Configuration

Configuration

🇪🇸 Español

Goliat reads its configuration from environment variables. Every variable is documented in .env.example. Locally, server/start-next.mjs loads .env before Next.js starts; in Azure, the deployment scripts set App Service settings and .env is never uploaded.

Never use the NEXT_PUBLIC_ prefix for credentials. Those values are embedded in the browser bundle.

Web

Variable	Description
PORT	HTTP port for dev and start (default 4000).
SITE_URL	Public base URL, used for metadata.
INVENTORY_REFRESH_TIMEOUT_MS	Maximum wait for a manual refresh. Default 120000, maximum 900000.
INVENTORY_TAG_KEYS	Tag keys for local Function collection, comma-separated. Empty detects all tags.

Logging

Variable	Values
LOG_ENABLED	true | false
LOG_LEVEL	info | warn | error
LOG_HTTP_ENABLED	true | false

Logs are JSON on stderr (Pino). Each API summary includes route, status, duration and a requestId, also returned as X-Request-ID. Bodies, cookies, tokens, query strings and SQL are never logged.

Authentication

Variable	Description
DASHBOARD_AUTH_ENABLED	true (default) requires a session for pages and data APIs.
DASHBOARD_AUTH_MODE	demo or azure-ad.
AUTH_SECRET	Session secret, at least 32 random bytes. Shared by all replicas.
AUTH_URL	Canonical origin, for example http://127.0.0.1:4000.
DASHBOARD_USERNAME, DASHBOARD_PASSWORD	Credentials for demo mode.
AUTH_MICROSOFT_ENTRA_ID_ID	Entra application (client) ID for azure-ad mode.
AUTH_MICROSOFT_ENTRA_ID_SECRET	Entra client secret.
AUTH_MICROSOFT_ENTRA_ID_ISSUER	https://login.microsoftonline.com/<tenant-id>/v2.0
DASHBOARD_ADMIN_OBJECT_IDS	Comma-separated object IDs of the initial Goliat administrators (azure-ad only).
DASHBOARD_MEMBERS_ENABLED	Enables the Members view (azure-ad only).

See Authentication and Roles.

PostgreSQL

Variable	Description
DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD	Connection used by the web and collectors (DML).
DB_POOL_SIZE	Pool size per process (default 5).
DB_QUERY_TIMEOUT_MS	Query timeout (default 60000).
DB_SSL	true verifies certificate and host name; false for local servers without TLS.
DB_SSL_CA_PATH	PEM file for a private CA. Empty uses the system CAs.
DB_MIGRATION_HOST, DB_MIGRATION_USER, DB_MIGRATION_PASSWORD	Optional DDL credentials for the migrator; empty reuses DB_*.
DB_MIGRATION_LOCK_TIMEOUT_MS, DB_MIGRATION_STATEMENT_TIMEOUT_MS	Migration limits (defaults 5 s and 15 min).

Size connections as replicas × (pool + 3) + collectors + migrator + margin: each web process adds up to three connections for manual refreshes.

Azure Storage (inventory source)

Variable	Description
AZURE_AUTH_MODE	default, client-secret or managed-identity.
AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET	Service principal for client-secret mode.
AZURE_STORAGE_ACCOUNT_URL	https://<account>.blob.core.windows.net
AZURE_STORAGE_CONTAINER	Default cloud-inventory.
AZURE_STORAGE_BLOB	Default azure/latest.json.
AZURE_MAX_OBJECT_MB	Maximum blob size to download (default 64).

The identity only needs blob read access.

Azure Function and Administration

Variable	Description
AZURE_FUNCTION_BASE_URL	Base URL of the collector Function.
AZURE_FUNCTION_SCOPE	api://<api-client-id>/.default; the caller needs the Inventory.Generate role.
AZURE_FUNCTION_RESOURCE_ID	ARM ID of the Function, used by Administration.
AZURE_POSTGRES_RESOURCE_ID	ARM ID of the PostgreSQL server for metric charts (optional for external PostgreSQL).
AZURE_STORAGE_RESOURCE_ID	ARM ID of the Storage account for metric charts.

FinOps

Variable	Description
FINOPS_AUTH_MODE	default, client-secret or managed-identity; omitted reuses AZURE_AUTH_MODE.
FINOPS_SUBSCRIPTION_IDS	Up to 20 comma-separated subscription IDs. Empty reuses the inventory catalogue.

See FinOps.