Settings (.env)

The full address people open, such as https://automations.example.com, with the port when it is not 443.

Opens every password, API key and connection GoRunner stores: 64 hexadecimal characters (openssl rand -hex 32).

all: everything on this server.

The built-in database's password.

The built-in queue's password.

The keys of the built-in object storage (S3).

The keys of the built-in object storage (S3).

How people reach GoRunner.

Only with your own proxy: where it reaches GoRunner, [IP:]PORT.

Who may tell GoRunner the caller's address.

The name people open, such as automations.example.com.

acme (the default): a free certificate from Let's Encrypt.

on: every page tells browsers to use https for this address for a year (Strict-Transport-Security: max-age=31536000, this name only, not its subdomains). The setup writes on when it gets a certificate from Let’s Encrypt.

The server ports Caddy listens on.

The server ports Caddy listens on.

Only when a proxy of yours stands in front of Caddy: that proxy's own address or range.

The private networks GoRunner keeps for Caddy, as three numbers such as 172.29.253: one joins Caddy to the app, the other carries Caddy's published ports.

A Resend API key. Used when set.

Any SMTP server, used when there is no Resend key.

Any SMTP server, used when there is no Resend key.

Any SMTP server, used when there is no Resend key.

Any SMTP server, used when there is no Resend key.

How the connection is encrypted.

The sender, such as GoRunner <no-reply@example.com>.

Optional. Set it, and only this address can create the first admin account, even with the setup code.

true. Leave it: GoRunner refuses to start without sign-in on a server.

false: nobody can sign up on their own, and people join by invitation.

true: with GORUNNER_ADMIN_EMAIL empty, nobody may create the first admin.

Not set by default, which keeps it closed.

Not needed: load the license in the dashboard instead, or paste it when the setup asks.

bundled: the built-in database on this server.

Your own database, as separate fields.

Your own database, as separate fields.

Your own database, as separate fields.

Your own database, as separate fields.

Your own database, as separate fields.

disable, require, verify-ca or verify-full.

The certificate authority to check the database's certificate with, as a file in certs/: /certs/rds.pem.

Your own database as one address instead, such as postgresql://user:password@host:5432/gorunner?sslmode=require.

The built-in database's connection limit.

bundled or external, as for the database. Your own Redis must be 6.2 or later, set never to delete keys (maxmemory-policy noeviction).

Your own Redis, as separate fields.

Your own Redis, as separate fields.

Your own Redis, as separate fields.

Your own Redis, as separate fields.

Your own Redis, as separate fields.

true for an encrypted connection, as most managed Redis services need.

Your own Redis as one address instead, such as redis://user:password@host:6379/0 (rediss:// for TLS).

bundled: the built-in object storage (S3).

Your bucket: the store's address (such as https://s3.eu-central-1.amazonaws.com), the bucket (gorunner) and its region (us-east-1).

Your bucket: the store's address (such as https://s3.eu-central-1.amazonaws.com), the bucket (gorunner) and its region (us-east-1).

Your bucket: the store's address (such as https://s3.eu-central-1.amazonaws.com), the bucket (gorunner) and its region (us-east-1).

true for MinIO and SeaweedFS, false for AWS S3.

Step data larger than this many KB goes to storage; smaller stays in the database.

How long one storage call may take (15 seconds), and how often it is tried (4).

How long one storage call may take (15 seconds), and how often it is tried (4).

when_required, for an S3-compatible store that refuses the checksums newer AWS clients add.

when_required, for an S3-compatible store that refuses the checksums newer AWS clients add.

How many worker containers run on this server.

How many runs one worker runs at once.

How many Test step and connection tests from the editor one worker serves at once.

How many Keel conversations one worker serves at once.

How many notifications to your server one worker sends at once.

The memory one worker may use.

How long a worker may finish its runs during an update before it is stopped.

The memory each of the app's two copies may use.

The most database connections each GoRunner process keeps. The setup and the update size it from the check; empty means 50.

How many database connections the check keeps free beside GoRunner's own, for pg_dump and an administrator's session.

The fewest each process keeps open.

A soft memory goal for every GoRunner process, below the memory limits above, such as 900MiB.

The time zone of the processes' logs, and of the time a password lockout ends.

Empty (the default): no private address.

The proxy for everything GoRunner calls outside, such as http://user:password@proxy.example.com:3128.

The proxy for everything GoRunner calls outside, such as http://user:password@proxy.example.com:3128.

Names reached directly, separated by commas.

name (the default) or ip: what the proxy is asked to connect to, for the addresses other people chose.

Runs that finished longer ago than this are deleted every hour, with their data.

Audit log rows older than this many days are deleted every hour.

Credential use GoRunner itself recorded (a run, a schedule or a poll using a connection) older than this many days is deleted every hour.

false stops every organization's event streaming on this installation.

The largest input or output one step may hold.

Requests a minute to the API for one caller: an API token, a signed-in session or an embed session, else one address.

Requests a minute from one address to webhooks, and to a connection sign-in’s launch and return pages.

