Configuration Reference

Everything is set through environment variables. CDM reads them once at start, so restart the container after a change. A missing or invalid value stops CDM at start, and the log names each setting at fault.

Basics

Setting	Required	Meaning
CDM_PUBLIC_URL	yes	The address your users type into the browser, for example https://cdm.example.com. It builds the single sign-on redirect URI, so it must match what your provider allows, and the per-cluster hosts that Open UI uses (see First Steps). Use https:// in production.
CDM_SECRET_KEY	yes	32 random bytes that encrypt stored cluster credentials and the links that open a cluster's own interface. Generate with openssl rand -hex 32; CDM refuses to start with a key shorter than 32 characters. Back it up: without it CDM cannot read its stored clusters, and the only way back is an empty data volume and adding every cluster again.
PORT	no	Port inside the container, default 8234. Change the port mapping too if you change this.
CDM_DB	no	SQLite database URL. Default sqlite:///data/cdm.db, which uses the mounted volume.
CDM_DEMO_CLUSTER	no	on by default: on the first start without any cluster, registers four demo clusters once. Set to off before the first start to skip them. Once registered, they stay until you delete them in the interface, and deleting them is permanent.
CDM_LOG_LEVEL	no	debug, info (default), warn or error.
CDM_LOG_FORMAT	no	text (default) or json, for a log collector that parses lines.

Single sign-on

Setting	Required	Meaning
OIDC_DISCOVERY_URL	yes	Your provider's discovery document, usually ending in /.well-known/openid-configuration.
OIDC_CLIENT_ID	yes	The client id issued for CDM.
OIDC_CLIENT_SECRET	yes	The matching client secret.
OIDC_ROLE_MAPPING	no	Maps a group to a CDM role, as JSON, for example {"storage-admins":"admin","noc":"viewer"}. Roles are admin and viewer. Empty by default, so every user gets OIDC_DEFAULT_ROLES.
OIDC_DEFAULT_ROLES	no	Roles for a user whose groups match nothing. Default ["viewer"].
OIDC_GROUPS_CLAIM	no	Which claim carries the group names, default groups.
OIDC_SCOPES	no	Requested scopes, default openid email profile.
OIDC_CLIENT_AUTH	no	basic (default) or post. Change only if your provider requires it.

Single Sign-On walks through filling these in, with authentik as the worked example.

Everything together

A complete docker-compose.yml with every setting in place. Copy it, replace the five values marked CHANGE ME, and delete the optional lines you do not need:

services:
  cdm:
    image: oci.croit.io/croit/cdm:latest
    restart: unless-stopped
    ports:
      # host:container. Change the host side if 8234 is taken; put CDM behind
      # your own reverse proxy for TLS.
      - "8234:8234"
    volumes:
      # Cluster list, capacity history, audit trail and settings. Back this up.
      - cdm-data:/data
    environment:
      # ---- required ----------------------------------------------------------
      # The address your users open. Must match the redirect URI you registered.
      CDM_PUBLIC_URL: https://cdm.example.com          # CHANGE ME
      # openssl rand -hex 32 -- back this up, see the note below.
      CDM_SECRET_KEY: change-me-to-the-output-of-openssl-rand-hex-32  # CHANGE ME

      OIDC_DISCOVERY_URL: https://id.example.com/application/o/cdm/.well-known/openid-configuration  # CHANGE ME
      OIDC_CLIENT_ID: cdm                              # CHANGE ME
      OIDC_CLIENT_SECRET: change-me                    # CHANGE ME

      # ---- optional ------------------------------------------------------------
      # Which of your groups may change things. Empty by default, so everyone is
      # read-only; the group names here are examples.
      OIDC_ROLE_MAPPING: '{"storage-admins":"admin","noc":"viewer"}'

      # ---- optional, shown with their defaults -------------------------------
      OIDC_DEFAULT_ROLES: '["viewer"]'
      OIDC_GROUPS_CLAIM: groups
      OIDC_SCOPES: openid email profile
      OIDC_CLIENT_AUTH: basic

      PORT: 8234
      CDM_DB: sqlite:///data/cdm.db
      # Set to off to start without the four built-in demo clusters.
      CDM_DEMO_CLUSTER: "on"
      CDM_LOG_LEVEL: info
      CDM_LOG_FORMAT: text

volumes:
  cdm-data:

Note the quoting: OIDC_ROLE_MAPPING, OIDC_DEFAULT_ROLES and CDM_DEMO_CLUSTER need single or double quotes in YAML, because {, [ and a bare on mean something else there.

Prefer to keep secrets out of the compose file? Replace the whole environment: block with env_file: cdm.env and put the same KEY=value lines in that file, without quotes.