Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.tembo.io/llms.txt

Use this file to discover all available pages before exploring further.

All keys use convict dot-notation and can be set in /var/lib/tembo/config.json. You can access this file by going to the VS Code IDE located on the instance, located in a web browser at http://<YOUR_IP_ADDRESS>:8888. It should, by default, open to this file. If you are unable to access this, please go to the installer at http://<YOUR_IP_ADDRESS>:3999 -> Settings and click the checkbox for Enable VS Code Server. Be sure to update again after enabling this.

Core

KeyEnv VarDefaultDescription
app.environmentAPP_ENVIRONMENTdevelopmentApp environment
applicationBaseUrlENVIRONMENT_URLstaging.tembo.ioEnvironment URL
debugDEBUGfalseEnable debug mode
defaultOrgIdDEFAULT_ORG_IDDefault organization ID
portPORT9854Port to bind the server to

Database

KeyEnv VarDefaultDescription
database.urlDATABASE_URLpostgresql://postgres:postgres@localhost:5432/postgresDatabase URL (also assembled from DB_HOST, DB_USERNAME, DB_PASSWORD, DB_PORT, DB_NAME, DB_CONNECTION_LIMIT)

Auth

KeyEnv VarDescription
betterAuth.oauth.github.callbackUrlSELF_HOSTED_GITHUB_CALLBACK_URLSelf-hosted GitHub OAuth callback URL
betterAuth.oauth.github.clientIdSELF_HOSTED_GITHUB_CLIENT_IDSelf-hosted GitHub OAuth client ID
betterAuth.oauth.github.clientSecretSELF_HOSTED_GITHUB_CLIENT_SECRETSelf-hosted GitHub OAuth client secret
betterAuth.oauth.google.callbackUrlGOOGLE_CALLBACK_URLGoogle OAuth callback URL
betterAuth.oauth.google.clientIdGOOGLE_CLIENT_IDGoogle OAuth client ID
betterAuth.oauth.google.clientSecretGOOGLE_CLIENT_SECRETGoogle OAuth client secret
betterAuth.oauth.okta.callbackUrlOKTA_CALLBACK_URLOkta OAuth callback URL
betterAuth.oauth.okta.clientIdOKTA_CLIENT_IDOkta OAuth client ID
betterAuth.oauth.okta.clientSecretOKTA_CLIENT_SECRETOkta OAuth client secret
betterAuth.oauth.okta.discoveryUrlOKTA_DISCOVERY_URLOkta OIDC discovery URL
betterAuth.secretBETTER_AUTH_SECRETBetter Auth secret (min 32 chars)
clerk.secretKeyCLERK_SECRET_KEYClerk secret key

AI / Models

KeyEnv VarDefaultDescription
anthropic.apiKeyANTHROPIC_API_KEYAnthropic API key
anthropic.proxy.logANTHROPIC_PROXY_LOGfalseLog Anthropic proxy requests
anthropic.proxyUrlANTHROPIC_PROXY_URLOverride for Anthropic proxy URL
anthropic.useBedrockANTHROPIC_USE_BEDROCKfalseUse AWS Bedrock for small model
cerebras.apiKeyCEREBRAS_API_KEYCerebras API key
claudeCode.appendSystemPromptCC_APPEND_SYSTEM_PROMPTtrueUse append-system-prompt flag in Claude Code
cursor.apiKeyCURSOR_API_KEYFallback Cursor agent API key
exa.apiKeyEXA_API_KEYExa API key
openai.apiKeyOPENAI_API_KEYOpenAI API key
openai.proxyUrlOPENAI_PROXY_URLOverride for OpenAI proxy URL
vertex.serviceAccountVERTEX_SERVICE_ACCOUNTtembo-ai-5935f185a273.jsonGoogle Vertex AI service account file

