Configuration

Everything is an environment variable, and nothing needs one: with none set, the factory runs on a laptop with DuckDB in var/, no door and no agents.

On a server the variables live in /etc/dataproductfactory.env — owned by root, mode 600, read by the systemd unit — because a unit file is readable by every user on the machine. On a laptop they can go in .env at the repository root, which git ignores.

Some connection settings can also be typed into the application's Connections page. Those are stored in the record and fill the gaps the environment leaves: the environment always wins, and a secret is never shown back once saved.

This table is generated from dpf/envvars.py. A variable the code reads and the registry does not document fails the build.

The application

Variable	Default	What it does
DPF_DB	var/dpf.sqlite3	Where the SQLite control-plane database lives — every product, requirement, contract, release and audit entry. A systemd unit typically overrides this to a StateDirectory the service may write to.
PORT	8200	The port the dev server binds to; it wins over the --port flag so a supervisor can assign one.
DPF_ENV	—	Set to production to make startup refuse to run without SECRET_KEY, instead of quietly using a default meant only for a laptop.
DPF_PREFIX	—	The path this application is mounted under on somebody else's domain, e.g. /factory. nginx passes it through untouched; this tells Flask, so url_for builds the right URL and the app still runs at / locally with nothing set.
DPF_ACTOR	—	Names who the audit log credits for an action taken outside a session — a scheduled job, a seeding script, the CLI. Left unset, those events carry no actor rather than an invented one.
DPF_WORKFLOW	—	Points at a workflow YAML to run instead of the one shipped with the application, for a different process definition.
DPF_BUILD	—	The short commit hash reported as running, shown next to the version number. Unset, it falls back to a BUILD file the deploy writes, then to git.

Identity and sign-in

Variable	Default	What it does
DPF_IDENTITY	open	Which door admits a reader: open (none, a laptop), site (the site next door signs you in), link (one key in the URL, then a cookie), site+link (both, named rather than inferred), or entra (Microsoft Entra ID decides identity and role). Exactly one may be set. One of open, site, link, site+link, entra.
DPF_GATE	—	The older spelling of DPF_IDENTITY=site, read when DPF_IDENTITY itself is not set. Setting both is refused at startup unless they agree.
DPF_SITE_URL	https://gedankenexperiment.xyz	The site that owns the session cookie and the login page a reader is sent to, under DPF_IDENTITY=site, link or site+link.
SECRET_KEY	—	Signs the session cookie that identity and sign-in rely on, including the Entra flow. Mounted inside another site, it must be that site's key, or the shared cookie stops verifying. Required when DPF_IDENTITY=site, link, site+link or entra, or DPF_ENV=production. Secret.
DPF_SECRET_KEY	—	The same signing secret as SECRET_KEY, read when that is unset — for a deployment that keeps every setting under the DPF_ prefix. Secret.
ALLOWED_EMAILS	—	Comma-separated Google account emails let in under DPF_IDENTITY=site or site+link. Re-read on every request, so removing somebody takes effect on their next click. Required when DPF_IDENTITY=site or site+link.
DPF_LINK_KEY	—	The shared secret accepted in the unlisted link's ?k= parameter, under DPF_IDENTITY=link or site+link. Rotating it signs out every session the old key had admitted. Required when DPF_IDENTITY=link or site+link. Secret.
DPF_ENTRA_TENANT_ID	—	The Entra directory (tenant) id this deployment signs in against, as a GUID. Required when DPF_IDENTITY=entra.
DPF_ENTRA_CLIENT_ID	—	The application (client) id of this deployment's Entra app registration. Required when DPF_IDENTITY=entra.
DPF_ENTRA_CLIENT_SECRET	—	The app registration's client secret, used alongside PKCE in the authorization code exchange. Required when DPF_IDENTITY=entra. Secret.
DPF_ENTRA_REDIRECT_URI	—	The OAuth callback URL for the Entra sign-in flow; it must match the app registration exactly. Required when DPF_IDENTITY=entra.
DPF_ENTRA_ROLE_MAP	—	Maps Entra groups to roles, as comma-separated role=group pairs (a source owner also names its system, as source_system:oms=). Read fresh on every request, so removing a group takes effect on the next click. Required when DPF_IDENTITY=entra.
DPF_ENTRA_SESSION_HOURS	8	How many hours an Entra session lasts before sign-in is asked again. Short on purpose: group membership is only as current as the token.
DPF_ENTRA_AUTHORITY	https://login.microsoftonline.com	The Entra authority host, overridden for a sovereign cloud such as Azure Germany or a US government tenant instead of the public login.microsoftonline.com.

