Configuration reference

A deployment is configured by .env beside the compose files, started from .env.example. This page lists every variable it sets, and the few that are not .env keys (Backups and host monitoring). After them come the team settings a manager changes on Settings, and the options of the winner client on a laptop.

• Default is the value the stack runs with when the variable is unset; none means unset leaves it blank or off.
• Required: Required means scripts/check-env.sh, which the bundle installer and the upgrade command run before they start anything, refuses an .env without it. Required in production means it is required once PUBLIC_BASE_URL is https, which is what makes a deployment a production one. Required outside the trial profile means a trial .env may leave it blank. Required in the dns certificate mode means scripts/check-env.sh refuses a CERTIFICATE_MODE=dns .env without it. Required with the bedrock provider means scripts/check-env.sh refuses a FLEETVIEW_LLM_PROVIDER=bedrock .env without it. Written by the bundle installer means it is never set by hand: on a server installed from the bundle the installer writes it once the install has proved itself, and the upgrade and rollback commands after it. Not read by the stack means nothing in a deployment reads it.
• Layers are the ones that can supply the value: release (a default ships with the release; Settings shows it as release <version>), operator (whoever runs the deployment sets it in these files; Settings shows operator) and team (a manager overrides it for their organisation on Settings, which shows your team). A team value wins over an operator one, which wins over the release default. Settings shows operator for any value compose passes to the stack, with a default of its own (${NAME:-default} in docker-compose.yml, such as FLEETVIEW_FEATURES or the FLEETVIEW_LLM_* values) or blank (${NAME:-}), even when .env leaves it unset: the stack receives the variable either way. A blank FLEETVIEW_LLM_REGION or FLEETVIEW_SENTRY_TRACES_SAMPLE_RATE is the exception, shown as release. For the rows with a compose default, release in Layers is the default the stack runs with, not a word Settings shows.

On an installation from the bundle, .env is <install>/.env, in the folder of the release that runs now. Commands on the other pages says how the other pages' server commands read there.

Global

Variable	Meaning	Default	Required	Layers
COMPOSE_PROFILES	Compose profiles switched on. local-llm runs the Ollama container, which serves the dashboard's query embeddings and, by default, the chat models. scripts/check-env.sh refuses a blank value, except on an install from the bundle, where blank turns the AI runner off. cert-dns starts the certificate helper of the dns certificate mode, and the bundle installer writes it in that mode. trial runs the bundled Dex a trial signs in through, as does *, which compose reads as every profile; scripts/check-env.sh and the control plane refuse either on an https base URL. Under the trial scripts/check-env.sh requires the trial block of .env.example as written and a base URL that is blank or http://localhost:4180, the one address Dex knows, and refuses the production overlay in COMPOSE_FILE; an install from the bundle then runs the trial on loopback, with no edge.	none; the example ships local-llm	Required, except on an install from the bundle	operator
FLEETVIEW_FEATURES	Product surfaces switched on, as a JSON list of nav slugs (coaching, skills, benchmarks). Anything not listed shows as Soon, and the list also selects which jobs passes run.	[]	Optional	release, operator, team (a team can only switch a feature off)
FLEETVIEW_VERSION	The release the server runs: after an install from the bundle, the tag of the images it loaded, which the installer and the upgrade write; a rollback reads the older release's own .env.	none	Required in production; written by the bundle installer, so an unpacked bundle's check before the install does not ask for it	operator
FLEETVIEW_BACKEND_DIGEST	Blank on a server installed from the bundle, which runs the backend image it loaded; the upgrade command blanks it. Only a server that pulls Winner AI's images from its registry, which a bundle install never does, sets it.	none	Required in production, except on an install from the bundle	operator
FLEETVIEW_CADDY_DIGEST	The same for the caddy image: blank on a server installed from the bundle.	none	Required in production, except on an install from the bundle	operator
COMPOSE_FILE	The compose files a server installed from the bundle stacks: the base file, the production overlay and docker-compose.bundle.yml (a trial leaves out the production overlay), so a later docker compose up -d in the bundle folder never pulls one of our images. scripts/check-env.sh reads it to tell an install from the bundle, which needs no digests.	none	Written by the bundle installer	operator
FLEETVIEW_PIN	Not read on a server installed from the bundle, where you choose each upgrade and rollback yourself (Upgrade and roll back). Leave it blank.	none	Optional	operator

