Database & Storage

Atlas is configured entirely through environment variables, prefixed ATLAS_ (plus two unprefixed POSTGRES_* ones consumed by compose.yaml). They’re read once per process at startup, either from the real environment or from a .env file — api/.env.example is the canonical, fully-commented list to copy from:

cp api/.env.example api/.env
# edit api/.env

No settings table, no admin “system config” page: a value that changes behavior for every request — which secret signs a session, which OIDC provider to trust — belongs to the deployment, not to data a superuser could edit at runtime and accidentally lock everyone out with. It also keeps docker compose and a Kubernetes-style deployment symmetric: one configuration mechanism for both.

Variable	Default	Description
`ATLAS_DATABASE_URL`	required	Postgres connection string, `postgresql+psycopg://...`.
`ATLAS_S3_STAGING_BUCKET`	required	The one bucket `tusd` uploads into. Never browsed directly — each finished upload is relayed into its destination workspace’s bucket.
`ATLAS_BUCKET_NAME_PREFIX`	`atlas`	Naming convention for buckets created by the app — not enforced in code, just what an IAM policy scoping `s3:CreateBucket` would key off.
`ATLAS_S3_ENDPOINT_URL`	unset (real AWS)	Only set against a non-AWS S3-compatible endpoint (e.g. MinIO).
`ATLAS_AWS_ACCESS_KEY_ID`	unset	Leave unset, along with the two below, to use boto3’s own credential chain (env vars, `~/.aws/credentials`, an IAM role) — the recommended path outside of a local S3-compatible service with throwaway keys.
`ATLAS_AWS_SECRET_ACCESS_KEY`	unset	Paired with the access key id above.
`ATLAS_AWS_SESSION_TOKEN`	unset	Only needed for temporary credentials (STS / SSO / AssumeRole).

See Connect an S3 bucket for a walkthrough of setting these against real AWS versus a local MinIO.