Configuration
Environment variables, secrets, organisation and roles, API keys.
.env file
# --- Licensing (required) -----------------------------------
LICENSE_KEY=your-license-key-here
# --- MySQL (business data) ----------------------------------
DB_HOST=mysql
DB_PORT=3306
DB_USERNAME=mlab_web
DB_PASSWORD=CHANGE_ME_mysql_password
DB_ROOT_PASSWORD=CHANGE_ME_mysql_root_password
# --- ClickHouse (analytics / activity) ----------------------
CH_HOST=clickhouse
CH_USERNAME=default
CH_PASSWORD=CHANGE_ME_clickhouse_password
# --- Behaviour (optional) -----------------------------------
COOKIE_SECURE=false
CORS_ORIGIN=same-origin
DEV=falseVariable reference
| Variable | Required | Default | Description |
|---|---|---|---|
LICENSE_KEY | Yes | - | Your tprm.mlab.sh license token (free or licensed). |
DB_HOST / DB_PORT | Yes | mysql / 3306 | MySQL host and port. |
DB_USERNAME / DB_PASSWORD | Yes | - | MySQL credentials. |
CH_HOST | Yes | clickhouse | ClickHouse host. |
CH_USERNAME / CH_PASSWORD | Yes | - | ClickHouse credentials. |
COOKIE_SECURE | No | false | Marks the session cookie Secure. Set to true once TLS terminates in front of the app, and leave it false on plain HTTP or the browser drops the cookie and login fails silently. |
CORS_ORIGIN | No | same-origin | Origin allowed to call the API from a browser. |
DEV | No | false | Verbose request logging. Leave off in production. |
INTERNAL_SECRET | No | - | Shared secret for internal service callbacks. Internal auth stays disabled while it is unset or left at its default value. |
DB_ROOT_PASSWORD is read by the MySQL container in docker-compose.yml, not by
the application. It still belongs in .env for the stack to come up.
The app listens on port 8080 inside the container. Change the published port
by editing the ports mapping in docker-compose.yml; there is no environment
variable for it.
Don't commit .env. Add it to your .gitignore. Rotate all database passwords if they ever leak.
Generating secrets
openssl rand -hex 32 # database passwords, internal secretLicense token
Sign in on mlab.sh, then visit Organization > TPRM. A free token is created for you automatically. Paste it into LICENSE_KEY. See Licensing for how validation works.
Organisation & roles (RBAC)
Access control is based on a 12-bit permission model. Manage members and their permissions under /orga/team. The permission bits are:
| Permission | Grants |
|---|---|
| Admin | Super-user (full access, implicit). |
| Email verified | Confirmed email account. |
| Manage team | Invite / remove users, manage roles. |
| Manage providers | CRUD on ICT third-party providers. |
| Manage assessments | CRUD on risk assessments. |
| Manage contracts | CRUD on contracts. |
| Manage exit strategies | CRUD on exit plans. |
| Manage incidents | CRUD on third-party incidents. |
| View risk dashboard | Access to concentration analysis. |
| View analytics | Access to the analytics dashboard (/an/). |
| Manage settings | Organisation configuration. |
| Manage register / compliance | DORA register, functions, due diligence, audits, Art. 30, entity, scope, branches, intra-group, definitions, outsourcing register, proportionality, reviews, EBA export. |
API keys
Create keys under /settings/api-keys with a descriptive note. Keys are formatted mlab_ + unique identifier and can be revoked at any time. On the Free tier keys are read-only (GET); on Licensed they support full CRUD. See the API reference.