Database

Variable	Meaning	Default	Required	Layers
POSTGRES_USER	The database superuser.	fleetview	Optional	release, operator
POSTGRES_PASSWORD	Its password; any strong value.	none	Required	operator
POSTGRES_DB	The database name. Keep fleetview: enrollment hands laptops fleetview whatever this says, because FLEETVIEW_PG_DATABASE is not forwarded from it.	fleetview	Optional	release, operator
POSTGRES_PORT	Outside production, the loopback port Postgres is published on and the port enrollment hands laptops: a development machine and a trial. A production server, a bundle install included, publishes Postgres on 5432 and hands laptops 5432 whatever this says.	5433	Optional	release, operator
PUBLIC_PG_HOST	The name laptops dial for Postgres. Give it its own DNS-only name when a CDN fronts PUBLIC_HOST; never an IP address, because laptops verify the certificate against it.	localhost; under the production overlay the edge and the certificate sidecar fall back to PUBLIC_HOST, but enrollment still hands laptops localhost	Required in production	release, operator
PUBLIC_PG_SSLMODE	The sslmode written into laptops' connection strings; verify-full in production.	none	Required in production	operator
VPN_RANGES	Where laptops reach Postgres through a VPN and share its addresses: the VPN's whole private subnets, comma-separated, never single addresses and clear of the compose subnet. On a server installed from the bundle it is a declaration: scripts/check-env.sh checks only its shape, and nothing else reads it. Type the same ranges into your own fail2ban jails by hand (The Postgres jail).	none	Optional	operator
FLEETVIEW_SERVE_DB_PASSWORD	Password of the Org's read-only serve role, which its dashboard reads with.	none	Required	operator
FLEETVIEW_RELOAD_DB_PASSWORD	Password of the role the certificate sidecar uses to reload Postgres after a renewal.	none	Required in production	operator