The warehouse

Variable	Default	What it does
DPF_WAREHOUSE_URL	—	Chooses the warehouse engine: empty or a bare path means DuckDB at that path, duckdb:// says the same explicitly, and databricks:// means Databricks, configured by DPF_DATABRICKS_*.
DPF_WAREHOUSE	var/warehouse.duckdb	Where the DuckDB warehouse file lives when DPF_WAREHOUSE_URL does not say otherwise.
DPF_DATABRICKS_HOST	—	The Databricks workspace hostname the SQL connection is made to, without the https:// prefix. Also settable on the Connections page.
DPF_DATABRICKS_HTTP_PATH	—	The SQL warehouse's HTTP path, copied from its Connection details tab. Also settable on the Connections page.
DPF_DATABRICKS_TOKEN	—	A personal access token, or a service principal's, that the warehouse connection authenticates with. Secret. Also settable on the Connections page.
DPF_DATABRICKS_CATALOG	—	The Unity Catalog catalog this connection works in; the data catalogue reads the same one through this credential. Also settable on the Connections page.
DPF_DATABRICKS_SCHEMA	—	The default schema for the session. Optional; the catalog is used unqualified when this is unset. Also settable on the Connections page.
DPF_DATABRICKS_READ_ONLY	no	Yes when the token holds SELECT and nothing more; build, promote and rollback are then refused here rather than by the driver. One of no, yes. Also settable on the Connections page.

The agents

Variable	Default	What it does
ANTHROPIC_API_KEY	—	The API key the agents authenticate to Anthropic with. Secret. Also settable on the Connections page.
ANTHROPIC_AUTH_TOKEN	—	An alternative to ANTHROPIC_API_KEY that the Anthropic SDK also reads; either one is enough to let an agent step run. Secret.
DPF_LLM_DATA	full	What the agents may send about source data: full sends profiles, samples and extremes; metadata sends counts only and no values; off makes no model calls at all. One of full, metadata, off. Also settable on the Connections page.

The data catalogue

Variable	Default	What it does
DPF_CATALOG	file	Which data-catalogue connector answers search and sync: file (a JSON export), informatica, or unity (read through the Databricks connection). Defaults to the bundled JSON export so the catalogue page works before anybody has credentials. One of file, informatica, unity.
DPF_CATALOG_FILE	dpf/examples/catalog.json	The JSON file the file catalogue reads, when DPF_CATALOG is file or unset. Unset, it reads the example catalogue shipped with the application.
DPF_INFA_USER	—	An Informatica IDMC user able to log in and search the catalogue. Also settable on the Connections page.
DPF_INFA_PASSWORD	—	That user's password. Secret. Also settable on the Connections page.
DPF_INFA_POD	https://dm-us.informaticacloud.com	The IDMC pod hostname, for an organisation not on the default dm-us region.

Access requests (ServiceNow)

Variable	Default	What it does
DPF_SNOW_INSTANCE	—	The ServiceNow instance name, e.g. acme in acme.service-now.com. Also settable on the Connections page.
DPF_SNOW_USER	—	A service account with rights to open an access request. Also settable on the Connections page.
DPF_SNOW_PASSWORD	—	That service account's password. Secret. Also settable on the Connections page.
DPF_SNOW_TABLE	sc_request	Which ServiceNow table an access request is created in. The generic sc_request works everywhere; a real deployment usually has a catalogue item and points this at sc_req_item instead.

The delivery tracker

Variable	Default	What it does
DPF_TRACKER	—	Which delivery tracker a build plan is pushed to: ado or jira. Unset, the app uses whichever one has credentials, preferring Jira, and otherwise reads the plan in Azure DevOps's vocabulary. One of ado, jira. Also settable on the Connections page.
DPF_ADO_ORG	—	The organisation segment of dev.azure.com/ that work items are created in. Also settable on the Connections page.
DPF_ADO_PROJECT	—	The Azure DevOps team project the work items are filed under. Also settable on the Connections page.
DPF_ADO_PAT	—	A personal access token with Work Items (Read & write), for creating and linking work items. Secret. Also settable on the Connections page.
DPF_ADO_WORK_ITEM_TYPE	User Story	The process's own name for a story — User Story on Agile, Product Backlog Item on Scrum. Optional; creating the wrong one fails rather than guessing. Also settable on the Connections page.
DPF_ADO_AREA_PATH	—	An existing area path to file work items under, instead of a tag. Optional; a path that does not already exist rejects the whole create. Also settable on the Connections page.
DPF_JIRA_URL	—	The Jira site this pushes issues to, e.g. https://acme.atlassian.net. Also settable on the Connections page.
DPF_JIRA_PROJECT	DATA	The project key issues are created in, e.g. DATA. Also settable on the Connections page.
DPF_JIRA_EMAIL	—	The account the Jira API token belongs to. Also settable on the Connections page.
DPF_JIRA_TOKEN	—	An API token with Create issues and Link issues permission in that project. Secret. Also settable on the Connections page.
DPF_JIRA_ISSUE_TYPE	Story	The issue type issues are filed as. Optional; defaults to Story. Also settable on the Connections page.