Docker environment variables

These are the settings the Figaf Tool container accepts. Put them in the environment file you pass to docker run.

Defaults apply when the variable isn’t set.

1. Database

Variable Default Description

IRT_DB_TYPE

postgresql

Database type: postgresql, oracle or mssql.

IRT_DB_HOST

localhost

Database host name.

IRT_DB_PORT

5432

Database port.

IRT_DB_NAME

irt

Database name.

IRT_DB_USER

-

Database user.

IRT_DB_PASSWORD

-

Database password.

IRT_DB_JDBC_URL

-

A complete JDBC URL. When it’s set, it’s used instead of the host, port and name above.

IRT_DB_SSLMODE

require

PostgreSQL SSL mode. Use disable for a database that doesn’t accept TLS connections.

IRT_DB_AUTH_MODE

password

password, or azure-entra to authenticate with a Microsoft Entra access token instead of IRT_DB_PASSWORD. See Microsoft Entra authentication for Azure PostgreSQL.

IRT_DB_AZURE_MANAGED_IDENTITY_CLIENT_ID

-

Client id of a user-assigned managed identity. Empty means the default Azure credential chain.

IRT_DB_APPEND_PG_TRGM_SCHEMA_TO_SEARCH_PATH

false

Set to true on Azure when the pg_trgm extension isn’t in the schema the application uses.

2. Address and port

Variable Default Description

IRT_CONTAINER_PORT

8089

Port the application listens on inside the container.

SERVER_PROTOCOL

https

Protocol users reach the application on.

SERVER_HOST

-

Host name users reach the application on.

SERVER_PORT

443

Port users reach the application on.

IRT_REPORT_URL

Built from the three settings above

URL written into reports and notifications.

IRT_SAML_BASE_URL

Same as IRT_REPORT_URL

Base URL used in SAML requests.

3. HTTPS and certificates

Variable Default Description

IRT_SSL_KEY_STORE

-

Key store file path inside the container. The three settings below apply only when this one is set.

IRT_SSL_KEY_STORE_PASSWORD

-

Key store password.

IRT_SSL_KEY_STORE_TYPE

-

Key store type, for example PKCS12.

IRT_SSL_KEY_STORE_ALIAS

-

Key alias.

USE_SYSTEM_CA_CERTS

-

When set to any value, certificates placed in /certificates are added to the Java trust store at start-up.

4. Memory and JVM

Variable Default Description

XMX_VALUE

4G

Maximum Java heap size.

ADDITIONAL_JVM_ARGUMENTS

-

Extra JVM arguments, for example proxy settings.

ADDITIONAL_IRT_PARAMETERS

-

Application properties, space separated.

5. Logging

Variable Default Description

STDOUT_FILTER_LEVEL

DEBUG

Lowest log level written to the container output.

LOGS_TOTAL_SIZE_CAP

10GB

Maximum total size of the logs folder.

6. Instance monitoring

Variable Default Description

ENABLE_INSTANCE_MONITORING

true

Enables the Glowroot agent and the /instance-monitoring endpoint.

INSTANCE_MONITORING_PORT

4000

Port of the built-in Glowroot UI.

ENABLE_DIRECT_ACCESS_TO_INSTANCE_MONITORING_PORT

false

Set to true to let the Glowroot UI listen on all addresses.

INSTANCE_MONITORING_CONFIG_FOLDER

/glowroot

Folder holding the Glowroot configuration and data.

INSTANCE_MONITORING_AGENT_MODE

false

Set to true to report to a central Glowroot collector instead of running the built-in UI.

INSTANCE_MONITORING_AGENT_ID

-

Agent id reported to the collector. Used only in agent mode.

INSTANCE_MONITORING_COLLECTOR_ADDRESS

-

Address of the central Glowroot collector. Used only in agent mode.

7. Login

IRT_LOGON_MODE selects how users log in and takes the same values as the irt.logon-mode application property: LOCAL_USERS (default), SSO_USERS or MIXED_MODE.

The two SSO modes need an identity provider. These variables are required for them, and the container refuses to start if any of them is missing:

SSO_LOGIN_PAGE_URL, SSO_REGISTRATION_NAME, SSO_REGISTRATION_CLIENT_ID, SSO_REGISTRATION_CLIENT_SECRET, SSO_REGISTRATION_REDIRECT_URI, SSO_PROVIDER_AUTHORIZATION_URI, SSO_PROVIDER_TOKEN_URI, SSO_PROVIDER_USER_INFO_URI, SSO_PROVIDER_JWK_SET_URI, SSO_PROVIDER_USERNAME_ATTRIBUTE.

These are optional: SSO_LOGOUT_URL, SSO_LOGOUT_CALLBACK_PARAM_NAME, SSO_LOGOUT_CALLBACK_URL, SSO_USERNAME_CLAIMS_MAPPING, SSO_DISPLAY_NAME_CLAIMS_MAPPING, SSO_ROLES_CLAIMS_MAPPING.

Each one sets the identically named irt.sso. or spring.security.oauth2.client. setting, so the SSO configuration example explains what to put in them.