Authentication

Variable	Meaning	Default	Required	Layers
AUTH0_DOMAIN	The Auth0 tenant domain. An installation signing in through another provider names no tenant, but scripts/check-env.sh still requires a value: a placeholder that resolves nowhere, such as unused.invalid.	none	Required outside the trial profile	operator
AUTH0_AGENT_CLIENT_ID	The Auth0 native device-code application a winner older than the control plane's own laptop login signed in with. It is public: the control plane serves it beside that login, and only an older winner uses it. A current winner signs in through the control plane's own login on every installation, Auth0 included. On another provider, a placeholder such as unused.	none	Required outside the trial profile	operator
AUTH0_PROXY_CLIENT_ID	The sign-in gate's application at the provider OAUTH2_PROXY_OIDC_ISSUER_URL names, which every browser signs in through; on Auth0, a regular web application. It keeps its Auth0 name so an existing .env keeps working.	none	Required	operator
AUTH0_PROXY_CLIENT_SECRET	Its secret.	none	Required	operator
AUTH0_MGMT_CLIENT_ID	The machine-to-machine application for the Management API: the roster, enrollment, and the jobs role sync that revokes removed members. Blank, each role comes from the sign-in gate (FLEETVIEW_MANAGER_GROUP or FLEETVIEW_MANAGER_EMAILS, one of which scripts/check-env.sh then requires outside a trial), and a trial requires it blank.	none	Optional: set both or neither	operator
AUTH0_MGMT_CLIENT_SECRET	Its secret.	none	Optional: set both or neither	operator
AUTH0_TEST_ORG_ID	The installation's one organisation, configured once: the control plane provisions it at start and serves its dashboard; enrollment falls back to it when a laptop's token names no organisation. Changing it needs the whole stack brought up again (docker compose up -d), which recreates the web server and pg serve: each keeps the key it was started with. Restarting only the backend leaves both on the earlier organisation, so until the whole stack is brought up again the Dashboard answers 503, because the web server admits only the organisation it started with, and spend reads as unavailable: the backend reads no spend while another organisation's serve role can still log in or is connected.	none	Required	operator
ORG_DISPLAY_NAME	The organisation's name, shown in the page headers. Read once, when the control plane first makes the Org; a later change does not rename an Org that already exists.	Winner AI	Optional	release, operator
AUTH0_AUDIENCE	Not read. The backend validates a laptop's Auth0 token against FLEETVIEW_AUTH0_AUDIENCE, which compose does not pass, so the tenant's API identifier must be that variable's default, https://api.fleetview.local.	none	Not read by the stack	none
AUTH0_CLAIMS_NAMESPACE	Not read. The backend reads roles under FLEETVIEW_AUTH0_CLAIMS_NAMESPACE, default https://fleetview.local/, and the gate's groups claim is OAUTH2_PROXY_OIDC_GROUPS_CLAIM.	none	Not read by the stack	none
OAUTH2_PROXY_COOKIE_SECRET	The session cookie key: 32 random bytes, URL-safe base64; check-env refuses a value the gate would not start with.	none	Required	operator
OAUTH2_PROXY_ALLOW_UNVERIFIED_EMAIL	Admit a sign-in whose e-mail the identity provider has not verified (on by default). Set false where the provider's check is real and people cannot choose their address. scripts/check-env.sh refuses a manager e-mail list (FLEETVIEW_MANAGER_EMAILS) unless this is false, because the list trusts any address the gate admits.	true	Optional	release, operator
OAUTH2_PROXY_OIDC_ISSUER_URL	The issuer of the provider the sign-in gate (oauth2-proxy) signs people in through. scripts/check-env.sh refuses a production .env without it, so production names its provider instead of inheriting Auth0 from a missing line, and refuses a production issuer other than https://<AUTH0_DOMAIN>/ while AUTH0_MGMT_CLIENT_ID is set, because with Management credentials a person is found by e-mail in Auth0. A person is their issuer and the provider's subject together, so a second provider presenting the same subject is another person; another provider signs people in on production with the Management keys blank. scripts/check-env.sh and the control plane refuse an https .env whose issuer is the bundled Dex (http://localhost:4180/dex, or /dex under PUBLIC_BASE_URL), and the trial profile requires http://localhost:4180/dex.	https://${AUTH0_DOMAIN}/, the Auth0 tenant	Required in production	release, operator
OIDC_END_SESSION_URL	The provider's end-session address, where sign-out sends the browser with client_id and the base URL to return to: returnTo for Auth0's /v2/logout, post_logout_redirect_uri for any other. For Auth0 it is https://<AUTH0_DOMAIN>/v2/logout. Its host must be in OAUTH2_PROXY_WHITELIST_DOMAINS, which scripts/check-env.sh checks. A trial leaves it blank, which scripts/check-env.sh requires: the bundled Dex has no end-session endpoint.	none; sign-out clears only the gate's cookie and the provider signs the same person straight back in	Required in production	operator
OAUTH2_PROXY_WHITELIST_DOMAINS	The hosts the gate may send a browser to after sign-out, comma-separated as oauth2-proxy reads them; a leading . or *. admits subdomains, and host:port or host:* a port. The gate applies the same list to every redirect it follows, after sign-in too, so scripts/check-env.sh refuses an entry for a whole public suffix (.com, *.co.uk).	${AUTH0_DOMAIN}	Optional	release, operator
OAUTH2_PROXY_SCOPE	The scopes the gate asks for, always passed, because given none oauth2-proxy adds groups on its own. A provider that puts groups in the token only when asked wants openid profile email groups.	openid profile email	Optional	release, operator
OAUTH2_PROXY_OIDC_GROUPS_CLAIM	The token claim the gate reads groups from. Settings shows it as Groups claim, and without Auth0 Management credentials the control plane reads the role from these groups (FLEETVIEW_MANAGER_GROUP).	https://fleetview.local/roles, the claim the Auth0 post-login Action writes	Optional	release, operator
OAUTH2_PROXY_SKIP_OIDC_DISCOVERY	true makes the gate use the three addresses below instead of reading its issuer's discovery document at start. Only a trial sets it: the bundled Dex's issuer is the gate's own address, which the gate cannot read before it listens. scripts/check-env.sh refuses any value but false on an https base URL.	false	Optional	release, operator
OAUTH2_PROXY_LOGIN_URL	With discovery skipped, the provider's sign-in page as the browser reaches it; a trial's is http://localhost:4180/dex/auth. Set, it also gives the gate its public /dex/ route to the bundled Dex, so only a trial sets it: scripts/check-env.sh refuses it on an https base URL and with the trial profile off.	none; read from the issuer's discovery document	Optional	operator
OAUTH2_PROXY_REDEEM_URL	With discovery skipped, the token endpoint the gate redeems a sign-in at; a trial's is http://dex:5556/dex/token, on the internal network. scripts/check-env.sh refuses it on an https base URL, where the gate discovers it from its https issuer.	none; read from the issuer's discovery document	Optional	operator
OAUTH2_PROXY_OIDC_JWKS_URL	With discovery skipped, the provider's signing keys; a trial's is http://dex:5556/dex/keys, on the internal network. scripts/check-env.sh refuses it on an https base URL, where the gate discovers it from its https issuer.	none; read from the issuer's discovery document	Optional	operator
FLEETVIEW_GATE_SESSION_SECONDS	How long a sign-in lasts, 10 to 604800 whole seconds (scripts/check-env.sh refuses a unit, underscore or fraction), before the gate sends the person back to the provider to be admitted again. It is the longest a person removed at the provider, or from the team, keeps web access: the gate checks nothing inside the window and asks for no refresh token. A form open when the window ends is lost, and a provider that keeps its own browser session signs the person straight back in. Settings shows it as Sign-in session.	3600	Optional	release, operator
FLEETVIEW_MANAGER_GROUP	Without Auth0 Management credentials, the provider group whose members are Managers, matched by its exact name among the groups the sign-in gate forwards; where groups arrive without it the person is a Member, and a person removed from it at the provider keeps the role until their sign-in ends, at most FLEETVIEW_GATE_SESSION_SECONDS. Blank, groups are not read and FLEETVIEW_MANAGER_EMAILS decides. Outside a trial scripts/check-env.sh requires it or FLEETVIEW_MANAGER_EMAILS where the Management credentials are blank.	none	Optional	operator
FLEETVIEW_MANAGER_EMAILS	Without Auth0 Management credentials, comma-separated addresses that are Managers where sign-in brings no usable groups claim, an ASCII address compared without regard to case and any other exactly. It trusts any address the gate admits, so scripts/check-env.sh refuses it unless OAUTH2_PROXY_ALLOW_UNVERIFIED_EMAIL is false.	none	Optional	operator
PGSERVE_AUTH_TOKEN	Bearer token gating the Org's dashboard API. Caddy and the control plane send it; browsers never see it.	none	Required	operator

