Configuration reference

This page lists every TestLookup setting, with its type and its default value in the code of this version. Your Compose file, Helm values, Kustomize overlay, .env file, secret store or saved project settings can change these defaults.

All settings

The table below is built automatically from TestLookup’s settings code. For each setting it gives the name, the type, any other name TestLookup accepts, the default and the allowed range. It shows what TestLookup does when nothing else sets a value, so your installation may use different values.

The backend, the background workers (Celery) and the scheduler (Celery beat) all read the same settings. TestLookup looks for each value in this order:

1. An environment variable passed to the process.
2. A .env file in the working folder.
3. The default in the code.

Names are case sensitive, and an empty value counts as not set. TestLookup ignores a name it does not know and shows no error, so check the spelling: a misspelled variable simply has no effect.

For these groups of settings, a value saved in the TestLookup screens wins over the environment variable, whether it turns a feature on or off:

• AI provider, model and analysis settings (/settings/ai).
• Integration settings (/settings/integrations).
• Email (SMTP) settings.
• Storage addresses (/settings/storage).

Offline mode (AI_OFFLINE_MODE) is the exception. The AI settings page can make it stricter, but never looser. The table has no descriptions. The hand-written configuration guide on GitHub explains what each setting does and when to change it.

The defaults in this table come from the code. Nothing here is read from a .env file, a cluster secret or a running server. The configuration guide on GitHub explains what each setting does, and the deployment guide lists what production needs.