Integrations

KeyEnv VarDescription
atlassian.clientIdATLASSIAN_CLIENT_IDAtlassian OAuth client ID
atlassian.clientSecretATLASSIAN_CLIENT_SECRETAtlassian OAuth client secret
bitbucket.clientIdBITBUCKET_CLIENT_IDBitbucket client ID
bitbucket.clientSecretBITBUCKET_CLIENT_SECRETBitbucket client secret
bitbucket.webhookSecretBITBUCKET_WEBHOOK_SECRETBitbucket webhook secret
github.appIdGITHUB_APP_IDGitHub App ID
github.appNameGITHUB_APP_NAMEGitHub App name
github.botTagNameGITHUB_BOT_TAG_NAMEBot mention tag name
github.clientIdGITHUB_CLIENT_IDGitHub App client ID
github.clientSecretGITHUB_CLIENT_SECRETGitHub App client secret
github.clientUserEmailGITHUB_BOT_EMAILGitHub bot email
github.clientUserNameGITHUB_BOT_USERNAMEGitHub bot username
github.enforceLinkedGithubAccountENFORCE_LINKED_GITHUB_ACCOUNTRequire linked GitHub account for tasks
github.oauthClientIdGITHUB_OAUTH_CLIENT_IDGitHub OAuth app client ID
github.oauthClientSecretGITHUB_OAUTH_CLIENT_SECRETGitHub OAuth app client secret
github.overrideTokenGH_TOKENOverride GitHub token
github.privateKeyGITHUB_PRIVATE_KEYGitHub App private key
github.webhookSecretGITHUB_WEBHOOK_SECRETGitHub webhook secret
gitlab.clientIdGITLAB_CLIENT_IDGitLab OAuth client ID
gitlab.clientSecretGITLAB_SECRETGitLab OAuth client secret
gitlab.webhookSecretGITLAB_WEBHOOK_SECRETGitLab webhook secret
linear.appNameLINEAR_APP_NAMELinear app name
linear.appSlugLINEAR_APP_SLUGLinear app slug
linear.clientIdLINEAR_CLIENT_IDLinear client ID
linear.clientSecretLINEAR_CLIENT_SECRETLinear client secret
linear.webhookSecretLINEAR_WEBHOOK_SECRETLinear webhook secret
notion.clientIdNOTION_CLIENT_IDNotion OAuth client ID
notion.clientSecretNOTION_CLIENT_SECRETNotion OAuth client secret
sentry.appNameSENTRY_APP_NAMESentry app name
sentry.clientIdSENTRY_CLIENT_IDSentry OAuth client ID
sentry.clientSecretSENTRY_CLIENT_SECRETSentry OAuth client secret
slack.appIdSLACK_APP_IDSlack integration app ID
slack.clientIdSLACK_CLIENT_IDSlack OAuth client ID
slack.clientSecretSLACK_CLIENT_SECRETSlack OAuth client secret
slack.signingSecretSLACK_SIGNING_SECRETSlack webhook signing secret
supabase.clientIdSUPABASE_CLIENT_IDSupabase OAuth client ID
supabase.clientSecretSUPABASE_CLIENT_SECRETSupabase OAuth client secret

Sandbox

KeyEnv VarDefaultDescription
sandbox.docker.imageSANDBOX_DOCKER_IMAGEghcr.io/tembo-io/monorepo/sandbox:latestDocker image
sandbox.docker.keepContainersSANDBOX_DOCKER_KEEP_CONTAINERSfalseKeep containers after sandbox stops
sandbox.docker.memoryLimitSANDBOX_DOCKER_MEMORY_LIMIT16gHard memory limit
sandbox.docker.memoryReservationSANDBOX_DOCKER_MEMORY_RESERVATION4gSoft memory reservation
sandbox.docker.networkModeSANDBOX_DOCKER_NETWORK_MODEbridgeDocker network mode
sandbox.docker.workspaceStorageSANDBOX_DOCKER_WORKSPACE_STORAGEtmpfsWorkspace storage type (local or tmpfs)
sandbox.docker.workspaceStoragePathSANDBOX_DOCKER_WORKSPACE_STORAGE_PATH/var/lib/tembo/workspacesWorkspace storage path (when local)
sandbox.pushgateway.enabledSANDBOX_PUSHGATEWAY_ENABLEDfalsePush sandbox metrics to Pushgateway
sandbox.pushgateway.urlSANDBOX_PUSHGATEWAY_URLhttp://localhost:9091Pushgateway URL
sandbox.repositoryCache.enabledSANDBOX_REPOSITORY_CACHE_ENABLEDfalseEnable repository cache
sandbox.repositoryCache.pathSANDBOX_REPOSITORY_CACHE_PATH/mnt/user-cache/repositoriesRepository cache path
sandbox.sizeFilter.enabledSANDBOX_SIZE_FILTER_ENABLEDtrueFilter queue jobs by sandbox size
sandbox.sizeFilter.sizesSANDBOX_SIZE_FILTERComma-separated sandbox sizes this worker claims
sandbox.sizes.large.cpuSANDBOX_LARGE_CPU8vCPUs for large sandboxes
sandbox.sizes.large.diskSizeGbSANDBOX_LARGE_DISK_SIZE_GB100Disk (GB) for large
sandbox.sizes.large.memoryMbSANDBOX_LARGE_MEMORY_MB32768Memory (MB) for large
sandbox.sizes.medium.cpuSANDBOX_MEDIUM_CPU4vCPUs for medium sandboxes
sandbox.sizes.medium.diskSizeGbSANDBOX_MEDIUM_DISK_SIZE_GB50Disk (GB) for medium
sandbox.sizes.medium.memoryMbSANDBOX_MEDIUM_MEMORY_MB8192Memory (MB) for medium
sandbox.sizes.micro.cpuSANDBOX_MICRO_CPU2vCPUs for micro sandboxes
sandbox.sizes.micro.diskSizeGbSANDBOX_MICRO_DISK_SIZE_GB50Disk (GB) for micro
sandbox.sizes.micro.memoryMbSANDBOX_MICRO_MEMORY_MB4096Memory (MB) for micro
sandbox.sizes.ultra.cpuSANDBOX_ULTRA_CPU32vCPUs for ultra sandboxes
sandbox.sizes.ultra.diskSizeGbSANDBOX_ULTRA_DISK_SIZE_GB200Disk (GB) for ultra
sandbox.sizes.ultra.memoryMbSANDBOX_ULTRA_MEMORY_MB131072Memory (MB) for ultra
sandbox.sizes.xl.cpuSANDBOX_XL_CPU16vCPUs for xl sandboxes
sandbox.sizes.xl.diskSizeGbSANDBOX_XL_DISK_SIZE_GB200Disk (GB) for xl
sandbox.sizes.xl.memoryMbSANDBOX_XL_MEMORY_MB65536Memory (MB) for xl

