Environment Variables
Since 1.4.8 the only source of truth for middleware collection is the UI Data Sources page. The variables in the "Middleware Connection Details" section below are read once, on the first startup, and seeded into UI data sources — after installation, editing them has no effect. Change connection details in the UI instead (changes take effect immediately, no container restart needed).
This behaviour is controlled by ENV_PROMETHEUS_SD_MODE, which defaults to http. Setting it explicitly to
env inverts it: collection reads only these environment variables and data sources configured in the UI do
not participate. The two modes are mutually exclusive, not layered.
All other variables (token, subpath, retention, object storage, Alloy, etc.) are unaffected and always come from this page.
All Ops Platform configuration is passed in through environment variables: written in ops.yaml for Docker Compose, or in a ConfigMap for Kubernetes. The tables below are grouped by purpose. Anything not marked as required is optional and falls back to its default if unset.
General / Gateway
| Environment Variable | Description |
|---|---|
| ENV_OPS_TOKEN | Access authentication key for the Ops Platform; be sure to change it on first deployment |
| ENV_OPS_SUB_PATH | Reverse proxy sub-path. Not needed for direct port access; once set, both the gateway and Grafana automatically adapt GF_SERVER_ROOT_URL and GF_SERVER_SERVE_FROM_SUB_PATH. Example: /mdis |
| ENV_OPS_PORT | Internal listening port of ops-server, default 8081, usually no need to change |
| ENV_OPS_GATEWAY_PORT | External port of the gateway, default 48881 |
Host Monitoring (Node Exporter)
| Environment Variable | Description |
|---|---|
| ENV_PROMETHEUS_HOST | Node_Exporter service address; replace with the actual server IP. The port is fixed at 59100; use commas to separate multiple Node_Exporters, in the format custom-hostname/IP:59100. For Docker Compose deployments, Node_Exporter defaults to a single node — just fill in the server's own internal IP. Example: hap_1/192.168.1.12:59100 For Kubernetes deployments, Node_Exporter runs on multiple nodes; use commas to separate them. Example: service_01/192.168.1.12:59100,service_02/192.168.1.13:59100 |
Cluster Monitoring (Kubernetes)
Since Ops Platform 1.3.0, monitoring a Kubernetes cluster (nodes, containers, Pods, cluster object state) is supported. For full configuration, see Kubernetes Cluster Monitoring.
| Environment Variable | Description |
|---|---|
| ENV_K8S_MONITOR_MODE | K8s monitoring mode: off (default, disabled) / static (outside the cluster, Docker Compose remote scraping) / incluster (inside the cluster, Pod-based auto-discovery) |
| ENV_PROMETHEUS_K8S_KSM | kube-state-metrics address in static mode, in the format alias/IP:NodePort. Example: k8s/192.168.1.10:30080 |
| ENV_PROMETHEUS_K8S_NODE | K8s node_exporter address in static mode; comma-separated for multiple nodes. Example: n1/192.168.1.10:30081,n2/192.168.1.11:30081 |
| ENV_PROMETHEUS_K8S_KUBELET | kubelet HTTPS endpoint in static mode (for scraping container-level cAdvisor metrics), in the format alias/IP:10250; comma-separated for multiple nodes. Example: n1/192.168.1.10:10250 |
| ENV_K8S_BEARER_TOKEN | ServiceAccount token used to scrape kubelet in static mode (requires nodes/proxy permission, provided by 15-metrics-reader.yaml) |
| ENV_K8S_BEARER_TOKEN_FILE | Same as above, but using the path to an already-mounted token file (choose either this or ENV_K8S_BEARER_TOKEN) |
| ENV_K8S_KSM_NAMESPACE | Namespace where kube-state-metrics runs in incluster mode, default mdis-monitoring |
Middleware Exporter Proxy Addresses
| Environment Variable | Description |
|---|---|
| ENV_PROMETHEUS_KAFKA | Kafka monitoring proxy address; defaults usually fine. Example: kafka_1/agent:9308 |
| ENV_PROMETHEUS_ELASTICSEARCH | Elasticsearch monitoring proxy address; defaults usually fine. Example: elasticsearch_1/agent:9114 |
| ENV_PROMETHEUS_REDIS | Redis monitoring proxy address; defaults usually fine. Example: redis_1/agent:9121 |
| ENV_PROMETHEUS_MONGODB | MongoDB monitoring proxy address; defaults usually fine. Example: mongodb_1/agent:9216 |
| ENV_PROMETHEUS_MYSQL | MySQL monitoring proxy address; defaults usually fine. Example: mysql_1/agent:9104 |
| ENV_PROMETHEUS_SERVER | Prometheus internal access address. Example: http://ops-prometheus:9090 |
Middleware Connection Details
The variables in this section are seeded into UI data sources on the first startup only; after that,
collection reads exclusively from the UI Data Sources page. Editing them on an existing installation has
no effect. To keep the old behaviour, explicitly set ENV_PROMETHEUS_SD_MODE=env.