Ingress and certificates

Variable	Meaning	Default	Required	Layers
PUBLIC_BASE_URL	Where browsers reach the proxy; it must match the callback and post-logout addresses registered for the gate's application at the provider (on Auth0, its callback and logout URLs). An https value marks a production deployment and must be https:// followed by PUBLIC_HOST.	http://localhost:4180	Optional; on an install from the bundle outside a trial, scripts/check-env.sh requires it https	release, operator
PUBLIC_HOST	The hostname the production edge serves and obtains a certificate for.	none	Required in production	operator
ACME_EMAIL	The contact on the certificate authority account. Let's Encrypt sends no expiry notices, and nothing on a server installed from the bundle watches the expiry: check it as Certificate renewals says.	none	Required in production	operator
CERTIFICATE_MODE	How the deployment gets its certificate. http: the edge takes it over port 80, and Postgres presents the edge's. dns: the cert-dns profile also starts the dns-certs helper (stock lego), which obtains one certificate for PUBLIC_HOST and PUBLIC_PG_HOST through a TXT record in their public zone and keeps it renewed. The edge serves that certificate on 443 instead of taking its own, each renewal within a minute, and Postgres presents it on 5432, each renewal within one db-certs poll. Nothing has to reach port 80, which only redirects to https, and the edge serves nothing until the first certificate exists. Certificate authorities log every certificate, so the names become public. scripts/check-env.sh refuses any other value, and dns beside a base URL that is not https or a PUBLIC_HOST or PUBLIC_PG_HOST that is not a lower-case DNS name.	http	Optional	release, operator
DB_CERTS_SOURCE	The volume db-certs reads Postgres's certificate from: edge-data in the http mode, dns-certs in the dns mode.	edge-data	Optional	release, operator (dns-certs in the dns mode)
DB_CERTS_SOURCE_DIR	The directory in that volume: /edge/caddy/certificates in the http mode, /edge/served in the dns mode.	/edge/caddy/certificates	Optional	release, operator (/edge/served in the dns mode)
AWS_HOSTED_ZONE_ID	The public Route 53 zone the dns mode writes its challenge record in. The helper uses the server's instance role; no AWS key is stored. In the dns mode the helper refuses to start without it.	none	Required in the dns certificate mode	operator
AWS_REGION	The region the helper's AWS client signs its Route 53 calls for; a Route 53 zone itself has no region. In the dns mode the helper refuses to start without it.	none	Required in the dns certificate mode	operator
EDGE_TRUSTED_PROXIES	Space-separated CIDR ranges of a CDN or reverse proxy whose forwarded client address the edge may believe.	none; no forwarded address is believed and logs keep the peer address	Optional	operator
OAUTH2_PROXY_COOKIE_SECURE	Mark the session cookie Secure. Set true whenever the base URL is https.	false	Required in production	release, operator