Queue

KeyEnv VarDefaultDescription
queue.feedbackLoopTaskQUEUE_FEEDBACK_LOOP_TASKfeedback_loopTask name for feedback loop
queue.jobExecutionTimeoutQUEUE_JOB_TIMEOUT21600000 (6h)Max runtime for jobs (ms)
queue.jobVisibilityTimeoutQUEUE_JOB_VISIBILITY_TIMEOUT300000 (5m)Job visibility timeout (ms)
queue.longJobVisibilityTimeoutQUEUE_LONG_JOB_VISIBILITY_TIMEOUT3600000 (1h)Long job visibility timeout (ms)
queue.maxReadCountQUEUE_MAX_READ_COUNT2Max read count before job fails
queue.noJobSleepTimeQUEUE_NO_JOB_SLEEP_TIME5sSleep time when no job found
queue.solveIssueTaskQUEUE_SOLVE_ISSUE_TASKsolve_issueTask name for solve issue

Redis

KeyEnv VarDefaultDescription
redis.hostREDIS_HOSTlocalhostRedis host
redis.portREDIS_PORT6379Redis port

API

KeyEnv VarDefaultDescription
api.agentApiUrlAGENT_API_URLURL for the agent API
api.agentSecretKeyTEMBO_AGENT_API_SECRETtemborulesSecret key for agent auth
api.baseAPI_BASE_URLhttp://localhost:9854/Base URL for the API
api.clerkDashboardUrlCLERK_DASHBOARD_URLClerk dashboard URL
api.intercom.accessTokenINTERCOM_ACCESS_TOKENIntercom API access token
api.metricsSecretKeyTEMBO_METRICS_SECRET_KEYtemboSecret key for metrics
api.prefixAPI_PREFIXOptional prefix path for all routes
api.sentry.dsnSENTRY_DSNSentry DSN for error reporting
api.sentry.enabledSENTRY_ENABLEDtrueEnable Sentry
api.showErrorsAPI_SHOW_ERRORStrueShow errors in API response
api.slackInternal.appIdSLACK_APP_IDA098R0Q23GTInternal Slack app ID
api.slackInternal.botTokenSLACK_BOT_TOKENInternal Slack bot token
api.slackInternal.clientSecretSLACK_CLIENT_SECRETInternal Slack client secret
api.slackInternal.enabledSLACK_ENABLEDfalseEnable internal Slack
api.slackInternal.internalChannelIdSLACK_INTERNAL_CHANNEL_IDC099AEFTN65Internal Slack channel ID
api.slackInternal.signingSecretSLACK_SIGNING_SECRETInternal Slack signing secret

