Environment variables
JumpCLI uses environment variables to configure runtime behavior. Variable names may retain historical technical prefixes as a compatibility constraint; they do not represent public brand names.
Access and security
| Variable | Purpose |
|---|---|
ACCESS_KEY | Optional outer access gate; it does not replace account authentication |
ADMIN_KEY | Operator step-up verification key; it must differ from the access-gate key |
PUBLIC_ORIGIN | Public application origin used for cookie and CSRF constraints |
ALLOWED_HOSTS | Permitted Host request headers |
TRUSTED_PROXY_IPS | Proxy addresses permitted to supply trusted forwarding headers |
Upstream models
| Variable | Purpose |
|---|---|
DEFAULT_API_URL | Upstream API base address |
DEFAULT_API_KEY | Upstream key or server-side secret reference |
DEFAULT_API_PATH | Permitted default endpoint path |
UPSTREAM_HOST_ALLOWLIST | Allowlist of upstream addresses |
Job queue and concurrency
| Variable | Purpose |
|---|---|
PLATFORM_MAX_ACTIVE_IMAGE_UNITS | Process-wide active upstream image-call cap (default 4). Restart-required. |
TENANT_MAX_ACTIVE_IMAGE_UNITS | One organization's active unit cap (default 2). Restart-required. |
ACCOUNT_MAX_ACTIVE_IMAGE_UNITS | One account's active unit cap (default 1). Restart-required. |
PLATFORM_MAX_QUEUED_IMAGE_UNITS | Process-wide accepted queue cap (default 60). Restart-required. |
TENANT_MAX_QUEUED_IMAGE_UNITS | One organization's queue cap (default 10). Restart-required. |
ACCOUNT_MAX_QUEUED_IMAGE_UNITS | One account's queue cap (default 5). Restart-required. |
UPSTREAM_MAX_ACTIVE_IMAGE_UNITS | Concurrent units for one normalized upstream host/preset (default 4). Restart-required. |
MODEL_MAX_ACTIVE_IMAGE_UNITS | Concurrent units for one model (default 3). Restart-required. |
MAX_ACTIVE_GENERATE_JOBS | One-release tenant compatibility alias for TENANT_MAX_ACTIVE_IMAGE_UNITS (default 2). Restart-required. |
MAX_QUEUED_GENERATE_JOBS | One-release tenant compatibility alias for TENANT_MAX_QUEUED_IMAGE_UNITS (default 20). Restart-required. |
GENERATE_SOURCE_ATTEMPTS | Generation/edit submissions per source IP per 15 minutes (default 120). Overall Config hot-reloadable. |
MAX_SSE_SUBSCRIBERS_GLOBAL | Global SSE slot limit (default 200). Overall Config hot-reloadable; updates apply to subsequent connections. |
MAX_SSE_SUBSCRIBERS_PER_IP | Per-IP SSE slot limit (default 40), including reconnect headroom for about ten users behind one NAT. Overall Config hot-reloadable; updates apply to subsequent connections. |
SSE_CONNECTION_TTL_SECONDS | Maximum SSE connection lifetime (default 3600 seconds). Overall Config hot-reloadable; updates apply to subsequent connections. |
GRANIAN_WORKERS | Hard production invariant: 1. |
The eight canonical queue and concurrency settings are restart-required. n counts image units, not parent HTTP requests. Four platform execution slots serve about ten simultaneous submitters while the durable queue absorbs the remaining work up to 60 units. The three SSE settings and source submission limit are hot-reloadable through Overall Config. Startup rebuilds queued work, preserves fair FIFO order, and retains idempotency receipts for 30 days independently of visible task history. Capacity exhaustion returns 429 with Retry-After. Scaling beyond one worker requires an external shared queue/coordinator and a shared data layer that is not SQLite.
Integration services
| Variable group | Purpose |
|---|---|
CASDOOR_* | OIDC, public authentication origins, allowlists, and key references |
METEROID_* | Billing service addresses, credentials, allowlists, and timeouts |
BILLING_* | Billing delivery, fulfillment, and capacity control |
TUSAAS_MAINTENANCE_ROOT | Protected maintenance-log root directory under a historical compatibility name |
For complete fields, use the .env.example and configuration reference published with the current application version. Back up changes and validate them in a controlled environment before applying them; never commit secret variables to Git.