Setting	Type	Default in code and allowed values
APP_NAME	str	'TestLookup'
APP_ENV	Literal['development', 'staging', 'production']	'development'
APP_SECRET_KEY	str	'change-me-in-production'
APP_SECRET_KEY_PREVIOUS	Optional[str]	None
APP_DEBUG	bool	False
APP_VERSION	str	'0.0.1'
BUILD_REVISION	str	''
BUILD_DATE	str	''
CORS_ORIGINS_RAW (also read as CORS_ORIGINS)	str	'http://localhost:3000,http://localhost:5173'
PUBLIC_BASE_URL	str	''
POSTGRES_HOST	str	'localhost'
POSTGRES_PORT	int	5433
POSTGRES_DB	str	'testlookup'
POSTGRES_USER	str	'testlookup_user'
POSTGRES_PASSWORD	str	''
DATABASE_URL	str	''
MONGO_HOST	str	'localhost'
MONGO_PORT	int	27017
MONGO_DB	str	'testlookup_logs'
MONGO_URI	str	'mongodb://localhost:27017'
STORAGE_BACKEND	Literal['minio', 's3', 'local']	'minio'
LOCAL_STORAGE_PATH	str	'/tmp/testlookup_data'
MINIO_ENDPOINT	str	'localhost:9000'
MINIO_ACCESS_KEY	str	'testlookup_minio'
MINIO_SECRET_KEY	str	''
MINIO_BUCKET_NAME	str	'test-telemetry'
MINIO_USE_SSL	bool	False
RETENTION_EXPORT_MAX_BYTES	int	536870912 (512 MiB); minimum 1048576
RETENTION_EXPORT_COLLECT_TTL_HOURS	int	72; from 1 to 720
REDIS_PASSWORD	str	''
REDIS_URL	str	'redis://localhost:6379/0'
CELERY_BROKER_URL	str	'redis://localhost:6379/0'
CELERY_RESULT_BACKEND	str	'redis://localhost:6379/1'
REPORT_EXPORT_SYNC_MAX_TESTS	int	200000; minimum 0
CELERY_WORKER_CONCURRENCY	int	4
PG_POOL_SIZE	Optional[int]	None; minimum 1
PG_MAX_OVERFLOW	Optional[int]	None; minimum 0
PG_POOL_RECYCLE	int	1800; minimum 1
PG_POOL_TIMEOUT	int	30; minimum 1
PG_PROCESS_ROLE	Literal['api', 'worker', 'operation']	'operation'
PG_PROCESSES_PER_POD	int	1; minimum 1
PG_FLEET_MAX_CONNECTIONS	int	400; minimum 1
PG_FLEET_OPERATIONAL_RESERVE	int	50; minimum 1
PG_FLEET_SUPERUSER_RESERVED_CONNECTIONS	int	3; minimum 0
PG_FLEET_RESERVED_CONNECTIONS	int	0; minimum 0
PG_FLEET_MIGRATION_CONNECTIONS	int	1; minimum 1
PG_FLEET_REQUIRED_CONNECTIONS	int	273; minimum 1
MONGO_MAX_POOL_SIZE	int	50
MONGO_MIN_POOL_SIZE	int	5
MONGO_SOCKET_TIMEOUT_MS	int	30000
MONGO_MAX_IDLE_TIME_MS	int	60000
S3_MAX_POOL_CONNECTIONS	int	50
INGESTION_S3_CONCURRENCY	int	10
LLM_MAX_CONCURRENT_ANALYSES	int	3
AGENT_INVOKE_SYNC_CONCURRENCY	int	4
AGENT_INVOKE_SYNC_WAIT_SECONDS	int	25
AGENT_INVOKE_STREAM_TICKET_SECONDS	int	60
WS_MAX_CONNECTIONS_PER_PROJECT	int	500
WS_MAX_TOTAL_CONNECTIONS	int	5000
WS_BROADCAST_TIMEOUT	float	5.0
INGEST_RATE_LIMIT_PER_MINUTE	int	200
INGEST_EVENT_RATE_LIMIT_PER_MINUTE	int	20000
MAX_ARCHIVE_UNCOMPRESSED_BYTES	int	209715200 (200 MiB)
