Configuration

You configure the install in one file, local-env.yaml. Copy it from local-env.template.yaml. Most settings in the template are commented out and show their default, so you uncomment only what you change. dockerHub.token is not commented out. This page lists the settings that an integrator sets at install time.

cp local-env.template.yaml local-env.yaml

⚠️ Protect local-env.yaml — It holds secrets that exist nowhere else. Do not delete it, overwrite it or commit it. Keep a safe copy.

Set before the first install

Setting	Why
dockerHub.token	Pulls the Octostar images. Not needed for air-gapped installs.
timbrAdminPassword	The default password is public.
octostar.domain	The domain of home. and fusion.. Default local.test.
storageClass	Cannot change after the first install. See Storage and S3.
Certificates	See Certificates.
Write-once secrets	See Write-once secrets.

With a custom domain, point home.<domain> and fusion.<domain> at the cluster in DNS. The API is on home.<domain>. With the bundled Keycloak on its own host name, also point auth.<domain>.

With the default ingress type (NodePort), the ingress controller listens on node ports 30080 and 30443. Open them in your firewall, and send ports 80 and 443 to them with a load balancer or reverse proxy. With ingress.service.type: LoadBalancer, the installer prints the address.

Admin access

Without Keycloak, log in at https://home.<domain> as admin with timbrAdminPassword. Set this password before the first install.

With keycloak.enabled: true, https://home.<domain> logs in through Keycloak, and no admin user exists there. The administrator is the local admin of the octostar realm. The installer prints its user name at the end. Read the user name and password with:

kubectl --context <context-name> -n octostar-main get secret keycloak-octostar-admin -o jsonpath='{.data.username}' | base64 -d
kubectl --context <context-name> -n octostar-main get secret keycloak-octostar-admin -o jsonpath='{.data.password}' | base64 -d

Fusion's own admin still logs in at https://fusion.<domain>/login/?local=1. See Keycloak and custom OIDC.

Certificates

Choose one approach:

Approach	When to use	Settings
Self-signed (default)	local.test or internal demos	octostar.internalDomain: true
Your own certificate	You have a certificate and key (base64 of the PEM)	tls.cert, tls.key
Wildcard certificate	One certificate for *.<domain>	wildcard.enabled, wildcard.cert, wildcard.key, with octostar.internalDomain: false
ZeroSSL (automatic)	Public certificates	zeroSsl.eab.keyId, zeroSsl.eab.hmac, zeroSsl.email, zeroSsl.challengeType (http01 or dns01)

⚠️ Replace the default tls values — The defaults are a public test certificate and key. Do not use them in production.

Set wildcard.cert and wildcard.key together, or neither. One alone is refused.

• Both set: the install creates the wildcard-tls Secret. To renew, put the new values in local-env.yaml and run update-existing.sh.
• Neither set: set wildcard.enabled: true and keep the wildcard-tls Secret yourself, in the Octostar namespace. Until it exists, the ingresses serve the default certificate.

⚠️ Do not switch a running install between the two. From both to neither, the update deletes the wildcard-tls Secret that the install made. The ingresses serve the default certificate until you apply your own. From neither to both, the update fails, because Helm does not take over a Secret it did not create.

Storage

ClickHouse is the store for entities and relationships. For volume sizes, StorageClass, resize and your own S3 store, see Storage and S3.

⚠️ OpenSearch — Do not lower opensearch.replicas. It can cause data loss. Its admin credentials apply only at the first install.

Monitoring

Grafana, Prometheus and Loki install by default. Tune retention with monitoring.loki.retentionPeriod (default 7d). Enable tracing with monitoring.tempo.enabled.

• Alerts do nothing until you configure delivery. See Alerting.
• A cluster that already has Prometheus or Loki. See Shared clusters.

Single sign-on

Use the keycloak: and oidc: sections for the bundled Keycloak or your own provider. See Keycloak and custom OIDC and Users and roles.

Optional components

Each component is off unless you enable it. Read its section in the template.

Component	Setting	Note
Keycloak	keycloak.enabled	Single sign-on and Active Directory
Map tile server	tileserver.enabled	Needs hundreds of GB. See Prerequisites.
Geocoder (Photon)	photon.enabled	Needs hundreds of GB. See Prerequisites.
Local LLM (vLLM)	vllm.enabled, vllm.profile	See GPU deployments.
T3K CORE	t3k.enabled	Needs a vendor license, licensed images and a GPU. See GPU deployments.
Langfuse	langfuse.enabled	Several secrets are write-once.
Backups	backup.remoteS3.*	See Backup & restore.
Sample data	bigData	"small" needs about 30 GB, "large" about 100 GB.
Own S3 store	s3.backend: external	See Storage and S3.

API keys

Set the keys for the services that you use: assemblyAIAPIKey, espysysAPIKey, openaiToken, socialGistAPIKey, socialLinksAPIKey and localLLMLicenseKey.

GPU

For GPU hosts, start from local-env.template-gpu.yaml. See GPU deployments.

Platform key

Each install has its own EC private key. The installer generates it. Leave octostar.ecPrivateKey unset, and never share a key between installs.

⚠️ Rotating the key logs every user out. Use update-existing.sh --rotate-platform-keys, and read Upgrading and Backup & restore first.

Write-once secrets

⚠️ Warning — Some values apply only at the first install. You cannot change them later by editing local-env.yaml. They include the Langfuse salt, encryptionKey and project keys, and the OpenSearch admin credentials. The template marks them # write-once. Decide on them before the first install.

Other settings

• Branding: octostar.mainLogo, octostar.favicon and octostar.spinner.
• Sessions: octostar.session.idleTimeoutSeconds and octostar.session.maxSessionSeconds.
• appsIngress.skipStaticAssetsAuthentication is true by default, so the static files under /apps/* are readable without a login. Set it to false if they must need a login.
• Pipeline service sizes: leave the defaults unless Octostar support tells you to change them.