Environment variables

Required

JANUS_ENCRYPTION_KEY is the only required variable — 32 bytes, given as 64 hex characters (openssl rand -hex 32) or base64, used to encrypt upstream credentials at rest; changing it orphans stored credentials.

JANUS_PUBLIC_URL (default http://localhost:8080) — the externally reachable URL; set it for any deployment reached from another machine. It forms the OIDC redirect URI and the SDK base URL shown in the UI.

Database

JANUS_DATABASE_URL — postgres:// (or postgresql://) for production, or sqlite:///absolute/path.db for a single-node deployment. Optional: when unset, the gateway defaults to embedded SQLite at /data/janus.db (single-node evaluation mode) and logs a prominent startup warning. The Administration → Settings → System status page reports the backend and sanitized location in force.

Identity

All identity variables are optional: without an identity provider Janus uses local accounts, and the first sign-in creates the administrator. JANUS_OIDC_PROVIDER_URL, JANUS_OIDC_CLIENT_ID and JANUS_OIDC_CLIENT_SECRET configure the identity provider; if the provider URL is set, the other two must be set too. JANUS_OIDC_EMAIL_CLAIM (default email), JANUS_OIDC_NAME_CLAIM (name) and JANUS_OIDC_GROUPS_CLAIM (groups) override claim names for non-standard providers; JANUS_OIDC_SCOPES (default openid,profile,email,groups) sets the requested scopes. JANUS_BOOTSTRAP_ADMIN_EMAILS grants the admin role on first sign-in (sticky). JANUS_ADMIN_GROUPS — a comma- or space-separated list of IdP group names, matched case-insensitively against the groups claim on every sign-in — grants the admin capability while membership lasts; leaving the group in the identity provider revokes it at the next sign-in, and removing someone from the group in Janus or through SCIM, or removing the group from an admin-group list, revokes it at once. Administrators can add more admin groups under Administration → People → Groups; both lists apply.

JANUS_DEV_AUTH enables the local evaluation sign-in (no identity provider, any email). The gateway refuses to boot with it when JANUS_ENV=production is set explicitly (an unset JANUS_ENV does not count, so the local quick start works) or the public URL is not loopback; JANUS_DEV_AUTH_ALLOW_UNSAFE=true overrides that refusal for isolated demos only.

Serving and sessions

JANUS_LISTEN_ADDR (default :8080), JANUS_TLS_CERT_PATH / JANUS_TLS_KEY_PATH for direct TLS with an issued certificate (set both or neither; re-read when they change), JANUS_TLS_SELF_SIGNED=true for a self-signed listener certificate Janus generates and stores (temporary; names JANUS_TLS_SELF_SIGNED_NAMES, lifetime JANUS_TLS_SELF_SIGNED_DAYS), JANUS_TLS_REQUIRE=true to refuse to start without serving TLS itself, JANUS_COOKIE_SECURE to force secure cookies (default: on when the public URL is https), JANUS_TRUSTED_PROXIES as a comma- or space-separated list of IP addresses or CIDR blocks gating X-Forwarded-For. Outbound trust store (every outbound TLS connection): JANUS_CA_BUNDLE (a PEM file), JANUS_CA_DIR (a directory of .pem/.crt/.cer files, rescanned every 30 seconds), JANUS_TRUST_DOD_ROOTS (the built-in DoD PKI root CAs; default on in the FIPS edition, off otherwise), plus certificates uploaded under Administration → Settings → Certificates. Outbound calls honor the standard HTTPS_PROXY, HTTP_PROXY and NO_PROXY variables.

JANUS_SESSION_TTL_HOURS (default 24) and JANUS_SESSION_IDLE_TIMEOUT_HOURS (default 4) bound browser sessions.

Proxy behavior and retention

JANUS_UPSTREAM_CONNECT_TIMEOUT_SECONDS (default 10), JANUS_UPSTREAM_TTFB_TIMEOUT_SECONDS (30), and JANUS_UPSTREAM_TOTAL_TIMEOUT_SECONDS (600) set the default bound for each hop. An administrator can override any of them at runtime from Administration → Settings → General → Upstream timeouts (PATCH /api/v1/admin/system/upstream-timeouts): the override is stored in the database, survives restarts, applies to the next request on every replica without a redeploy, and is audit-logged. Raise the time-to-first-byte bound when a busy provider queues requests and callers see 503s. A streamed reply is timed out on silence, not on its total length. The same limits apply when Janus resends a request it fitted to a model’s limits. JANUS_MAX_RESPONSE_BYTES (default 104857600, 100 MiB) caps buffered responses. JANUS_DISCOVERY_INTERVAL_MINUTES (default 2) sets the model-discovery cadence — each run also records whether every upstream is reachable, so it doubles as the availability probe — and an administrator can override it at runtime from Administration → Settings → General → Model discovery (PATCH /api/v1/admin/system/discovery-interval), stored in the database, applied immediately without a restart, and audit-logged.

JANUS_DB_MAX_CONNS (default 25) caps each replica’s PostgreSQL connection pool. Keep replicas × this value well under the database’s max_connections, with headroom for maintenance tools: when the database runs out of connections, requests fail.

