Configuration and secrets
Application processes read environment variables with prefix FALCONTALON_. Dots in keys become underscores (key.api → FALCONTALON_KEY_API).
Inject these from whatever secret store you use. Rotating FALCONTALON_KEY_ENCRYPTION without re-encrypting existing configs rows makes those datasources unreadable.
API
| Env | Typical value | Purpose |
|---|---|---|
FALCONTALON_DB_URL | Postgres URL | Database |
FALCONTALON_LISTEN_ADDR | listen address | Bind |
FALCONTALON_CORS_ORIGINS | console origin (CSV) | Browser CORS |
FALCONTALON_KEY_API | shared secret | Workers and tooling |
FALCONTALON_KEY_ENCRYPTION | Base64 32-byte AES-GCM key | Encrypts credential fields in configs |
FALCONTALON_OIDC_ISSUER_URL | OIDC issuer URL (e.g. an AWS Cognito user pool) | Not a secret — OIDC token verification |
FALCONTALON_OIDC_CLIENT_ID | OIDC app client ID | Checked as the token audience |
FALCONTALON_PYTHON_BIN | python3 | Custom transformers |
FALCONTALON_WORKER_MODE | cluster | Remote workers only |
FALCONTALON_WORKER_REAP_AFTER_MS | 90000 | Stale worker deletion |
FALCONTALON_ALLOW_PRIVATE_URLS | false | Keep false; SSRF protection |
FALCONTALON_DEBUG | unset / false | Access logs |
Worker
| Env | Typical value | Required |
|---|---|---|
FALCONTALON_API_URL | API base URL reachable from workers | yes |
FALCONTALON_KEY_API | same as API | yes |
FALCONTALON_PYTHON_BIN | python3 | |
FALCONTALON_GLOBAL_SLOTS | 4 | Concurrent executions per worker process |
Optional timing knobs: FALCONTALON_DISPATCH_TICK_MS (2000), FALCONTALON_HEARTBEAT_TICK_MS (10000), FALCONTALON_CANCEL_POLL_TICK_MS (1000).
Console
| Env | Purpose |
|---|---|
VITE_API_BASE_URL | Public API URL |
VITE_KAFKA_UI_URL | Optional Kafka UI URL (button hidden when unset) |
VITE_LISTEN_NAMESPACE | Namespace in computed TCP/UDP listen addresses. The chart sets this to the release namespace. Empty hides the address |
VITE_OIDC_AUTHORITY | OIDC issuer URL (required unless OIDC is disabled) |
VITE_OIDC_CLIENT_ID | OIDC app client ID (required unless OIDC is disabled) |
VITE_OIDC_REDIRECT_URI | Callback URL registered with the provider (optional, defaults to /callback on the current origin) |
VITE_OIDC_COGNITO_DOMAIN | AWS Cognito Hosted UI domain, used only for sign-out (Cognito has no standard end_session_endpoint) |
VITE_OIDC_AUTH_ENABLED | true (default) or false to skip OIDC and use API-key auth only |
VITE_CSP | Optional full Content-Security-Policy (overrides auto assembly) |
VITE_CSP_CONNECT_SRC | Optional extra connect-src origins, space-separated (auto CSP only) |
Migrations
| Var | Use |
|---|---|
DATABASE_URL | dbmate (same connection string as FALCONTALON_DB_URL) |
Datasource encryption
Fields tagged for encryption on datasource models are AES-GCM encrypted in configs.source / configs.sink JSON. GET decrypts them for the editor.
Keep FALCONTALON_ALLOW_PRIVATE_URLS=false. Enabling it lets HTTP/S3 datasources target private networks.