRIEVAL_TOP_K |
int | 10 |
static | admin-only | no | db unless config explicit | Code retrieval top-k results |
timmy.dump_extracted_text_to_note |
TMI_TIMMY_DUMP_EXTRACTED_TEXT_TO_NOTE |
bool | false |
static | admin-only | no | db unless config explicit | Dump extracted text to note (dev/test only) |
timmy.embedding_cleanup_interval_minutes |
TMI_TIMMY_EMBEDDING_CLEANUP_INTERVAL_MINUTES |
int | 60 |
static | admin-only | no | db unless config explicit | Embedding cleanup interval in minutes |
timmy.embedding_dimension |
TMI_TIMMY_EMBEDDING_DIMENSION |
int | 0 |
static | admin-only | no | db unless config explicit | Text embedding vector dimension — shared invariant |
timmy.embedding_idle_days_active |
TMI_TIMMY_EMBEDDING_IDLE_DAYS_ACTIVE |
int | 30 |
static | admin-only | no | db unless config explicit | Days before idle active-TM embeddings are cleaned up |
timmy.embedding_idle_days_closed |
TMI_TIMMY_EMBEDDING_IDLE_DAYS_CLOSED |
int | 7 |
static | admin-only | no | db unless config explicit | Days before idle closed-TM embeddings are cleaned up |
timmy.enabled |
TMI_TIMMY_ENABLED |
bool | false |
hot | admin-only | no | db unless config explicit | Timmy AI assistant enabled |
timmy.inactivity_timeout_seconds |
TMI_TIMMY_INACTIVITY_TIMEOUT_SECONDS |
int | 3600 |
static | admin-only | no | db unless config explicit | Session inactivity timeout in seconds |
timmy.llm_api_key |
TMI_TIMMY_LLM_API_KEY |
string | (secret) | static | admin-only | yes | db unless config explicit | LLM API key |
timmy.llm_base_url |
TMI_TIMMY_LLM_BASE_URL |
string | (none) | static | admin-only | no | db unless config explicit | LLM API base URL |
timmy.llm_max_tokens |
TMI_TIMMY_LLM_MAX_TOKENS |
int | 4096 |
static | admin-only | no | db unless config explicit | Max tokens per chat completion (required by Anthropic; optional for OpenAI) |
timmy.llm_model |
TMI_TIMMY_LLM_MODEL |
string | (none) | static | admin-only | no | db unless config explicit | LLM model |
timmy.llm_provider |
TMI_TIMMY_LLM_PROVIDER |
string | (none) | static | admin-only | no | db unless config explicit | LLM provider |
timmy.llm_timeout_seconds |
TMI_TIMMY_LLM_TIMEOUT_SECONDS |
int | 120 |
static | admin-only | no | db unless config explicit | LLM request timeout in seconds |
timmy.max_concurrent_llm_requests |
TMI_TIMMY_MAX_CONCURRENT_LLM_REQUESTS |
int | 10 |
static | admin-only | no | db unless config explicit | Max concurrent LLM requests |
timmy.max_conversation_history |
TMI_TIMMY_MAX_CONVERSATION_HISTORY |
int | 50 |
static | admin-only | no | db unless config explicit | Max conversation history entries |
timmy.max_memory_mb |
TMI_TIMMY_MAX_MEMORY_MB |
int | 256 |
static | admin-only | no | db unless config explicit | Max memory in MB |
timmy.max_messages_per_user_per_hour |
TMI_TIMMY_MAX_MESSAGES_PER_USER_PER_HOUR |
int | 60 |
static | admin-only | no | db unless config explicit | Max messages per user per hour |
timmy.max_sessions_per_threat_model |
TMI_TIMMY_MAX_SESSIONS_PER_THREAT_MODEL |
int | 50 |
static | admin-only | no | db unless config explicit | Max Timmy sessions per threat model |
timmy.operator_system_prompt |
TMI_TIMMY_OPERATOR_SYSTEM_PROMPT |
string | (none) | static | admin-only | no | db unless config explicit | Operator system prompt override |
timmy.query_decomposition_enabled |
TMI_TIMMY_QUERY_DECOMPOSITION_ENABLED |
bool | false |
static | admin-only | no | db unless config explicit | Query decomposition enabled |
timmy.rerank_api_key |
TMI_TIMMY_RERANK_API_KEY |