JANUS_PERFORMANCE_MODE (default false; Business edition) raises the request rate one replica can meter. Usage records are written in batches every 100 ms and committed without waiting for the database’s disk flush. The trade: a database crash can lose about the last 0.5 s of usage records, and a replica that is killed without a graceful shutdown (out of memory, SIGKILL) can lose up to 100 ms of them. A graceful shutdown or rollout loses nothing. Quota counters trail by at most one batch. The mode is decided at startup: without a valid Business or Enterprise license the gateway logs why and runs normally, and Administration → Settings → System status shows the mode in force. Leave it off unless one replica is approaching its request ceiling (several hundred requests per second); adding replicas is the other answer.

Usage figures on console lists and dashboards come from hourly totals that each replica’s background job keeps up to date about once a minute (one replica at a time), combined with the last few minutes of the request log, so they always match the request log exactly and stay fast however much history the gateway holds. Purging usage and moving a token’s history to another team update the totals in the same step. After an upgrade the first start fills them from existing history in the background, at roughly 4 seconds per million requests.

JANUS_USAGE_RETENTION_DAYS (default 365) and JANUS_AUDIT_RETENTION_DAYS (730) control purging, run daily at JANUS_PURGE_JOB_TIME_UTC (default 02:00). Keep usage retention at least as long as your longest rolling quota window; a quota with a longer window is refused. JANUS_QUOTA_CHECKPOINT_INTERVAL_HOURS (default 24) bounds quota-counter recovery time. JANUS_SMTP_HOST/PORT/USER/PASSWORD/FROM configure alert email (port defaults to 587, sender to janus@localhost). JANUS_ENV (default production) labels the deployment; JANUS_LOG_LEVEL (default info) is debug, info, warn, or error.

Chat and files

JANUS_CHAT_PREVIEW (default false) must be true for Janus Chat to be available at all; while it is false, Chat stays off whatever Administration → Chat says. JANUS_CHAT_AUTO_TITLE (default true) is the starting point for chat naming until an administrator chooses in Administration → Chat → Tools → Chat names. Each naming call is metered and shows in the request log as janus-chat-title. JANUS_CHAT_MAX_UPLOAD_BYTES (default 20 MiB) caps one chat attachment; the smaller of this and the storage cap applies. JANUS_CHAT_SEARCH_SEARXNG_URL (unset) points at a SearXNG instance, such as http://searxng:8080, and turns Chat web search on with it once at startup; later admin changes stick.

JANUS_STORAGE_MODE (database or s3; unset lets Administration → Settings → General → File storage decide) fixes where chat attachments and troubleshooting captures are stored. With s3, JANUS_S3_ENDPOINT, JANUS_S3_BUCKET, JANUS_S3_ACCESS_KEY_ID and JANUS_S3_SECRET_ACCESS_KEY are required; JANUS_S3_REGION (default us-east-1), JANUS_S3_PATH_STYLE (default false), JANUS_S3_PREFIX (key prefix) and JANUS_S3_CA_FILE (PEM file of extra CAs for the endpoint) are optional. JANUS_STORAGE_MAX_OBJECT_BYTES (default 25 MiB) caps one stored file.

Licensing and updates

JANUS_LICENSE_FILE (unset) — path to a license key file; when present it takes precedence over a key installed from the UI. JANUS_LICENSE_SYNC (unset: the UI decides) pins automatic license renewal and sync on or off, and JANUS_LICENSE_SYNC_TOKEN pins its sync token. JANUS_UPDATE_CHECK (default false) turns on the daily check for a newer release. JANUS_OFFLINE (default false) declares an air-gapped deployment: no update check, no license sync, and no personal subscriptions.

Telemetry

OTEL_EXPORTER_OTLP_ENDPOINT (or the alias JANUS_OTEL_EXPORTER_OTLP_ENDPOINT; unset means no OTLP export, /metrics only) sends metrics to an OpenTelemetry collector. JANUS_OTEL_EXPORT_INTERVAL_SECONDS (default 30) sets how often.

Other

JANUS_LOCAL_ONLY (default false) is for deployments with no billing: cost tracking is off, USD quotas stop applying and cannot be created, and all pricing is hidden in the UI and in Chat exports. Token, request and latency figures are unaffected.

JANUS_TROUBLESHOOT_DIR (unset) lets troubleshooting sessions store captured bodies as files under that directory instead of in the database. JANUS_CONFIG_CACHE_TTL_SECONDS (default 5) is how long other replicas may serve model, grant, rule, quota rule, Security Gateway policy, Child Safety, router and rate-card settings — and classifier credentials and base URLs — before they see an admin change. Chat administration settings and quota counters refresh every 5 seconds and the file storage backend every 15 seconds, whatever this value is. A license change reaches a replica that serves no license page within an hour.

JANUS_GITHUB_OAUTH_CLIENT_ID, JANUS_OPENAI_OAUTH_CLIENT_ID and JANUS_XAI_OAUTH_CLIENT_ID (unset: built-in IDs) replace the OAuth client IDs used to connect personal subscriptions. JANUS_BUILD_VERSION (default dev), JANUS_BUILD_SHA (unknown) and JANUS_BUILD_DATE are build details set by the image; leave them alone.