MAX_ARCHIVE_ENTRIES	int	5000
MAX_ARCHIVE_ENTRY_BYTES	int	52428800 (50 MiB)
MAX_ARCHIVE_RATIO	int	100
FORM_URLENCODED_MAX_BYTES	int	65536 (64 KiB)
FORM_URLENCODED_ACS_MAX_BYTES	int	2097152 (2 MiB)
INGEST_MAX_RESULTS_PER_UPLOAD	int	50000
INGEST_REDIS_MEMORY_THRESHOLD_PCT	float	75.0
INGEST_REDIS_MEMORY_ABSOLUTE_BYTES	int	0
LIVE_BUFFER_MAX_EVENTS_PER_RUN	int	50000
PERSIST_LIVE_BULK_INSERT_CHUNK	int	1000
LIVE_INGEST_SHARD_COUNT	int	8
LIVE_SESSION_DRAIN_ENABLED	bool	True
LIVE_SESSION_DRAIN_BATCH_SIZE	int	5000
AI_PIPELINE_DEADLINE_SECONDS	int	1500
AGENT_PIPELINE_ALERT_GRACE_SECONDS	int	300
HIGH_VOLUME_AUTO_DETECT_ENABLED	bool	True
HIGH_VOLUME_TESTS_PER_MINUTE	int	1000
HIGH_VOLUME_CONSECUTIVE_MINUTES	int	3
HIGH_VOLUME_SAMPLE_EVERY_N	int	2
INGESTION_DLQ_ENABLED	bool	True
CANONICAL_DELETION_WINDOW_RUNS	int	5
LLM_PROVIDER	Literal['ollama', 'lmstudio', 'localai', 'vllm', 'openai', 'gemini', 'anthropic', 'openrouter']	'ollama'
LLM_MODEL	str	'qwen2.5:7b-instruct'
LLM_TEMPERATURE	float	0.1
LLM_MAX_TOKENS	int	4096
OLLAMA_BASE_URL	str	'http://localhost:11434'
OLLAMA_NUM_CTX	int	8192
LMSTUDIO_BASE_URL	str	'http://localhost:1234/v1'
LOCALAI_BASE_URL	str	'http://localhost:8080/v1'
VLLM_BASE_URL	str	'http://localhost:8000/v1'
OPENAI_API_KEY	Optional[str]	None
GOOGLE_API_KEY	Optional[str]	None
ANTHROPIC_API_KEY	Optional[str]	None
OPENROUTER_API_KEY	Optional[str]	None
OPENROUTER_BASE_URL	str	'https://openrouter.ai/api/v1'
OPENROUTER_SITE_URL	str	'https://github.com/test-intelligence/testlookup'
OPENROUTER_APP_NAME	str	'TestLookup'
LLM_PRICE_OVERRIDES	Optional[str]	None
EMBEDDING_PROVIDER	str	'ollama'
EMBEDDING_MODEL	str	'nomic-embed-text:v1.5'
CHROMA_HOST	str	'localhost'
CHROMA_PORT	int	8001
CHROMA_COLLECTION	str	'testlookup_embeddings'
CHROMA_ONNX_MODEL_DIR	str	''
AI_OFFLINE_MODE	bool	True
REVIEW_GATE_ENFORCED	bool	False
AI_LLM_PROVIDER_ALLOWLIST	str	''
AI_LLM_ALLOWED_BASE_URLS	str	''
OFFLINE_NOTIFICATION_ALLOWED_HOSTS	str	''
OFFLINE_EMAIL_ALLOWED_RECIPIENT_DOMAINS	str	''
WEBHOOK_PRIVATE_ALLOWED_HOSTS	str	''
OUTBOUND_WEBHOOK_PRIVATE_ALLOWED_HOSTS	str	''
AGENT_MEMORY_RETENTION_DAYS	int	365
AI_CONFIDENCE_THRESHOLD	int	80
AIQ_GAP_REFINEMENT_ENABLED	bool	False
AIQ_CONTRACT_VALIDATION_ENABLED	bool	False
AIQ_CHANGE_OWNERSHIP_ENABLED	bool	False
AIQ_ASYNC_DECISION_REPORT_SUPERSESSION_ENABLED	bool	False
AI_REPORT_EVAL_ALLOW_CALLER_CORPUS	bool	False
AI_MAX_RETRIES	int	3
AI_TIMEOUT_SECONDS	int	300
CHAT_FIRST_TOKEN_TIMEOUT_SECONDS	int	45