| Environment Variable | Description |
|---|---|
| ENV_MYSQL_HOST | MySQL database host address. Example: 10.206.0.6 |
| ENV_MYSQL_PORT | MySQL database connection port. Example: 3306 |
| ENV_MYSQL_USERNAME | MySQL database username. Example: root |
| ENV_MYSQL_PASSWORD | MySQL database password. Example: 123456 |
| ENV_MONGODB_URI | MongoDB connection URI. Example: mongodb://root:123456@10.206.0.6:27017 Replica set example: mongodb://root:123456@10.206.0.6:27017,10.206.0.7:27017,10.206.0.8:27017 |
| ENV_MONGODB_OPTIONS | Additional MongoDB connection options, typically specifying the auth database as admin. If the database has no authentication enabled, this can be left empty. Example: ?authSource=admin |
| ENV_REDIS_HOST | Redis database host address. Example: 10.206.0.6 |
| ENV_REDIS_PORT | Redis database connection port. Example: 6379 |
| ENV_REDIS_PASSWORD | Redis database password. Example: 123456 |
| ENV_KAFKA_ENDPOINTS | Kafka service address. For a cluster, just fill in one node. Example: 10.206.0.6:9092 |
| ENV_ELASTICSEARCH_ENDPOINTS | Elasticsearch service address. For a cluster, just fill in one node. Example: http://10.206.0.6:9200 |
| ENV_ELASTICSEARCH_PASSWORD | Elasticsearch username and password in the form username:password, not just the password. The Elasticsearch shipped with the HAP private deployment uses the username md, e.g. md:your-es-password. Getting this wrong shows up as a live collector that reads no metrics at all ("No Data" on the UI Data Sources page) |
| ENV_FLINK_URL | Flink Web service address; can be commented out if not needed or Flink is not deployed. Example: http://flink:8081 |
Data Source Registry Mode (Since 1.4.0, Optional)
By default (ENV_PROMETHEUS_SD_MODE=env), middleware monitoring targets are statically configured via the environment variables above. Since 1.4.0, you can switch to http mode: monitoring targets are managed centrally on the Ops Platform UI's Data Source page (multiple Kafka / MongoDB / MySQL / Redis / Elasticsearch instances can be added), the agent automatically starts the corresponding exporters based on the registry, and Prometheus scrape targets are also driven by the registry — no more editing environment variables or restarting containers.
| Environment Variable | Description |
|---|---|
| ENV_PROMETHEUS_SD_MODE | Service discovery mode: env (default, static configuration via environment variables) / http (driven by the UI data source registry). Must be configured on both the ops-prometheus and agent services |
| ENV_OPS_SD_URL | Address at which ops-prometheus / agent reach the registry (ops-server) in http mode, default http://gateway:8081 |
| ENV_OPS_SD_TOKEN | Access token for the registry interface in http mode; keep it consistent across gateway, ops-prometheus, and agent. When empty, no validation is performed (recommended only for Docker internal networks) |
| ENV_AGENT_SD_HOST | Hostname of the agent service in http mode (for Prometheus to address the exporters), default agent, usually no need to change |
Data Retention Periods
| Environment Variable | Description |
|---|---|
| ENV_PROMETHEUS_RETENTION | Prometheus metrics data retention period, default 15d if unset. Example: 30d |
| ENV_LOKI_RETENTION | Loki log data retention period, default 720h (30 days) if unset. Example: 360h |
| ENV_TEMPO_RETENTION | Tempo trace data retention period, default 720h (30 days) if unset. Example: 360h |
Observability Collection (Alloy)
| Environment Variable | Description |
|---|---|
| ENV_TEMPO_GRPC_URL | gRPC address for alloy to forward trace data to Tempo. Example: http://ops-tempo:4317 |
| ENV_PROMETHEUS_REMOTE_WRITE_URL | Address for alloy to report metrics to Prometheus via remote_write. Example: http://ops-prometheus:9090/prometheus/server/api/v1/write |
| ENV_LOKI_PUSH_URL | HTTP API address for alloy to push logs to Loki. Example: http://ops-loki:3100/loki/api/v1/push |
Log Storage Backend (Loki S3/MinIO, Optional)
Uses Loki's local filesystem storage when unset.