Agent

KeyEnv VarDefaultDescription
agent.healthChecks.enabledAGENT_HEALTH_CHECKS_ENABLEDfalseEnable health checks
agent.tasks.allowedAGENT_TASKS_ALLOWEDComma-separated allowed tasks
agent.tasks.disallowedAGENT_TASKS_DISABLEDComma-separated disabled tasks

MCP

KeyEnv VarDefaultDescription
mcp.enabledSuggestedServersMCP_ENABLED_SUGGESTED_SERVERSComma-separated list of suggested MCP server types to expose
mcp.temboMcpExecutableTEMBO_MCP_EXECUTABLE/run/current-system/sw/bin/temboPath to the tembo MCP executable

AWS

KeyEnv VarDefaultDescription
aws.accountIdAWS_ACCOUNT_IDAWS account ID
aws.ecsTaskRoleArnAWS_ECS_TASK_ROLE_NAMEECS task role ARN
aws.imageBucket.nameAWS_IMAGE_BUCKET_NAMES3 bucket for image uploads
aws.regionAWS_REGIONus-east-1AWS region
aws.registrationLambda.bucketPrefixAWS_CROSS_ACCOUNT_TEMPLATE_S3_BUCKETRegistration lambda S3 bucket
aws.registrationLambda.templateFileAWS_CROSS_ACCOUNT_TEMPLATE_FILEcross-account-cf-template.yamlRegistration lambda template file
aws.selfHostedReleases.bucketNameAWS_SELF_HOSTED_RELEASES_BUCKET_NAMES3 bucket for self-hosted releases
aws.selfHostedReleases.downloadUrlExpiresInSecondsAWS_SELF_HOSTED_RELEASES_DOWNLOAD_URL_EXPIRES_IN3600Download URL expiration (seconds)
aws.selfHostedReleases.manifestKeyAWS_SELF_HOSTED_RELEASES_MANIFEST_KEYreleases/manifest.jsonRelease manifest object key
aws.sqlExecutorLambda.bucketPrefixAWS_SQL_EXECUTOR_LAMBDA_S3_BUCKETSQL executor lambda S3 bucket
aws.sqlExecutorLambda.sourceKeyAWS_SQL_EXECUTOR_LAMBDA_S3_SOURCE_KEYsql-executor-lambda/index.zipSQL executor lambda source key

JWT

KeyEnv VarDefaultDescription
jwt.secretKeyTEMBO_JWT_SECRET_KEYtemboJWT secret key

Frontend

KeyEnv VarDefaultDescription
frontend.urlFRONTEND_URLhttp://localhost:3000Frontend URL

Cron

KeyEnv VarDefaultDescription
cron.enabledCRON_ENABLEDtrueEnable cron
cron.monitoring.enabledCRON_MONITORING_ENABLEDtrueEnable cron monitoring

Payments / Analytics

KeyEnv VarDescription
conversions.googleAds.clientIdGOOGLE_ADS_CLIENT_IDGoogle Ads OAuth client ID
conversions.googleAds.clientSecretGOOGLE_ADS_CLIENT_SECRETGoogle Ads OAuth client secret
conversions.googleAds.conversionActionIdGOOGLE_ADS_CONVERSION_ACTION_IDGoogle Ads conversion action ID
conversions.googleAds.customerIdGOOGLE_ADS_CUSTOMER_IDGoogle Ads customer ID
conversions.googleAds.developerTokenGOOGLE_ADS_DEVELOPER_TOKENGoogle Ads developer token
conversions.googleAds.refreshTokenGOOGLE_ADS_REFRESH_TOKENGoogle Ads OAuth refresh token
conversions.meta.accessTokenMETA_CONVERSIONS_ACCESS_TOKENMeta Conversions API access token
conversions.meta.pixelIdMETA_PIXEL_IDMeta pixel ID
conversions.twitter.accessTokenTWITTER_ADS_ACCESS_TOKENX/Twitter Ads access token
conversions.twitter.accessTokenSecretTWITTER_ADS_ACCESS_TOKEN_SECRETX/Twitter Ads access token secret
conversions.twitter.consumerKeyTWITTER_ADS_CONSUMER_KEYX/Twitter Ads consumer key
conversions.twitter.consumerSecretTWITTER_ADS_CONSUMER_SECRETX/Twitter Ads consumer secret
conversions.twitter.eventIdTWITTER_ADS_EVENT_IDX/Twitter conversion event ID
conversions.twitter.pixelIdTWITTER_ADS_PIXEL_IDX/Twitter pixel ID
imagor.secretKeyIMAGOR_SECRET_KEYImagor secret key
langfuse.baseUrlLANGFUSE_BASE_URLLangfuse base URL
langfuse.publicKeyLANGFUSE_PUBLIC_KEYLangfuse public key
langfuse.secretKeyLANGFUSE_SECRET_KEYLangfuse secret key
loops.apiKeyLOOPS_API_KEYLoops.so API key
posthog.apiKeyPOSTHOG_API_KEYPostHog API key
pylon.identitySecretPYLON_IDENTITY_SECRETPylon chat widget identity secret
resend.apiKeyRESEND_API_KEYResend.com API key
stripe.publishableKeySTRIPE_PUBLISHABLE_KEYStripe publishable key
stripe.secretKeySTRIPE_SECRET_KEYStripe secret key
stripe.webhookSecretSTRIPE_WEBHOOK_SECRETStripe webhook secret

