Configuration Reference

All environment overlays use the FLUVIUS_ prefix. Defaults live in src/fluvius/<module>/_meta/defaults.py.

Area	Keys
Base	CONFIG_FILE, DEBUG, DIAGNOSTICS, LOG_LEVEL, LOG_FORMAT
Data	DB_URL, DB_DSN, DB_CONFIG, DB_STATEMENT_TIMEOUT_MS, SQLALCHEMY_DIALECT
Domain	CQRS_ID_TYPE, DENY_UNKNOWN_FIELDS, IF_MATCH_VERIFY, TRACK_MUTATION, SQL_LOG_DB_DSN
HTTP	API_BASE, APPLICATION_ROOT, API_ZONE, APPLICATION_SECRET_KEY, RESPONSE_CUSTOM_ENABLED
Auth	AUTH_REALMS_CONFIG, SESSION_COOKIE, COOKIE_HTTPS_ONLY, VALIDATE_CSRF_TOKEN, SAFE_REDIRECT_DOMAINS
Query	DEFAULT_QUERY_LIMIT, MAX_QUERY_LIMIT, MAX_QUERY_PAGE, ALLOW_SELECT_ESCAPE
Work queue	BUS_URL, WORKQ_URL, WORKQ_RESULT_BACKEND_URL, WORKQ_DEFAULT_QUEUE_NAME
MCP	MCP_SECRET_KEY, MCP_TOKEN_AUDIENCE, MCP_TOKEN_TTL_SECONDS, MCP_STATELESS_HTTP
Transport	NATS_URL, SVC_TRANSPORT_URL, RTC_WIRE_ENCODING, RTC_TRANSPORT_ENCODING, MAX_MESSAGE_BYTES
Media	MEDIA_DB_DSN, DEFAULT_FILESYSTEM, FILESYSTEM_CONFIG_PATH, MAX_FILE_SIZE, CHUNK_SIZE

URL precedence

• Database: FLUVIUS_DB_URL, then DB_URL.
• Shared bus: FLUVIUS_BUS_URL, then BUS_URL, then legacy NATS_URL.
• A module-specific value such as FLUVIUS_WORKQ_URL overrides the shared bus for that module.

Safe production defaults

• Keep HTTPS-only cookies and CSRF validation enabled.
• Set explicit application and MCP secrets.
• Do not use FLUVIUS_DEBUG in production.
• Use a durable PostgreSQL, Redis, or NATS work-queue backend; no implicit in-memory backend exists.
• Validate startup wiring and policy metadata rather than suppressing configuration failures.