Skip to main content

NudgeBee Configurations

This document provides a comprehensive reference for the various secrets and environment variables used by the NudgeBee application. These configurations can be set on Helm > nudgebee_secrets section.

Important Security Note: This document outlines the purpose of the secrets and environment variables. It does NOT contain the actual secret values. The values are stored securely using encryption and managed separately.

Table of Contents​

License​

Configuration related to the NudgeBee license. Only relevant for the Enterprise edition — leave empty for the open-source Community edition, and the server short-circuits to licenseType=free.

  • NUDGEBEE_LICENSE: NudgeBee license JWT (Enterprise). Empty for Community.

General Configuration​

Critical Security Notice: Production Secret Overrides

Do NOT use default or fallback keys in production environments. The Helm chart includes placeholder default keys for quick sandboxes and local evaluation. Using shared default keys in production is a severe security vulnerability: anyone with knowledge of the default keys could forge authentication tokens or decrypt stored database credentials.

Always generate unique, cryptographically random keys for production deployments:

# Generate 32-byte hex encryption key:
openssl rand -hex 32

# Generate RSA keypair for JWT signing:
openssl genrsa -out jwt_private.pem 2048
openssl rsa -in jwt_private.pem -pubout -out jwt_public.pem
  • BASE_URL: The base URL for the NudgeBee application, default http://localhost:3000. Required.
  • NUDGEBEE_ENCRYPTION_KEY: 32-byte hex key that encrypts integration credentials and other at-rest secrets in the database. Required — the chart fails install if this is empty or left as __REPLACE__. Generate once with openssl rand -hex 32 and store securely in your secret manager. Losing this key makes previously-encrypted DB rows unreadable, so treat it like a database master password.
  • NEXTAUTH_SECRET: Encryption key used for encoding NextAuth session cookies. Auto-generated by the Helm chart on a fresh install (using the lookup-or-generate pattern) and reused on upgrade. Required to set explicitly in GitOps / offline-render workflows (Argo CD, Flux).
  • ACTION_API_SERVER_TOKEN: Auth token between internal services. Auto-generated by Helm chart; Required to set explicitly in GitOps workflows.
  • JWT_PRIVATE_KEY: RSA private key used for signing JWT auth tokens. Optional for local trial only; REQUIRED to override with your own private key in production.
  • JWT_PUBLIC_KEY: Corresponding RSA public key for JWT verification. Optional for local trial only; REQUIRED to override in production.
  • LICENSE_PUBLIC_KEY: RSA public key for verifying the NUDGEBEE_LICENSE JWT. Empty in the Community edition — getLicenseDetails() short-circuits to licenseType=free. Only set for Enterprise installs.

Authentication​

These secrets and environment variables are used for user authentication and integrating with identity providers. Please refer Authentication Integrations for more details

Google​

  • GOOGLE_CLIENT_ID: The Client ID for the Google OAuth application used for authentication.
  • GOOGLE_CLIENT_SECRET: The Client Secret for the Google OAuth application.

Auth0​

  • AUTH0_CLIENT_ID: The Client ID for the Auth0 application used for authentication.
  • AUTH0_CLIENT_SECRET: The Client Secret for the Auth0 application.
  • AUTH0_ISSUER: The issuer URL for the Auth0 domain.

Teleport​

  • TELEPORT_ENABLED: Set to true to enable this provider.
  • TELEPORT_ATTRIBUTE_USERNAME: Teleport JWT attribute name for username field, defaults to sub
  • TELEPORT_ATTRIBUTE_NAME: Teleport attribute/trait name for displayname field, defaults to sub
  • TELEPORT_ATTRIBUTE_GROUPS: Teleport attribute/trait name for nudgebee-groups field, defaults to empty. Note that these groups needs to be available on nudgebee
  • TELEPORT_SSO_ENABLED: if enabled, nudgebee wont show signin screen, will try to login directly based on teelport headers

Azure AD​

  • AZURE_AD_CLIENT_ID: The Client ID for the Azure Active Directory (AD) application.
  • AZURE_AD_CLIENT_SECRET: The Client Secret for the Azure AD application.
  • AZURE_AD_TENANT_ID: The Tenant ID for the Azure AD instance.

Okta​

  • OKTA_CLIENT_ID: The Client ID for the Okta application.
  • OKTA_CLIENT_SECRET: The Client Secret for the Okta application.
  • OKTA_ISSUER: The issuer URL for the Okta organization.

Ldap​

  • NEXTAUTH_LDAP_URI: ldap URI.
  • NEXTAUTH_LDAP_LOGIN_FILTER: Login filter for ldap.
  • NEXTAUTH_LDAP_SEARCH_FILTER: Search filter for ldap.
  • NEXTAUTH_LDAP_SEARCH_DN: Search DN for ldap.
  • NEXTAUTH_LDAP_BIND_DN: Bind DN for ldap.
  • NEXTAUTH_LDAP_BIND_PASSWORD: Bind password for ldap.
  • NEXTAUTH_LDAP_ATTRIBUTE_EMAIL: Attribute for email.
  • NEXTAUTH_LDAP_ATTRIBUTE_GROUP: Attribute for group.
  • NEXTAUTH_LDAP_ATTRIBUTE_NAME: Attribute for name.
  • NEXTAUTH_LDAP_ATTRIBUTE_FIRSTNAME: Attribute for first name.
  • NEXTAUTH_LDAP_ATTRIBUTE_LASTNAME: Attribute for last name.
  • NEXTAUTH_LDAP_GROUP_MAPPING: Group mapping for ldap.
  • NEXTAUTH_LDAP_SEARCH_USER_PATTERN: Search user pattern.
  • NEXTAUTH_MAGICLINK_CREDS_ENABLED: Enable/Disable magic-links based auth (default true)
  • EMAIL_SERVER_HOST: The hostname of the email server used for sending emails (e.g., for magic links).
  • EMAIL_SERVER_PORT: The port number of the email server.
  • EMAIL_SERVER_USER: The username used to authenticate with the email server.
  • EMAIL_SERVER_PASSWORD: The password used to authenticate with the email server.
  • EMAIL_FROM: Email address which will be used to send email to user.