LLM

Variable	Meaning	Default	Required	Layers
FLEETVIEW_LLM_ENDPOINT	The host model's endpoint (OpenAI-compatible, or a Bedrock VPC endpoint) for the coaching, skills and benchmarks passes; https, or a compose service. With bedrock it must be an https Bedrock runtime host (bedrock-runtime.<region>.amazonaws.com or its VPC interface endpoint).	http://ollama:11434/v1	Optional	release, operator, team (a team sets endpoint and model together)
FLEETVIEW_LLM_MODEL	The host model.	qwen3:4b-instruct-2507-q4_K_M	Required with the bedrock provider (a Bedrock model or inference profile id, not the default)	release, operator, team (set with the endpoint)
FLEETVIEW_LLM_API_KEY	The host model's key, sent as a bearer token and never stored; blank sends no header. With bedrock it is a Bedrock API key, and blank signs each request instead: with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and AWS_SESSION_TOKEN if set) from the process's environment, which compose does not pass, so nothing in the deployed stack uses them; else with the EC2 instance role, read through IMDSv2. One of the pair set without the other is refused, never a fall-through to the role.	none	Optional	operator, team (a team's own key, sealed)
FLEETVIEW_LLM_FALLBACK	What an organisation with no key of its own gets: host lends it the host model, refuse skips its model passes.	host	Optional	release, operator
FLEETVIEW_LLM_PROVIDER	Which API the host model is called through: openai for an OpenAI-compatible endpoint, bedrock for Amazon Bedrock's Converse API. A team's own model stays OpenAI-compatible.	openai	Optional	release, operator
FLEETVIEW_LLM_REGION	The AWS region of the host's Bedrock endpoint, such as us-east-1; with bedrock, a blank or default FLEETVIEW_LLM_ENDPOINT becomes that region's endpoint. Used only with bedrock: scripts/check-env.sh refuses it set under any other provider, a sign the provider was forgotten. Left blank, Settings shows it as release.	none	Required with the bedrock provider	operator
FLEETVIEW_SETTINGS_KEYS	Comma-separated Fernet keys that seal team model keys; the first seals, all of them open. Blank means no team key can be stored. Keep it out of database backups.	none	Optional	operator
FLEETVIEW_COACHING_DAILY_BUDGET	Prompts the coaching pass judges per organisation per rolling day: the cap on model spend.	300	Optional	release, operator, team
FLEETVIEW_BENCHMARK_ROUTES	Candidate routes per original model family, as a JSON map; these are replay targets only.	{"gpt-5.6": ["gpt-5.5", "qwen3:4b-instruct-2507-q4_K_M"], "claude-opus": ["claude-sonnet-5"], "claude-fable": ["claude-sonnet-5"]}	Optional	release, operator, team
FLEETVIEW_BENCHMARK_LOCAL_ROUTES	Route name prefixes the local endpoint serves without a key. They must be models the compose Ollama has pulled.	["qwen3"]	Optional	release, operator
FLEETVIEW_BENCHMARK_LOCAL_ENDPOINT	That local endpoint.	http://ollama:11434/v1	Optional	release, operator
FLEETVIEW_BENCHMARK_DAILY_RUNS	Replay runs per organisation per rolling day.	20	Optional	release, operator, team
FLEETVIEW_BENCHMARK_QUALITY_THRESHOLD	The judged score, 0 to 100, a replay must reach, with every structured check passed, to count as Equivalent.	95	Optional	release, operator, team
INSIGHTS_ENDPOINT	The dashboard's generated-insights endpoint. It belongs to the stock dashboard, not to Settings; https when hosted.	http://ollama:11434/v1	Optional	release, operator
INSIGHTS_MODEL	Its model.	qwen3:4b-instruct-2507-q4_K_M	Optional	release, operator
OPENAI_API_KEY	Its key, read only from the environment.	none	Optional	operator

