Environment Variables
Values are sourced from the endpoint profiles env/{test,dev,prod}.env (the pytest suite is pinned to env/test.env) layered over the gitignored .env (secrets). Ordinary config uses os.environ.get("KEY", default); required infra endpoints must NOT carry a literal default — see No literal fallback.
Core Services
| Variable | Default | Purpose |
|---|---|---|
REDIS_HOST |
(none — required; unset raises) | Redis server host |
REDIS_PORT |
(none — required; unset raises) | Redis server port |
REDIS_DB |
0 |
Redis logical DB index (not an endpoint — default OK) |
KG_ENGINE |
memgraph |
Operational-KG engine selector (post-cutover — see note below) |
KG_ROUTING_URI |
(none — unset raises) | Canonical operational-KG Bolt+routing URI — the direct replacement for NEO4J_URI |
KG_URI |
(none — unset raises) | Routing-URI alias read when KG_ROUTING_URI is absent |
KG_DATABASE |
(none — unset raises) | Operational-KG database name on the orchgraph cluster |
Neo4j → orchgraph cutover (migration plan Step 5.1, decommissioned 2026-07-27): the standalone
NEO4J_URI/NEO4J_USERNAME/NEO4J_PASSWORDkeys (and the per-workerNEO4J_URI_GW1..GW7fleet mapping) were removed from.envalong with the containers they named (neo4j-db.11,neo4j-node-2/3/4.13/.14/.19) — nothing reads them any more. The operational KG now lives as theorchkgdatabase on the orchgraph cluster, reached throughKG_ROUTING_URI/KG_URI(per-workerorchkg_w0..w7databases, sized byKG_WORKER_COUNT).
Memgraph / Semantic Graph
| Variable | Default (current .env) |
Purpose |
|---|---|---|
MEMGRAPH_URI |
(none — required; unset raises) | orchgraph client-entry Bolt+routing URI (auto-routes to MAIN/replicas) |
MEMGRAPH_URIS |
(empty) | Comma-separated fallback Bolt URIs (OPTIONAL — empty = no HA; a default is allowed) |
MEMGRAPH_HA_CONTROLLER_URL |
(empty) | Legacy — HTTP URL of the old HA controller, decommissioned 2026-07-10; OPTIONAL, empty = off |
MEMGRAPH_USERNAME |
(empty) | Memgraph username (orchgraph auth is off — ignored) |
MEMGRAPH_PASSWORD |
(empty) | Memgraph password (orchgraph auth is off — ignored) |
Gateway / Kernel
| Variable | Default | Purpose |
|---|---|---|
GATEWAY_HOST |
localhost |
Gateway WebSocket host |
GATEWAY_PORT |
8765 |
Gateway WebSocket port |
CXP_GRPC_HOST |
localhost |
gRPC kernel host (co-hosted — default OK) |
CXP_GRPC_PORT |
(none — required; unset raises) | gRPC kernel port |
KG_GRPC_PORT |
(none — required; unset raises) | Knowledge-graph gRPC port |
Logging / Misc
| Variable | Default | Purpose |
|---|---|---|
LOG_LEVEL |
INFO |
Default logging level |
PROLOG_STACK_LIMIT |
4000000000 |
SWI-Prolog stack limit |
No literal fallback for required infra endpoints (RUL-003)
The keys that select which live infra you talk to — REDIS_HOST, REDIS_PORT, KG_ROUTING_URI, KG_URI, KG_DATABASE, MEMGRAPH_URI, CXP_GRPC_PORT, KG_GRPC_PORT — MUST be read with no default and raise when unset. A .get(KEY, default) on these (even "localhost"/"") is forbidden: an unset key must fail loudly, never silently connect to the wrong server. Route through the raising seams core.graph_factory.resolve_uri/resolve_kg_database and core.redis_factory.resolve_redis_host/resolve_redis_port. The key set + AST scanner live in core.infra_env_rule; enforced by the check_infra_env_defaults code-review check and the scripts/validate_ci.py gate (standards rule 30d). Optional keys (MEMGRAPH_URIS, MEMGRAPH_HA_CONTROLLER_URL, TEST_MEMGRAPH_URI, REDIS_DB, CXP_GRPC_HOST) are excluded — a default is a valid state there.
Rule
Never hardcode IPs or ports. Change endpoints only in env/*.env (or .env for secrets). See Container IPs for the prod / test / dev fleet topology.