Configuration

The seeamess binary is configured with environment variables. A configuration error exits with status 2. Migrations run at start when the authoring, projector or jobs role is present.

Core

Variable	Default	Meaning
SEEAMESS_DATABASE_URL	required	PostgreSQL URL
SEEAMESS_ROLES	every role	Comma-separated: authoring, projector, delivery, media, jobs, editor. --roles <list> wins over it.
SEEAMESS_LISTEN	127.0.0.1:5080	Listen address
SEEAMESS_NODE_NAME	host name, process ID and a random suffix	This process in job and consumer leases
SEEAMESS_OUTBOX_POLL_MS	250	Poll interval of outbox consumers (projector, extension events)
SEEAMESS_JOBS_POLL_MS	5000	How often a job runner looks for due jobs
SEEAMESS_JOBS_LEASE_MS	300000	Job lease; renewed while the job runs

Authentication

Variable	Default	Meaning
SEEAMESS_AUTH	dev if SEEAMESS_DEV_TOKEN is set, else oidc	dev or oidc
SEEAMESS_DEV_TOKEN	none	The one token dev mode accepts, as an administrator
SEEAMESS_OIDC_ISSUER	none	Issuer URL; required for oidc when the authoring role runs
SEEAMESS_OIDC_AUDIENCE	none	Expected aud; required with the issuer
SEEAMESS_OIDC_JWKS_URL	from discovery	Overrides the key set location
SEEAMESS_OIDC_CLIENT_ID	none	Public client ID the editor uses (authorization code with PKCE)
SEEAMESS_OIDC_SCOPES	openid profile	Scopes the editor requests
SEEAMESS_OIDC_NAME_CLAIM	preferred_username, then sub	Subject name
SEEAMESS_OIDC_ROLES_CLAIM	roles	Claim with role names; a dotted path walks nested objects
SEEAMESS_ADMIN_ROLES	CmsAdmins,WebAdmins,Administrators	Roles that pass every acl check

Authorization and preview

Variable	Default	Meaning
SEEAMESS_POLICY	acl	acl, external or allow-all (only in dev mode)
SEEAMESS_POLICY_URL	none	The policy service for external
SEEAMESS_POLICY_DELIVERY	unset	true with external: ask the policy service for every document Delivery serves
SEEAMESS_PREVIEW_SECRET	random at start	Key for preview links; set it so links survive restarts

seeamess token preview-secret prints a suitable random secret.

Media

Variable	Default	Meaning
SEEAMESS_BLOB_STORE	fs:.local/blobs	fs:<dir>, s3://<bucket>/<prefix>, or memory: (tests)
SEEAMESS_S3_ENDPOINT, SEEAMESS_S3_REGION, SEEAMESS_S3_ACCESS_KEY, SEEAMESS_S3_SECRET_KEY	none	S3-compatible stores; unset ones come from the standard AWS_* variables. Path-style requests; http:// endpoints (MinIO) work.
SEEAMESS_MEDIA_MAX_UPLOAD	104857600	Largest upload, in bytes
SEEAMESS_MEDIA_MAX_PIXELS	60000000	Larger images are stored but never transformed
SEEAMESS_MEDIA_WIDTHS	160,320,640,960,1280,1920,2560	Rendition widths allowed without a signature
SEEAMESS_MEDIA_SECRET	none	Enables signed rendition URLs for any size
SEEAMESS_MEDIA_WORKERS	the number of CPUs	Renditions decoded at the same time

Extensions

Variable	Default	Meaning
SEEAMESS_EXT_TIMEOUT_MS	10000	Event and admin calls
SEEAMESS_EXT_JOB_TIMEOUT_MS	300000	Job calls
SEEAMESS_EXT_RETRY_MIN_MS, SEEAMESS_EXT_RETRY_MAX_MS	1000, 300000	Backoff for failed event deliveries
SEEAMESS_EXT_MAX_BODY	8388608	Largest answer read from an extension, in bytes
SEEAMESS_EXT_ALLOW_PRIVATE	true in dev mode, else false	Whether extension URLs may be or resolve to loopback, link-local or private addresses

Editor

Variable	Default	Meaning
SEEAMESS_EDITOR_DIR	editor/dist	Built editor files served at /editor/
SEEAMESS_EDITOR_MEDIA_ORIGIN	none	The origin media is served from, when it is not the engine’s own listener; allowed in the editor’s Content-Security-Policy

The editor’s Content-Security-Policy is computed from the registered UI modules and sites, so registering a module or a preview host needs no configuration.

Tenancy

Variable	Default	Meaning
SEEAMESS_TENANT	none	This database’s tenant ID. Set together with SEEAMESS_TENANTS.
SEEAMESS_TENANTS	none	Path of the tenant directory file: every tenant’s databaseUrl, blobStore and optional url, and which one is shared

See Multi-tenancy.

Command-line clients

seeamess schema and the other client subcommands default --url and --token to SEEAMESS_URL and SEEAMESS_TOKEN. See Command line.