CHAT_TURN_TIMEOUT_SECONDS	int	120
CHAT_MAX_TOOL_ROUNDS	int	4
CHAT_HISTORY_MESSAGES	int	12
CHAT_LLM_MODEL	str	''
AGENT_PIPELINE_MAX_ATTEMPTS	int	5
AGENT_MAX_ATTEMPTS_CEILING	int	10
AGENT_MAX_TIMEOUT_CEILING	int	600
AGENT_RETRY_BASE_SECONDS	int	30
AGENT_RETRY_CAP_SECONDS	int	600
LLM_CLUSTER_MAX_CONCURRENT	int	4
LLM_CLUSTER_SLOT_LEASE_SECONDS	int	60
AI_ANALYSIS_CACHE_TTL	int	3600
SEMANTIC_SIMILARITY_THRESHOLD	float	0.85
PROMPT_OVERHEAD_TOKENS	int	1500
SEMANTIC_CACHE_MAX_DOCUMENTS	int	10000
JIRA_ENABLED	bool	False
JIRA_DOMAIN	Optional[str]	None
JIRA_EMAIL	Optional[str]	None
JIRA_API_TOKEN	Optional[str]	None
JIRA_DEFAULT_PROJECT_KEY	str	'QA'
JIRA_WEBHOOK_SECRET	Optional[str]	None
CONFLUENCE_ENABLED	bool	False
CONFLUENCE_DOMAIN	Optional[str]	None
CONFLUENCE_EMAIL	Optional[str]	None
CONFLUENCE_API_TOKEN	Optional[str]	None
SPLUNK_ENABLED	bool	False
SPLUNK_BASE_URL	Optional[str]	None
SPLUNK_API_TOKEN	Optional[str]	None
SPLUNK_INDEX	str	'main'
OCP_ENABLED	bool	False
OCP_API_URL	Optional[str]	None
OCP_SA_TOKEN	Optional[str]	None
OCP_DEFAULT_NAMESPACE	str	'qa-testing'
SLACK_ENABLED	bool	False
SLACK_BOT_TOKEN	Optional[str]	None
SLACK_WEBHOOK_URL	Optional[str]	None
SLACK_DEFAULT_CHANNEL	str	'#qa-alerts'
TEAMS_ENABLED	bool	False
TEAMS_WEBHOOK_URL	Optional[str]	None
SMTP_ENABLED	bool	False
SMTP_HOST	str	'localhost'
SMTP_PORT	int	587
SMTP_USER	Optional[str]	None
SMTP_PASSWORD	Optional[str]	None
SMTP_FROM	str	'noreply@testlookup.io'
SMTP_TLS	bool	True
SEARCH_INDEX_BATCH_SIZE	int	200
SEARCH_INDEX_INCREMENTAL_LIMIT	int	5000
SEARCH_QUERY_TIMEOUT_MS	int	5000
SEARCH_MAX_RESULTS	int	200
DEV_AUTO_LOGIN_ENABLED	bool	True
JWT_SECRET_KEY	str	'change-me-jwt-secret'
JWT_ALGORITHM	str	'HS256'
JWT_ACCESS_TOKEN_EXPIRE_MINUTES	int	720
JWT_REFRESH_TOKEN_EXPIRE_DAYS	int	7
AUTH_REVOCATION_FAIL_OPEN	bool	False
REGISTRATION_ENABLED	bool	False
MFA_ISSUER_NAME	str	'TestLookup'
MFA_CHALLENGE_TTL_SECONDS	int	300
MFA_RECOVERY_CODE_COUNT	int	10
MFA_BREAKGLASS_ENABLED	bool	False
SSO_ENABLED	bool	False
SCIM_ENABLED	bool	False
SAML_SP_ENTITY_ID	str	'https://testlookup.io/saml/metadata'
SAML_BASE_URL	str	'http://localhost:8000'
SSO_ADMIN_FALLBACK_ENABLED	bool	True
SSO_ALLOW_PRIVATE_IDP_ENDPOINTS	bool	False
SAML_ALLOW_IDP_INITIATED	bool	False
SAML_CLOCK_SKEW_SECONDS	int	60
SSO_MAX_PROVISIONED_ROLE	str	'ADMIN'
SECRET_PROVIDER_VAULT_ADDR	str	''
SECRET_PROVIDER_VAULT_AUTH	str	'token'
SECRET_PROVIDER_VAULT_TOKEN	str	''
SECRET_PROVIDER_VAULT_ROLE_ID	str	''
SECRET_PROVIDER_VAULT_SECRET_ID	str	''
