Configuration Reference

All environment variables and settings for every Netptune service.

Netptune services are configured entirely through environment variables. The sections below document every option for each service. For Helm deployments, see the mapping table at the bottom of this page.

API server

Connection strings

Passed as environment variables using ASP.NET Core's double-underscore (__) separator for nested configuration keys.

VariableExampleDescription
ConnectionStrings__netptuneHost=postgres;Port=5432;Username=postgres;Password=secret;Database=netptunePostgreSQL connection string. The database must exist and be accessible.
ConnectionStrings__cachepassword@cache:6379Redis / Valkey connection string.
ConnectionStrings__natsnats://nats:4222NATS server URL. JetStream must be enabled on the server.

Authentication

VariableRequiredDescription
NETPTUNE_SIGNING_KEYYesSecret key used to sign JWT tokens. Must be a long random string. Generate with openssl rand -base64 64.
NETPTUNE_GITHUB_CLIENT_IDNoGitHub OAuth App client ID. Leave blank to disable GitHub login.
NETPTUNE_GITHUB_SECRETNoGitHub OAuth App client secret.

Token behaviour

VariableDefaultDescription
Tokens__Issuernetptune.co.ukJWT issuer claim.
Tokens__Audiencenetptune.co.ukJWT audience claim.
Tokens__ExpireDays5Number of days before a token expires.

Email

VariableRequiredDescription
SEND_GRID_API_KEYYesSendGrid API key used to send transactional emails.
Email__DefaultFromAddressYesThe From address for all outgoing emails. Must be verified in SendGrid.
Email__DefaultFromDisplayNameNoDisplay name shown alongside the from address.

S3 storage

VariableRequiredDescription
NETPTUNE_S3_BUCKET_NAMEYesName of the S3 bucket for file attachments.
NETPTUNE_S3_REGIONYesAWS region (e.g. us-east-1) or custom endpoint region for MinIO.
NETPTUNE_S3_ACCESS_KEY_IDYesAWS access key ID or MinIO access key.
NETPTUNE_S3_SECRET_ACCESS_KEYYesAWS secret access key or MinIO secret key.

ASP.NET Core

VariableExampleDescription
ASPNETCORE_URLShttp://0.0.0.0:7400Addresses the API listens on.
ASPNETCORE_FORWARDEDHEADERS_ENABLEDtrueEnable processing of X-Forwarded-For and X-Forwarded-Proto headers. Always set to true when behind a reverse proxy or ingress.

CORS

CORS origins are configured via appsettings.json. When self-hosting, set CorsOrigins to include your public domain:

json
{
  "CorsOrigins": [
    "https://your-domain.com"
  ]
}

Job server

The Job Server requires the same connection string, authentication, email, and S3 variables as the API server. The table below lists each one for reference.

VariableDescription
ConnectionStrings__netptunePostgreSQL connection string (same as API).
ConnectionStrings__cacheRedis / Valkey connection string (same as API).
ConnectionStrings__natsNATS server URL (same as API).
NETPTUNE_SIGNING_KEYJWT signing key (same as API).
SEND_GRID_API_KEYSendGrid API key.
NETPTUNE_S3_BUCKET_NAMES3 bucket name.
NETPTUNE_S3_REGIONS3 region.
NETPTUNE_S3_ACCESS_KEY_IDS3 access key ID.
NETPTUNE_S3_SECRET_ACCESS_KEYS3 secret key.

PostgreSQL

VariableDescription
POSTGRES_USERDatabase superuser — use postgres.
POSTGRES_PASSWORDSuperuser password. Use a strong random value.
POSTGRES_DBDatabase name — must be netptune.
POSTGRES_HOST_AUTH_METHODSet to scram-sha-256 for encrypted authentication.
POSTGRES_INITDB_ARGS--auth-host=scram-sha-256 --auth-local=scram-sha-256

Redis / Valkey

Start the server with a --requirepass flag:

bash
valkey-server --requirepass <your_password>

Include the password in the connection string passed to the API and Job Server:

<password>@<hostname>:<port>

NATS

NATS must run with JetStream enabled using the -js flag:

bash
nats-server -js
No password is required for a basic self-hosted setup. For production environments, authentication can be added via NATS configuration files.

Client (Nginx)

The client container is a pre-built Angular application served by Nginx. No additional configuration is required. The following behaviours are baked in:

  • All requests to /api/* are proxied to the API server
  • All other routes fall back to the Angular SPA's index.html
  • Static assets are served with a 1-year Cache-Control header
  • Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy
  • Gzip compression enabled

Helm values mapping

When deploying via Helm, environment variables are managed through values.yaml and values.secret.yaml. The table below maps Helm value paths to their corresponding environment variables.

Helm pathEnvironment variable
secrets.api.signing_keyNETPTUNE_SIGNING_KEY
secrets.api.github_client_idNETPTUNE_GITHUB_CLIENT_ID
secrets.api.github_secretNETPTUNE_GITHUB_SECRET
secrets.api.sendgrid_api_keySEND_GRID_API_KEY
secrets.api.s3_bucket_nameNETPTUNE_S3_BUCKET_NAME
secrets.api.s3_regionNETPTUNE_S3_REGION
secrets.api.s3_access_key_idNETPTUNE_S3_ACCESS_KEY_ID
secrets.api.s3_secret_access_keyNETPTUNE_S3_SECRET_ACCESS_KEY
secrets.postgres.postgres_passwordPOSTGRES_PASSWORD
secrets.cache.cache_passwordRedis --requirepass value