Dummy Creds​

  • NEXTAUTH_DUMMY_CREDS_ENABLED: Enable disable dummy creds which are generated during deployment (default true)

Database​

These secrets and environment variables are used for connecting to postgres database.

  • APP_DATABASE_URL: Url for Postgres Database. If not provided then defaults to postgresql://postgres:xxx@postgresql:5432/postgres?sslmode=disable

Messaging Queue​

configs to connect with RabbitMQ

  • RABBIT_MQ_HOST: The host of Rabbit MQ.
  • RABBIT_MQ_PORT: The port of Rabbit MQ.
  • RABBIT_MQ_USERNAME: username for rabbit MQ.
  • RABBIT_MQ_PASSWORD: The password of Rabbit MQ.

Large Language Models​

These secrets and environment variables are used for configuring and interacting with Large Language Models. Please refer LLM Integrations for more details and configs

  • LLM_PROVIDER: LLM provider for the app (bedrock, sagemaker, huggingface, etc)
  • Provider specific configs can be found on LLM Integrations docs.

Integrations​

These secrets and environment variables are used for integrating with third-party services. Please refer Integrations for more details

Slack App​

Required for deploying own-app on slack and using that for NudgeBee integration

  • SLACK_CLIENT_SECRET: The Client Secret for the Slack application integration.
  • SLACK_SIGNING_SECRET: The Signing Secret for the Slack application.
  • SLACK_CLIENT_ID: The Client ID for the slack app.

MS Teams App​

Required for integrating with MS Teams. See the MS Teams on-prem setup guide for how to create the Microsoft Entra ID app registration these values come from.

  • MS_TEAMS_CLIENT_ID: The Application (client) ID of your Microsoft Entra ID app registration.
  • MS_TEAMS_CLIENT_SECRET: The client secret of your Microsoft Entra ID app registration.
  • MS_TEAMS_AUTHORITY: (Optional) The Microsoft login authority URL used for OAuth sign-in and token exchange. Defaults to https://login.microsoftonline.com/common, which works for multi-tenant app registrations. Required if your app registration is single-tenant — set it to https://login.microsoftonline.com/<your-tenant-id>.

GChat App​

Required for integrating with Chat

  • GOOGLE_CLIENT_ID: Google clientId
  • **GOOGLE_CLIENT_SECRET: Google Client Secret

Email​

Required for sending emails like daily report

  • EMAIL_SERVER_HOST: The hostname of the email server used for sending emails (e.g., for magic links).
  • EMAIL_SERVER_PORT: The port number of the email server.
  • EMAIL_SERVER_USER: The username used to authenticate with the email server.
  • EMAIL_SERVER_PASSWORD: The password used to authenticate with the email server.
  • EMAIL_FROM: Email address which will be used to send email to user.

Cache Configuration​

Optional configuration related to cache. Currently only redis/in-memory cache is supported. if value is not provided then system assumes in-memory cache.

  • CACHE_PROVIDER: Cache provider.
  • REDIS_SERVER_HOST: Redis server host.
  • REDIS_SERVER_PORT: Redis server port.
  • REDIS_USER_NAME: Redis user name.
  • REDIS_USER_PASSWORD: Redis user password.

Observability​

These are optional configurations for NudgeBee for observability

  • OTEL_EXPORTER: Name of the exporter (none, console, otlp), default is none
  • OTEL_EXPORTER_OTLP_ENDPOINT: Endpoint for OTLP.

ML Configuration​

These are optional configurations for nudgebee ML-Server to manage/store models

  • ML_MODEL_STORE_PROVIDER: Provider for model store. Currentlly only s3/file supported. default is file
  • ML_MODEL_STORE_BUCKET: Bucket name where ML model will be stored. if s3 is enabled

Cloud Integration​

Optional configuration for connecting AWS cloud accounts and enabling AWS Organization onboarding. For infrastructure setup instructions, see AWS Infrastructure Setup.

AWS Account Integration​

  • NUDGEBEE_INSTANCE_ROLE: IAM role ARN in the NudgeBee AWS account. Used to assume cross-account roles in customer accounts. Required for AWS integration.
  • AWS_TEMPLATE_URL: CloudFormation template URL used during single AWS account onboarding. Defaults to NudgeBee-hosted template.

AWS Organization Onboarding​

These configs enable automatic registration of AWS Organization member accounts via CloudFormation StackSets and SNS/SQS messaging.

  • AWS_ORG_TEMPLATE_URL: CloudFormation StackSet template URL deployed to organization member accounts.
  • AWS_ORG_SNS_TOPIC_ARN: ARN of the SNS topic that receives CloudFormation Custom Resource callbacks from member accounts.
  • CLOUD_COLLECTOR_ORG_REGISTRATION_SQS: SQS queue URL polled by the cloud-collector service for organization registration events. The SNS topic forwards messages to this queue.

AWS EventBridge Events​

  • CLOUD_COLLECTOR_AWS_EVENTBRIDGE_SQS: SQS queue URL for ingesting real-time AWS resource events via EventBridge (e.g., CloudTrail, CloudWatch Alarms).

AWS Auth​

If App is deployed Outside EKS and want to access AWS specific services, then add following configs for accessing AWS Services

  • AWS_ACCESS_KEY_ID: Aws access key.
  • AWS_SECRET_ACCESS_KEY: Aws secret access key.
  • AWS_DEFAULT_REGION: Default aws region.