Skip to main content

Runtime configuration

MimirQ reads process environment variables and the repository-root .env through Pydantic Settings. The authoritative definitions are .env.example and app/core/config.py.

make init creates only missing .env / web/.env.local files and generates SECRET_KEY plus MARKDOWN_IMAGE_PROXY_SECRET. It does not overwrite existing values.

Minimum real-model path

LLM_API_KEY=<your-siliconflow-api-key>
VariableDefault / fallbackPurpose
LLM_API_BASEhttps://api.siliconflow.cn/v1OpenAI-compatible LLM base URL
LLM_MODELQwen/Qwen3-32BMain chat model
EMBEDDING_PROVIDERopenai_compatibleEmbedding implementation
EMBEDDING_MODELBAAI/bge-m3Default embedding model
EMBEDDING_API_KEYReuses LLM_API_KEY when emptySet for a separate service
EMBEDDING_API_BASEReuses LLM_API_BASE when emptySet for a separate service
ENABLE_RERANKERfalseEnables reranking when true
RERANKER_MODELBAAI/bge-reranker-v2-m3Default reranker model
RERANKER_API_KEYReuses LLM_API_KEY when emptyMay share LLM credentials
RERANKER_API_BASEhttps://api.siliconflow.cn/v1/rerankComplete rerank request endpoint

See Quick Start for separate-service examples. Reindex existing knowledge bases after changing the embedding model, provider, or dimension.

Authentication and initial owner

AUTH_MODE defaults to jwt; header is only for controlled local debugging and is rejected in production. make init generates SECRET_KEY.

For unattended bootstrap, set INITIAL_ADMIN_EMAIL, INITIAL_ADMIN_USERNAME, and exactly one of INITIAL_ADMIN_PASSWORD or INITIAL_ADMIN_PASSWORD_FILE. Every initial replica must use identical values; remove them everywhere after bootstrap. INITIAL_REGISTRATION_TOKEN remains an optional protected manual-registration fallback.

Host and Docker dependency variables

DependencyHost processCompose container
PostgreSQLDATABASE_URLComposed from POSTGRES_USER, POSTGRES_PASSWORD, and POSTGRES_DB
RedisREDIS_URLREDIS_URL_DOCKER
MilvusMILVUS_HOST / MILVUS_PORTMILVUS_HOST_DOCKER / MILVUS_PORT_DOCKER
MinIOMINIO_*MINIO_*_DOCKER
Task queueTASK_QUEUE_ENABLEDTASK_QUEUE_ENABLED_DOCKER

Host mode defaults to TASK_QUEUE_ENABLED=false and handles bounded background work in the API process. Setting it to true requires make worker; Docker enables the queue and starts the worker by default. Do not expose Docker-internal service names to browsers or host processes.

Frontend variables

NEXT_PUBLIC_API_URL is the host/browser backend URL. Docker Web normally uses same-origin NEXT_PUBLIC_API_URL_DOCKER=/, while SSR uses API_INTERNAL_URL_DOCKER. Every NEXT_PUBLIC_* value is public client-side configuration: never place secrets there, and rebuild production frontend images after changing it.

Backend .env values are loaded when API/worker processes start. The web Settings API manages only explicitly supported business settings and does not override arbitrary environment variables. Changing SECRET_KEY invalidates existing local JWTs.

Use Docker Secrets, Kubernetes Secrets, or an external secret manager for production database credentials, object-store credentials, model keys, and administrator passwords.

Related: Quick Start · Deployment · Health checks