| Environment Variable | Description |
|---|---|
| ENV_S3_ENDPOINT | S3-compatible storage endpoint. Example: http://minio:9000. Tencent COS example: cos.ap-hongkong.myqcloud.com (without bucket prefix) |
| ENV_S3_BUCKET | Bucket name for storing logs. Example: loki. Tempo uses a separate bucket (override via inline ENV_S3_BUCKET per StatefulSet); do not share one bucket with Loki |
| ENV_S3_ACCESS_KEY | S3 access key |
| ENV_S3_SECRET_KEY | S3 secret key |
| ENV_S3_FORCE_PATH_STYLE | Bucket addressing style. true (default) = path-style, works for MinIO / UCloud US3; Tencent COS / Alibaba OSS only support virtual-host, so set false. Shared by Loki (AWS SDK) and Tempo (minio-go, which maps it to bucket_lookup_type to force DNS) |
Alert Subsystem (Since 1.4.0)
Ops Platform 1.4.0 includes a built-in, self-developed alert subsystem. Alert configuration data (rules/state/history/notification channels/data sources) is stored in a dedicated ops-mongo container, fully decoupled from the business MongoDB being monitored.
| Environment Variable | Description |
|---|---|
| ENV_OPS_MONGODB_URI | MongoDB connection address for the alert subsystem's own storage, pointing to the built-in ops-mongo container by default. Example: mongodb://ops-mongo:27017 |
| ENV_MONGODB_COLLECTION_PREFIX | Common prefix for the alert subsystem's collection names. Example: mdis_ |
| ENV_ALERT_CRYPTO_KEY | AES encryption key for data source credentials (passwords/URIs) before they are persisted. Be sure to change it to a random string on first deployment and keep it safe. After changing the key, previously saved credentials can no longer be decrypted and must be re-entered |
Alert notification channels (Feishu / DingTalk / WeCom / Email / custom Webhook) are configured on the Alert → Notification Channels page in the Ops Platform UI, no longer via environment variables. The SMTP server details for the email channel are also entered on that page.
Slow Query Diagnostics Tuning (optional)
Adjusts how sensitively MongoDB slow queries are captured. The defaults suit production; in a test environment, lowering the first two makes slow queries much easier to reproduce. The four capture conditions are explained in full under Slow Query Analysis.
| Variable | Description |
|---|---|
| ENV_GATEWAY_DOCS_EXAMINED | Minimum documents examined before a query is recorded, default 100000. This is the condition people get stuck on most — a query that is slow but scans little is never recorded |
| ENV_GATEWAY_CAPTURE_INTERVAL_MS | Collection interval in milliseconds, default 600000 (10 minutes). After generating slow queries you must wait for the next cycle |
| ENV_GATEWAY_PROFILE_SLOW_MS | The slowms threshold in milliseconds that the platform sets on the monitored database, default 100 |
| ENV_GATEWAY_LOG_EXPIRE_MS | How long slow query history is kept in the platform's own database, in milliseconds, default 604800000 (7 days) |
Set these on the gateway service. One further condition is fixed and not configurable: the same query
shape must occur at least 50 times within the last 120 minutes.
Connecting Service Logs (easy to confuse — please read)
The Service Logs feature queries the logs that HAP microservices push into Loki. The switch is on the HAP side, not on this platform.
| Where | Variable | Role | Default |
|---|---|---|---|
| HAP private deployment | ENV_LOKI_URL | Write switch: whether HAP's logservice pushes logs to Loki. Without it the installer sets StoreInLoki to false and nothing is ever written | empty (no writes) |
| Ops Platform | ENV_LOKI_URL | Query address: where this platform reads logs from | http://ops-loki:3100, no configuration needed in a standard deployment |
The two share a name but are not the same thing. When the Service Logs page is empty, the one you need to
set is on the HAP side — point it at a reachable address of this platform's Loki (e.g.
http://<ops-platform-host-IP>:3100) and restart the HAP services.