Configuration

Application settings come from environment variables — set them in the shell, a systemd unit, or .env files (KEY=VALUE, one per line). No YAML or other config format.

Load order

1. Defaults (in code)
2. User config file (if present): see below
3. Project / CWD .env (when running from source or from a deployment directory)
4. Environment variables (always override)

So: env vars override .env; .env overrides user config file; user config overrides defaults.

User-level config (.env file)

When using the installed package (e.g. rediflow run), the app looks for a user config file and then for a .env in the current working directory.

• Explicit path: set REDIFLOW_CONFIG to the full path of a .env file (e.g. /etc/rediflow/config.env or ~/my.env).
• Default path (no env set):
  • Linux / macOS: $XDG_CONFIG_HOME/rediflow/config.env or, if that is unset, ~/.config/rediflow/config.env
  • Windows: %APPDATA%\rediflow\config.env

Create the directory and file if you want to use it (e.g. mkdir -p ~/.config/rediflow then create config.env with DATABASE_URL=..., SECRET_KEY=..., etc.). Only variables not already set in the environment are applied from the file.

Project / deployment directory (.env)

When you run from the source tree (e.g. python main.py run), the app loads from the project root: .env.<APP_ENV>, .env.dev, or .env (first found). When you run the installed rediflow CLI, it also loads from the current working directory in the same order. So in a deployment directory (or in Podman with WORKDIR /app), place .env, .env.qa, or .env.dev and the app will use it.

Deployment with compose: Place .env.qa or .env.prod in the same directory as the compose file. Compose reads env_file relative to the compose file location. Compose also loads .env by default for variable substitution; create .env with POSTGRES_USER, POSTGRES_PASSWORD, and POSTGRES_DB matching your env file, or source the env file before running compose. See Deploy QA and production for the full guide.

Example .env files

• Dev: copy .env.dev.example (in repo root) to .env.dev (or .env) and set DATABASE_URL, SECRET_KEY, etc.
• QA: copy .env.qa.example to .env.qa. When using Podman Compose, set DATABASE_URL so the host is the service name db, e.g. postgresql://rediflow:rediflow@db:5432/rediflow_qa. Compose overrides this via the environment section if you use the same variable names.

Running migrations

After setting DATABASE_URL, run schema migrations before starting the app.

From source (local):

uv run python main.py migrate

Or: uv run rediflow migrate head.

From container (dev, with compose):

make migrate

Or explicitly: podman run --rm --network rediflow_default --env-file .env.dev -e DATABASE_URL=postgresql://...@db:5432/rediflow rediflow:latest rediflow migrate head. Use docker instead of podman if you use Docker.

From container (QA or production):

podman compose -f compose.deploy-qa.yml run --rm app-qa rediflow migrate head

For production, use compose.deploy-prod.yml and service app-prod. See Deploy QA and production for the full guide.

Main variables

Row Level Security (RLS)

When using Authentik (OIDC), the app sets the PostgreSQL session variable app.current_user_id per request. RLS policies on user_settings and shared_views restrict access by user. When no user is logged in (or OIDC is disabled), the variable is empty and policies allow full access for backward compatibility.

RLS policies apply only when the app connects as a non-owner role. By default, the app uses the same role that runs migrations (table owner), so RLS is bypassed. To enable RLS, use a two-role setup.

RLS variables

Two-role setup

1. Owner role (e.g. rediflow): Runs migrations, owns tables. Use DATABASE_URL for migrations.
2. App role (e.g. rediflow_app): Has grants only. Use DATABASE_URL_APP for the app when RLS_ENABLED=true.

Steps to enable RLS:

1. Run migrations as owner: uv run python main.py migrate head (uses DATABASE_URL).
2. Create the app role and grant permissions: uv run rediflow setup-rls-app-role (requires DATABASE_URL, POSTGRES_APP_USER, POSTGRES_APP_PASSWORD).
3. Set RLS_ENABLED=true and DATABASE_URL_APP in your .env.
4. Restart the app.

See Authentik setup for the full RLS flow with Authentik and .env.test.

Registration and license: Providing no license or an expired/invalid license does not restrict use of the software or any feature. The app works fully in all cases. Only the footer text differs: "Unregistered installation · Register (free)" vs "Registered installation." See Registration and license for license format and how to obtain a license.

See .env.dev.example and .env.qa.example in the repo root for the full list and comments.