string | (secret) | static | admin-only | yes | db unless config explicit | Reranker API key |
timmy.rerank_base_url |
TMI_TIMMY_RERANK_BASE_URL |
string | (none) | static | admin-only | no | db unless config explicit | Reranker API base URL |
timmy.rerank_model |
TMI_TIMMY_RERANK_MODEL |
string | (none) | static | admin-only | no | db unless config explicit | Reranker model |
timmy.rerank_provider |
TMI_TIMMY_RERANK_PROVIDER |
string | (none) | static | admin-only | no | db unless config explicit | Reranker provider |
timmy.rerank_top_k |
TMI_TIMMY_RERANK_TOP_K |
int | 10 |
static | admin-only | no | db unless config explicit | Reranker top-k results |
timmy.text_embedding_api_key |
TMI_TIMMY_TEXT_EMBEDDING_API_KEY |
string | (secret) | static | admin-only | yes | db unless config explicit | Text embedding API key |
timmy.text_embedding_base_url |
TMI_TIMMY_TEXT_EMBEDDING_BASE_URL |
string | (none) | static | admin-only | no | db unless config explicit | Text embedding API base URL — shared invariant |
timmy.text_embedding_model |
TMI_TIMMY_TEXT_EMBEDDING_MODEL |
string | (none) | static | admin-only | no | db unless config explicit | Text embedding model — shared invariant between ingest and query |
timmy.text_embedding_provider |
TMI_TIMMY_TEXT_EMBEDDING_PROVIDER |
string | (none) | static | admin-only | no | db unless config explicit | Text embedding provider |
timmy.text_retrieval_top_k |
TMI_TIMMY_TEXT_RETRIEVAL_TOP_K |
int | 10 |
static | admin-only | no | db unless config explicit | Text retrieval top-k results |
webhooks.allow_http_targets |
TMI_WEBHOOK_ALLOW_HTTP_TARGETS |
bool | false |
static | admin-only | no | db unless config explicit | Allow non-HTTPS webhook target URLs (intra-cluster use only) |
websocket.inactivity_timeout_seconds |
TMI_WEBSOCKET_INACTIVITY_TIMEOUT_SECONDS |
int | 300 |
static | admin-only | no | db unless config explicit | WebSocket inactivity timeout in seconds |
Environment variables a TMI binary reads directly from its process environment, bypassing the config file, the settings registry above and the database. They have no dotted key and cannot be set through /admin/settings; they are listed here because this file is the complete TMI_* allowlist.
| Env var | Purpose | Secret |
|---|---|---|
TMI_ADMIN_PROVIDER |
Bootstrap administrator: identity provider. Setting it appends one entry to administrators at load time (internal/config) | no |
TMI_ADMIN_PROVIDER_ID |
Bootstrap administrator: the subject's provider id | no |
TMI_ADMIN_SUBJECT_TYPE |
Bootstrap administrator: subject type, user or group (default user) | no |
TMI_ADMIN_EMAIL |
Bootstrap administrator: email address | no |
TMI_ADMIN_GROUP_NAME |
Bootstrap administrator: group name when the subject type is group | no |
TMI_JWT_KEY_ID |
JWKS key id; falls back to JWT_KEY_ID, then 1. Read by auth/config.go rather than internal/config | no |
TMI_CLOUD_LOG_ENABLED |
Enable the cloud log writer when set to true | no |
TMI_CLOUD_LOG_PROVIDER |
Cloud log provider; only oci is supported | no |
TMI_CLOUD_LOG_LEVEL |
Minimum log level forwarded to the cloud log writer | no |
TMI_OCI_LOG_ID |
OCI Logging log OCID the cloud log writer sends to | no |
TMI_TEST_FORCE_AUTH_FLOW_RATE_LIMITING |
Test-only: force auth-flow rate limiting on. Honoured only when TMI_BUILD_MODE is test | no |
TMI_SSRF_ISSUE_URI_ALLOWLIST |
Env override of the ssrf.issue_uri.allowlist setting; read by cmd/server buildURIValidator at startup | no |
TMI_SSRF_ISSUE_URI_SCHEMES |
Env override of the ssrf.issue_uri.schemes setting; read by cmd/server buildURIValidator at startup | no |