LiteLLM

KeyEnv VarDefaultDescription
litellm.enabledLITELLM_ENABLEDfalseEnable LiteLLM
litellm.masterKeyLITELLM_MASTER_KEYLiteLLM master key
litellm.urlLITELLM_URLhttp://localhost:4000LiteLLM URL

Kernel

KeyEnv VarDescription
kernel.apiKeyKERNEL_API_KEYAPI key for the Kernel MCP server

Scanners

KeyEnv VarDefaultDescription
scanners.anyBug.maxFileSizeSCANNERS_ANY_BUG_MAX_FILE_SIZE10485760 (10mb)Max file size for bug scanner
scanners.slowQuery.minDurationSCANNERS_SLOW_QUERY_MIN_DURATION10Minimum slow query duration

Locks

KeyEnv VarDefaultDescription
locks.enabledLOCKS_ENABLEDfalseEnable distributed locks

Features / Misc

KeyEnv VarDefaultDescription
codeStorage.apiKeyCODE_STORAGE_API_KEYcode.storage API key
codeStorage.enabledCODE_STORAGE_ENABLEDfalseEnable code.storage sync
features.codebaseScanningCODEBASE_SCANNING_ENABLEDfalseEnable codebase scanning
logging.queriesLOGGING_QUERIESfalseLog database queries
telemetry.enabled(no env var)trueEnable telemetry
tembo.orgIdTEMBO_ORG_IDTembo internal org ID

VM / Cloud

KeyEnv VarDefaultDescription
azure.storageAccountKeyAZURE_STORAGE_ACCOUNT_KEYAzure storage account key
azure.storageAccountNameAZURE_STORAGE_ACCOUNT_NAMEAzure storage account name
cloud.providerCLOUD_PROVIDERawsCloud provider (aws, azure, gcs)
vm.guestDiskSizeVM_GUEST_DISK_SIZE50GVirtual disk size for QEMU guests
vm.goldenDirVM_GOLDEN_DIR/var/lib/tembo/goldenGolden QCOW2 cache directory
vm.snapshotDirVM_SNAPSHOT_DIR/var/lib/tembo/vmsPer-VM QCOW2 overlays directory
vmSnapshots.storageVM_SNAPSHOTS_STORAGEBucket/container for VM snapshots

Example config.json

{
  "port": 9854,
  "app": {
    "environment": "production"
  },
  "applicationBaseUrl": "https://tembo.your-domain.com",
  "database": {
    "url": "postgresql://postgres:yourpassword@localhost:5432/tembo"
  },
  "redis": {
    "host": "localhost",
    "port": 6379
  },
  "jwt": {
    "secretKey": "your-jwt-secret"
  },
  "betterAuth": {
    "secret": "your-better-auth-secret-min-32-characters",
    "oauth": {
      "github": {
        "clientId": "your-github-client-id",
        "clientSecret": "your-github-client-secret",
        "callbackUrl": "https://tembo.your-domain.com/api/auth/callback/github"
      }
    }
  },
  "anthropic": {
    "apiKey": "sk-ant-..."
  },
  "github": {
    "appId": "123456",
    "appName": "your-github-app",
    "clientId": "your-github-app-client-id",
    "clientSecret": "your-github-app-client-secret",
    "privateKey": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----",
    "webhookSecret": "your-webhook-secret",
    "clientUserName": "your-bot-username",
    "clientUserEmail": "bot@your-domain.com"
  },
  "frontend": {
    "url": "https://tembo.your-domain.com"
  },
  "sandbox": {
    "docker": {
      "image": "ghcr.io/tembo-io/monorepo/sandbox:latest"
    }
  }
}