Requests a minute from one address to AI app sign-in: discovery, register, authorize and token.

Requests a minute for one embed API key, counted across every app process.

Requests a minute for one embedded account, counted across every app process.

Login codes a minute for one person of one embedded account, so one page reloading in a loop stops at that person.

Renewals a minute for one embed session and the sessions renewed from it.

How long the embed may keep renewing its own session after a login code, from 1 to 24 hours.

Other websites allowed to call the API from a browser, separated by commas.

How many runs of one organization may wait in line for a free slot.

How many runs of one workflow may wait in line, so one flooded webhook cannot fill its organization's room.

Requests a minute for one embed API key to the AI app sign-in requests (oauth-requests/*), counted across every app process, in their own window apart from EMBED_API_RATE_LIMIT. A Docker install passes it to the app from v2026.10.31; before, only the default applied.

Memory one Code step or {{ }} expression may use, in MB (256; 64 to 16384).

Request bodies and whole payload reads one API holds at once, in MB (0: no limit).

How much the log says: debug, info, warn or error.

text, or json for a log collector.

Your OpenTelemetry tool's address and key: metrics, traces and logs.

Your OpenTelemetry tool's address and key: metrics, traces and logs.

The name GoRunner appears under in your tool.

Keep fewer traces on a busy installation.

Keep fewer traces on a busy installation.

A /metrics page for Prometheus, inside the Docker network, behind the token.

A /metrics page for Prometheus, inside the Docker network, behind the token.

Crashes and errors to your Sentry project.

true: the app's line for each request also names the caller's address (as your proxy reported it, from a trusted proxy only) and its browser, and requests for unknown addresses are logged too.

With automatic HTTPS, on: Caddy writes one line for each request with the caller's address.

/api/health and /api/ready say only ok or unavailable to anyone but the server itself.

http/protobuf (default) or grpc.

One signal elsewhere: a full address (used as given) and its own headers.

One signal elsewhere: a full address (used as given) and its own headers.

One signal elsewhere: a full address (used as given) and its own headers.

One signal elsewhere: a full address (used as given) and its own headers.

One signal elsewhere: a full address (used as given) and its own headers.

One signal elsewhere: a full address (used as given) and its own headers.

none turns one signal off (default otlp).

none turns one signal off (default otlp).

none turns one signal off (default otlp).

Extra resource attributes, key=value,key=value, such as team=platform.

How often metrics are pushed, in milliseconds.

true: OpenTelemetry never starts, whatever else is set.

Database and Redis calls as spans (they multiply trace volume), and a traceparent header on the HTTP calls steps make.

Database and Redis calls as spans (they multiply trace volume), and a traceparent header on the HTTP calls steps make.

A /metrics page for Prometheus on every API and worker container (port 9464 on this network, not published).

Add workflow_id to the run and step metrics (one series per workflow: costly).

Crashes and errors (the server's, and the dashboard's relayed through it) to Sentry.

false: drop the dashboard's browser error reports instead of logging them.

Not needed: set up the Google sign-in app under Platform › Settings › OAuth apps instead, which takes its place.

Not needed: set up the Google sign-in app under Platform › Settings › OAuth apps instead, which takes its place.

Off. Notification addresses and your own OAuth apps' token addresses must be https on the public internet.

Empty. off: the assistant builds without its compile step.

The installed version.

Where the images come from, such as registry.example.com/ralve-org.

What runs on this server: the role, one name for each built-in store (postgres, redis, storage), and caddy with automatic HTTPS.

Written by the setup and the update (the relay's tag by the update only) for two small containers that must never restart during an update: the one that holds the app's address open, and the one in front of the object storage.

The kernel setting of the container that holds the app’s address open. The update writes it.

Written by the setup and the update (the relay's tag by the update only) for two small containers that must never restart during an update: the one that holds the app's address open, and the one in front of the object storage.

The prefix of the container and volume names.

off: a worker takes runs while it has slots, whatever its memory and sandbox say.

The sandbox around Code steps and expressions.

1: hand every script every earlier step, instead of only the ones it reads.

Synchronous callers (webhooks, forms, ?wait=) one API waits for at once, one organization's share of them (default an eighth), and the MB of their answers it builds at once.

Synchronous callers (webhooks, forms, ?wait=) one API waits for at once, one organization's share of them (default an eighth), and the MB of their answers it builds at once.

Synchronous callers (webhooks, forms, ?wait=) one API waits for at once, one organization's share of them (default an eighth), and the MB of their answers it builds at once.

The client IP address on audit rows older than this many days is removed hourly; the rows stay.

AI apps that sign in with OAuth (ChatGPT, Claude, VS Code, Cursor…): their discovery documents, /oauth/register, /oauth/token and /oauth/revoke answer any website (CORS *, no cookies), so an app running in a browser can sign in.

More app callbacks AI apps may register: whole URIs, comma-separated, no query, for an app whose callback GoRunner does not know (https, loopback, Cursor's and Raycast's need nothing here).