TMI_SSRF_DOCUMENT_URI_ALLOWLIST |
Env override of the ssrf.document_uri.allowlist setting (also used for content OAuth); read by cmd/server buildURIValidator at startup | no |
TMI_SSRF_DOCUMENT_URI_SCHEMES |
Env override of the ssrf.document_uri.schemes setting; read by cmd/server buildURIValidator at startup | no |
TMI_SSRF_REPOSITORY_URI_ALLOWLIST |
Env override of the ssrf.repository_uri.allowlist setting; read by cmd/server buildURIValidator at startup | no |
TMI_SSRF_REPOSITORY_URI_SCHEMES |
Env override of the ssrf.repository_uri.schemes setting; read by cmd/server buildURIValidator at startup | no |
TMI_SSRF_TIMMY_ALLOWLIST |
Env override of the ssrf.timmy.allowlist setting; read by cmd/server buildURIValidator at startup | no |
TMI_SSRF_TIMMY_SCHEMES |
Env override of the ssrf.timmy.schemes setting; read by cmd/server buildURIValidator at startup | no |
TMI_SSRF_WEBHOOK_ALLOWLIST |
Env override of the ssrf.webhook.allowlist setting; read by cmd/server buildURIValidator at startup | no |
TMI_SSRF_WEBHOOK_SCHEMES |
Env override of the ssrf.webhook.schemes setting; read by cmd/server buildURIValidator at startup | no |
| Env var | Purpose | Secret |
|---|---|---|
TMI_NATS_URL |
NATS endpoint. Required by every worker; also read by the server (extraction wiring) and component-controller (JetStream provisioning) | no |
TMI_NATS_CREDS |
Path to a NATS credentials file used when connecting (the file is secret; the path is not) | no |
TMI_COMPONENT_NAME |
This worker's TMIComponent name; required by chunkembed, extractor and worker-probe | no |
TMI_HEARTBEAT_INTERVAL |
Worker heartbeat period as a Go duration (chunkembed, extractor) | no |
TMI_JOB_ACK_WAIT |
JetStream ack wait per job as a Go duration (chunkembed, extractor); also a TMIComponent spec.config key read by component-controller | no |
TMI_CONTENT_EXTRACTORS_WALL_CLOCK_BUDGET |
Extraction wall-clock cap read directly by the extractor worker; the same name is a registry setting for the server | no |
TMI_EMBEDDING_MODEL |
Embedding model name (chunkembed) | no |
TMI_EMBEDDING_BASE_URL |
Embedding API base URL (chunkembed) | no |
TMI_EMBEDDING_API_KEY |
Embedding API key (chunkembed) | yes |
TMI_WORKER_NATS_URL |
NATS URL for the worker bootstrap config; required (internal/config/bootstrap) | no |
TMI_WORKER_LOG_LEVEL |
Worker log level (internal/config/bootstrap) | no |
TMI_WORKER_HEARTBEAT_SUBJECT |
NATS subject worker heartbeats are published to (internal/config/bootstrap) | no |
The operator supplies the part in angle brackets.
| Pattern | Binary | Purpose | Secret |
|---|---|---|---|
TMI_SECRET_<KEY> |
server | Environment secrets provider: logical secret key, upper-cased, e.g. TMI_SECRET_JWT_SECRET or TMI_SECRET_SETTINGS_ENCRYPTION_KEY. Every value is a secret | yes |
TMI_WORKER_SECRET_MOUNT_<NAME> |
workers | Filesystem path to a mounted secret file, exposed to the worker under the logical name, e.g. TMI_WORKER_SECRET_MOUNT_EMBEDDING_API_KEY | no |
TMI_CONTENT_OAUTH_PROVIDERS_<ID>_<FIELD> |
server | Per-provider content OAuth config, discovered from the ENABLED suffix. FIELD is one of CLIENT_ID, CLIENT_SECRET (secret), AUTH_URL, TOKEN_URL, USERINFO_URL, REVOCATION_URL, REQUIRED_SCOPES | no |
SAML_PROVIDERS_<ID>_<FIELD> |
server | Per-provider SAML settings (ENTITY_ID, ACS_URL, SP_PRIVATE_KEY, ...) discovered from the ENABLED suffix; note the name has no TMI prefix. FIELD is a SAMLProviderConfig yaml key upper-cased, e.g. ENTITY_ID, ACS_URL, SP_PRIVATE_KEY (secret), IDP_METADATA_B64XML (secret) | no |