SECRET_PROVIDER_VAULT_K8S_ROLE	str	''
SECRET_PROVIDER_VAULT_MOUNT	str	'secret'
SECRET_PROVIDER_VAULT_NAMESPACE	str	''
SECRET_PROVIDER_VAULT_CACHE_SECONDS	int	60
FINETUNE_ENABLED	bool	False
FINETUNE_CLASSIFIER_MIN_EXAMPLES	int	500
FINETUNE_REASONING_MIN_EXAMPLES	int	2000
FINETUNE_EMBED_MIN_PAIRS	int	1000
FINETUNE_INCREMENTAL_TRIGGER	int	200
FINETUNE_EVAL_HOLDOUT	float	0.1
FINETUNE_MIN_ACCURACY_GAIN	float	0.02
FINETUNE_EXPORT_BUCKET	str	'training-data'
FINETUNE_OPENAI_SUFFIX	str	'testlookup'
CLASSIFIER_CONFIDENCE_THRESHOLD	int	85
CLASSIFIER_MODEL	Optional[str]	None
DEEP_INVESTIGATION_ENABLED	bool	True
RELEASE_PASS_RATE_THRESHOLD	float	90.0
KNOWLEDGE_RAG_ENABLED	bool	False
KNOWLEDGE_SYNC_TIMEOUT_SECONDS	int	60
KNOWLEDGE_MAX_SOURCES_PER_PROJECT	int	100
KNOWLEDGE_DOCS_BUCKET	str	'knowledge-docs'
KNOWLEDGE_STALE_THRESHOLD_JIRA_HOURS	int	24
KNOWLEDGE_STALE_THRESHOLD_URL_HOURS	int	168
KNOWLEDGE_CHUNK_TARGET_TOKENS	int	400
KNOWLEDGE_CHUNK_MAX_TOKENS	int	800
KNOWLEDGE_CHUNK_OVERLAP_TOKENS	int	50
KNOWLEDGE_RESYNC_BATCH_CAP	int	50
KNOWLEDGE_SYNC_STUCK_MINUTES	int	45
ANALYSIS_MODE	str	'auto'
ML_MODEL_DIR	str	'models'
ML_MODEL_SYNC_ENABLED	bool	True
ML_MODEL_STORE_PREFIX	str	'ml-models/'
ML_MIN_TRAINING_SAMPLES	int	200
ML_RETRAIN_ENABLED	bool	True
ML_ACCURACY_THRESHOLD	float	0.8
ML_PSEUDO_LABEL_CAP	float	0.3
ML_PSEUDO_LABEL_WEIGHT	float	0.3
ML_HUMAN_LABEL_FLOOR	int	50
ANOMALY_REGRESSION_THRESHOLD	float	10.0
ANOMALY_MIN_HISTORY_RUNS	int	3
ANOMALY_FLAKY_WINDOW_RUNS	int	10
ANOMALY_FLAKY_LOOKBACK_DAYS	int	30
ANOMALY_PERF_HISTORY_DAYS	int	30
ANOMALY_MIN_PERF_SAMPLES	int	5
ANOMALY_PERF_SPIKE_MULTIPLIER	float	2.0
ANOMALY_PERF_MIN_ABSOLUTE_DELTA_MS	int	1000
ANOMALY_SUMMARY_MAX_ITEMS	int	8
RISK_WEIGHT_USER_IMPACT	float	0.25
RISK_WEIGHT_ENV_SENSITIVITY	float	0.1
RISK_WEIGHT_REPRODUCIBILITY	float	0.15
RISK_WEIGHT_REGRESSION_LIKELY	float	0.2
RISK_WEIGHT_HIST_RECURRENCE	float	0.1
RISK_WEIGHT_BLAST_RADIUS	float	0.15
RISK_WEIGHT_DIAGNOSIS_CONF	float	0.05
PROMETHEUS_URL	Optional[str]	None
SLOW_QUERY_MS	int	500
GITHUB_TOKEN	Optional[str]	None
GITHUB_REPO	Optional[str]	None
COMMIT_RANGE_FILE_FETCH_LIMIT	int	25
HTTP_VERIFY_TLS	bool	True
HTTP_CA_BUNDLE	Optional[str]	None
WEBHOOK_SECRET	str	'change-me-webhook-secret'
TRUSTED_PROXY_IPS	str	''
LIVE_EVENTS_REQUIRE_PROJECT_KEY	bool	True
OTEL_ENABLED	bool	True
OTEL_SERVICE_NAME	str	'testlookup'
OTEL_EXPORTER_OTLP_ENDPOINT	Optional[str]	None
METRICS_ENABLED	bool	True
LOG_LEVEL	str	'INFO'
LOG_FORMAT	Literal['json', 'text']	'json'

