Solidtime configuration reference

Configuration lives in dp-infra/solidtime/config.yaml (non-secret). It is rendered into a solidtime-env ConfigMap plus per-container secret environment variables. Secrets come from External Secrets Operator (ESO).

config.yaml

Key	Example	Notes
namespace	solidtime	Target namespace
domain	time.kup.tirol	Ingress host and APP_URL
versions.solidtime	0.16.0	Pinned image tag; never latest
versions.postgresMajor	18	CNPG image major version
versions.gotenberg	8	Gotenberg image tag
storage.postgres	10Gi	CNPG volume size
replicas.http	2	Web replicas; scheduler and worker are always 1
s3.files	hel1, hetzner-s3-hel1	Hot app-file bucket
s3.backups	fsn1, hetzner-s3	Cold database-backup bucket
smtp.from	noreply@kleinundpartner.at	Must be a Mailjet-verified sender domain
superAdmins	jk@kleinundpartner.at	Comma-separated; granted admin on registration
enableRegistration	false	"true" is open signup, "false" is invite-only; see How to manage members before changing
backupSchedule	0 30 2 * * *	CNPG cron; the seconds field comes first

Environment variables

Warning

Solidtime’s environment variable names are not all Laravel defaults. The S3 disk uses S3_*, not AWS_*. The names below are validated against the official configuration docs and the image’s config/*.php files.

App and auth

The app secrets come from solidtime-app-secrets.

APP_KEY

Laravel key in the form base64:<32 bytes>.

PASSPORT_PRIVATE_KEY, PASSPORT_PUBLIC_KEY

Passport OAuth RSA keypair. Both are required.

APP_URL

https://time.kup.tirol.

APP_ENABLE_REGISTRATION

false for invite-only.

SUPER_ADMINS

Comma-separated admin emails.

LOG_CHANNEL

stderr, so logs appear in kubectl logs.

You must never rotate APP_KEY or the Passport keys. Rotating them invalidates all encrypted data, sessions, and OAuth tokens. scripts/bootstrap-secrets.sh reuses the existing keys when the source secret already exists.

Database

The host comes from the ConfigMap and the credentials from the CNPG-generated solidtime-postgres-app secret.

Set DB_CONNECTION=pgsql, DB_HOST=solidtime-postgres-rw, DB_PORT=5432, DB_DATABASE=solidtime. DB_USERNAME and DB_PASSWORD come from the secret.

Cache, queue, and sessions

Set CACHE_STORE=database, QUEUE_CONNECTION=database, SESSION_DRIVER=database. The worker runs WORKER_COMMAND (php artisan queue:work --tries=3 --sleep=3 --max-time=3600). The scheduler runs migrations on start through AUTO_DB_MIGRATE=true.

Mail

The credentials come from solidtime-smtp-secrets (the Mailjet API key and secret).

Set MAIL_MAILER=smtp, MAIL_HOST=in-v3.mailjet.com, MAIL_PORT=587, MAIL_ENCRYPTION=tls, MAIL_FROM_ADDRESS=noreply@kleinundpartner.at.

File storage

The app stores files on the hel1 S3 bucket; the credentials come from solidtime-s3-credentials.

Set FILESYSTEM_DISK=s3, S3_REGION=hel1, S3_BUCKET=solidtime-files-kup6s, S3_ENDPOINT=https://hel1.your-objectstorage.com, S3_USE_PATH_STYLE_ENDPOINT=true. Hetzner Object Storage requires path-style addressing. S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY come from the secret.

PDF export

Set GOTENBERG_URL=http://solidtime-gotenberg:3000.

Secrets bootstrap

The source secrets live in application-secrets and ESO projects them into the solidtime namespace. Create them with scripts/bootstrap-secrets.sh.

dp-infra/solidtime/scripts/bootstrap-secrets.sh

The script auto-generates APP_KEY and the Passport keypair, and prompts for the Mailjet credentials. The S3 credentials are not bootstrapped here. They reuse the cluster-wide hetzner-s3-creds-standard through the hetzner-s3-cluster-store ClusterSecretStore.