Configuration
Environment variables, secrets, organisation and roles, API keys.
.env file
# --- Licensing (required) -----------------------------------
LICENSE_KEY=your-license-key-here
# --- MySQL (business data) ----------------------------------
DB_HOST=mysql
DB_PORT=3306
DB_USERNAME=mlab_web
DB_PASSWORD=CHANGE_ME_mysql_password
DB_ROOT_PASSWORD=CHANGE_ME_mysql_root_password
# --- ClickHouse (analytics / activity) ----------------------
CH_HOST=clickhouse
CH_USERNAME=default
CH_PASSWORD=CHANGE_ME_clickhouse_password
# --- First start (optional) --------------------------------
# Password of admin@localhost (12+ characters). Unset: a one-time
# setup link is printed in the app logs instead.
# ADMIN_INITIAL_PASSWORD=
# --- Behaviour (optional) -----------------------------------
# PUBLIC_URL=https://tprm.example.com
# MLAB_LICENSE_URL=https://mlab.sh
COOKIE_SECURE=false
CORS_ORIGIN=same-origin
DEV=false
# --- Documents on S3 (optional) -----------------------------
# S3_ENDPOINT=http://silo:9000
# S3_BUCKET=tprm-docs
# S3_ACCESS_KEY_ID=
# S3_SECRET_ACCESS_KEY=
# --- mlab.sh scans (optional) -------------------------------
# MLAB_API_KEY=Variable reference
| Variable | Required | Default | Description |
|---|---|---|---|
LICENSE_KEY | Yes | - | Your tprm.mlab.sh license key (Free or Licensed). Without it the instance starts but stays paused. |
MLAB_LICENSE_URL | No | https://mlab.sh | Where the hourly license check is sent, to go through a proxy or gateway. Only licenses signed by mlab.sh are accepted, whatever answers there. |
DB_HOST / DB_PORT | Yes | mysql / 3306 | MySQL host and port. |
DB_USERNAME / DB_PASSWORD | Yes | - | MySQL credentials. |
CH_HOST | Yes | clickhouse | ClickHouse host. |
CH_USERNAME / CH_PASSWORD | Yes | - | ClickHouse credentials. |
COOKIE_SECURE | No | false | Marks the session cookie Secure. Set to true once TLS terminates in front of the app, and leave it false on plain HTTP or the browser drops the cookie and login fails silently. |
CORS_ORIGIN | No | same-origin | Origin allowed to call the API from a browser. |
DEV | No | false | Verbose request logging. Leave off in production. |
INTERNAL_SECRET | No | - | Shared secret for internal service callbacks. Internal auth stays disabled while it is unset or left at its default value. |
ADMIN_INITIAL_PASSWORD | No | - | Password of admin@localhost when the instance starts for the first time (12 characters or more). Unset, the account has no password and a one-time setup link is printed in the logs. See Quick start. |
PUBLIC_URL | For SSO | http://localhost:8080 | The address users reach the platform at, without a trailing slash. Single sign-on builds its redirect URI from it. See Single sign-on. |
S3_ENDPOINT, S3_BUCKET, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY | For documents | - | The S3 bucket contract documents are stored in. Optional: S3_REGION, S3_PATH_STYLE, S3_PREFIX, S3_MAX_UPLOAD_MB. See Documents. |
MLAB_API_KEY | No | - | mlab.sh API key for the whole instance, used by the public footprint scan when an organisation has not set its own. MLAB_API_URL defaults to https://mlab.sh/api/v1. See Public footprint. |
DB_ROOT_PASSWORD is read by the MySQL container in docker-compose.yml, not by
the application. It still belongs in .env for the stack to come up.
The app listens on port 8080 inside the container. Change the published port
by editing the ports mapping in docker-compose.yml; there is no environment
variable for it.
Don't commit .env. Add it to your .gitignore. Rotate all database passwords if they ever leak.
Generating secrets
openssl rand -hex 32 # database passwords, internal secretLicense token
Sign in on mlab.sh, then visit Organization > TPRM. A free key is created for you automatically. Paste it into LICENSE_KEY: it is required on Free too. Every instance using the key holds one of its places. See Licensing for how validation and places work.
Organisation settings
Administrators manage the organisation under Organization (/orga/team/settings):
| Tab | What it holds |
|---|---|
| General | Name, reporting framework (DORA register, filing and governance pages, or plain third-party risk management without them; turning DORA off hides its pages and keeps the data), identifier checks (GLEIF, off by default), single sign-on and the mlab.sh API key. |
| Team | Members and their role; invite a member. |
| License | The license status and places. |
| API keys | Keys for the REST API. |
Roles
There are two roles:
| Role | Can |
|---|---|
| Administrator | Everything, plus team management, organisation settings, single sign-on, API keys and license actions. |
| Member | Read and write all of the organisation's data. |
Invite members in the Team tab: the platform shows a one-time setup link (valid 72 hours) to hand to the person, who sets their own password with it. No email is sent. With single sign-on in SSO only mode, invitations are off and accounts are created at first sign-in.
API keys
Administrators create keys in the API keys tab, with a descriptive note. Keys
are formatted mlab_ + a unique identifier and can be revoked at any time. On the
Free tier keys are read-only (GET); on Licensed they support full CRUD. See the
API reference.