Configure Teleos with a .env file next to docker-compose.yml (teleos up writes one for you). Never commit it.
| Variable | Description |
|---|
GITHUB_TOKEN | Read-only GitHub token. The launcher fills it from gh auth token; on a server use a read-only fine-grained token |
SECRET_KEY | Long random string for signing sessions. Generate once; keep it secret |
DEBUG | Set to false on any server |
ALLOWED_HOSTS | Comma-separated hostnames Teleos answers to |
CSRF_TRUSTED_ORIGINS | Origins allowed to submit forms, e.g. https://teleos.example.com |
| Variable | Default | Description |
|---|
PORT | 8000 | Host port |
LOG_LEVEL | INFO | DEBUG, INFO, WARNING or ERROR |
SCHEDULER_ENABLED | true | Background sync schedule |
DATABASE_PATH | set by compose | SQLite file location inside the container |
TELEOS_SIGNATURES_PATH | bundled | Use a newer agent-signature definitions file without upgrading |
TELEOS_TIER / TELEOS_LICENSE_KEY | | Licensed tier (pilot: not enforced) |
GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY or GITHUB_APP_PRIVATE_KEY_PATH | | GitHub App credentials (in progress) |
| Variable | Description |
|---|
DISABLE_AUTH | Skip the login screen. Requires DEBUG=true; Teleos refuses to start otherwise. Only applies to requests from this machine |
TELEOS_DEV_USER | Which user DISABLE_AUTH signs you in as; switch per session with ?dev_as=<username> |
python3 -c "import secrets; print(secrets.token_urlsafe(50))"