Required secrets

Before you run TestLookup in production, replace every development placeholder with a real secret. This covers the application key, the key that signs sign-in tokens (JWT), the webhook secret, the database and file-storage passwords, and the keys for integrations and AI providers.

Back up APP_SECRET_KEY with your recovery records. Without it, TestLookup can no longer read the passwords and keys it stored in encrypted form. A secret setting can also hold a reference such as vault:<path>#<key> instead of the secret itself. This works once SECRET_PROVIDER_VAULT_ADDR (empty by default) gives the address of a Vault or OpenBao server.

Production startup checks

When APP_ENV is production or staging, the API refuses to start if any of these is true:

• JWT_SECRET_KEY, APP_SECRET_KEY or WEBHOOK_SECRET is empty or still a placeholder.
• The password inside MONGO_URI is a placeholder.
• DEV_AUTO_LOGIN_ENABLED is true.

With APP_ENV=production, the API also refuses to start when PostgreSQL’s max_connections is below PG_FLEET_MAX_CONNECTIONS (400 by default).

In these cases the API logs a warning but still starts:

• CORS_ORIGINS contains a wildcard entry.
• SAML_BASE_URL points at localhost while single sign-on is on.
• Jira is turned on but has no webhook secret.

In the code, APP_ENV defaults to development and DEV_AUTO_LOGIN_ENABLED defaults to true. The production image, the Compose files, the Kubernetes base, and the homelab and openshift-artifactory overlays already set production values. If you write an environment file or a ConfigMap by hand, set APP_ENV=production and DEV_AUTO_LOGIN_ENABLED=false yourself.

Encryption key rotation

APP_SECRET_KEY does three jobs:

• It encrypts stored secrets: integration tokens, the SMTP password, AI provider keys and webhook signing secrets.
• It encrypts each user’s two-step sign-in (MFA) secret.
• It signs saved copies of decision evidence and signed records (attestations).

If you simply replace the key, TestLookup can no longer read those values, and MFA sign-in fails with HTTP 503. To change the key safely:

1. Move the old value to APP_SECRET_KEY_PREVIOUS.
2. Put the new value in APP_SECRET_KEY. TestLookup decrypts with the current key first and then with the previous one, and it encrypts new writes with the current key.
3. Remove the previous key once every value has been encrypted again on its next write.

Feature switches and defaults

Several things decide whether a feature works: feature flags, project rules, the user’s role, what a key is allowed to reach, whether an AI provider is available, and workflow settings.

By default:

• Offline mode is on (AI_OFFLINE_MODE is true).
• The review gate (REVIEW_GATE_ENFORCED) is off.
• Single sign-on (SSO), automatic user setup from your company directory (SCIM) and self-registration (REGISTRATION_ENABLED) are off.

Each of these is a separate setting that you can change. SAML 2.0, OpenID Connect (OIDC) and SCIM are built in, but they need setting up. Before you turn on SSO or SCIM, check two settings:

• SSO_MAX_PROVISIONED_ROLE (default ADMIN) is the highest role that an identity-provider group mapping or SCIM can give a user.
• SSO_ADMIN_FALLBACK_ENABLED (default true) lets administrators still sign in with a password while SSO is required.

The github_checks and gitlab flags start off. outbound_webhooks starts on for a new installation, and an upgraded installation keeps its stored value. Integration values saved in the screens override their environment variables. All three, like filing Jira issues, do nothing while offline mode is on, because TestLookup checks offline mode before any flag or saved integration value. Offline mode overrides every other setting.

The default LLM_MODEL is qwen2.5:7b-instruct. HTTP_CA_BUNDLE (not set by default) gives TestLookup’s outgoing connections a PEM certificate bundle for your company’s own certificate authority.

The AIQ_* variables in the table do not turn deep investigation steps on or off by themselves. When the database update (migration) that creates a matching flag runs, it uses the variable’s value as the flag’s starting value. After that, TestLookup reads the variable only while the flag has no row in the database. From then on, the flag on the Feature flags page decides. The AI configuration guide lists each step’s default.

Flags and environment switches

Feature flags are stored in the database. Administrators manage them on Settings › System › Feature flags (/settings/feature-flags). Each flag has a main on/off switch, a rollout percentage, and optional lists of projects and roles. TestLookup keeps flag values for about 30 seconds before it reads them again. Several flags have one default on a new installation and keep their stored value on an upgraded one.

A few environment variables work like flags, but you must restart TestLookup to change them:

• AI_OFFLINE_MODE and REVIEW_GATE_ENFORCED.
• The main integration switches: JIRA_ENABLED, SLACK_ENABLED, TEAMS_ENABLED, SMTP_ENABLED, SPLUNK_ENABLED and OCP_ENABLED. Most of these also have a setting in the screens.
• SSO_ENABLED and SCIM_ENABLED.
• LIVE_EVENTS_REQUIRE_PROJECT_KEY.

The feature-flag reference on GitHub lists every flag’s default, what it covers and what it controls.

Values for this version

The values on this page come from the current development version of TestLookup. When you upgrade, compare this page with the configuration reference for the new version. That way you notice new, renamed or changed settings before you deploy.

No real settings or secrets on this page

This page shows the defaults in the code and nothing else. It does not read a .env file, a cluster secret or a running server, so no real tokens, passwords, keys, private addresses or local settings appear here.

Next, set these values for the way you install TestLookup. The deployment guide lists the secrets each install mode needs, and day-two operations explains how to check them on a running installation.