Jobs

Variable	Meaning	Default	Required	Layers
FLEETVIEW_JOBS_INTERVAL_SECONDS	How often the jobs service sweeps every organisation.	900	Optional	release, operator
FLEETVIEW_ATTRIBUTION_INTERVAL_SECONDS	How often session ownership is refreshed from the organisation schemas; 0 turns it off.	300	Optional	release, operator
FLEETVIEW_HEARTBEAT_URL	A dead-man's switch: the https URL the jobs service pings after every sweep.	none; no pings are sent	Optional	operator

Telemetry

Error reports and usage counts. A DSN that passes the host rule turns error reports on for the control plane and the jobs service (what a report carries); timings go with error reports at the sample rate (what a timing carries); with the telemetry secret set, cron check-ins go there too (what a check-in carries); usage counts are sent once the key, the host and the secret are all set and valid (Model and telemetry lists every event). Settings shows what each does in its Telemetry group.

Variable	Meaning	Default	Required	Layers
FLEETVIEW_SENTRY_DSN	Where error reports, timings and cron check-ins go; https, outside this host's network. Blank is off.	none	Optional	operator
FLEETVIEW_SENTRY_ENVIRONMENT	The environment name on every error report and check-in.	none; reports and check-ins then say production	Optional	operator
FLEETVIEW_SENTRY_TRACES_SAMPLE_RATE	The share of requests and jobs passes whose timings go where error reports go, from 0 to 1; 0, or a value that is not a share, sends none. Left blank, Settings shows it as release.	none; timings then sample 0.02, 2 in 100	Optional	operator
FLEETVIEW_POSTHOG_KEY	The analytics project key; usage counts need it, the host and the secret.	none	Optional	operator
FLEETVIEW_POSTHOG_HOST	The analytics host; https, outside this host's network.	none	Optional	operator
FLEETVIEW_POSTHOG_REPLAY	Page recording; no effect in this release.	false	Optional	release, operator
FLEETVIEW_TELEMETRY_SECRET	The key ids are hashed with, at least 32 characters; never shown or sent. Cron check-ins need it; give each deployment its own, and never change it.	none; an install from the bundle generates one	Optional	operator

Backups and host monitoring

These are not .env keys, and nothing on a server installed from the bundle reads any of them: they belong to a backup and watch schedule the bundle does not ship. They are listed only so that every name you may meet has a meaning here. On a bundle install, schedule and copy backups as Back up, restore and uninstall says, and watch the certificate as Certificate renewals says.

Variable	Meaning	Default	Required	Layers
RCLONE_REMOTE	The off-box target for nightly dumps, an rclone remote of an accepted type. Unset, the backup warns on every run.	none	Optional	operator
BACKUP_PING_URL	The backup's dead-man's switch, an https URL.	none	Optional	operator
WATCH_PING_URL	The watch's dead-man's switch, an https URL.	none	Optional	operator
KEEP_DAYS	Days of dumps kept, locally and off-box.	14	Optional	release, operator
DISK_LIMIT	Percent of the root filesystem used at which the watch reports a problem.	85	Optional	release, operator
MEM_MIN	The minimum percent of memory available before the watch reports a problem.	10	Optional	release, operator
OLLAMA_LIMIT_MB	Memory use of the Ollama container, in MiB, at which the watch reports a problem; it does not limit the container.	6144	Optional	release, operator
AUTH_FAIL_LIMIT	Refused Postgres logins from outside, within the window, that page.	20	Optional	release, operator
AUTH_FAIL_WINDOW	That window. Keep it at least twice the watch timer's five minutes, so a burst cannot straddle two runs.	10min	Optional	release, operator
AUTH_FAIL_VPN_LIMIT	Refused Postgres logins from the VPN ranges declared in .env, within the same window, that page: the total over every address in them, while the second jail counts per address, so at the jail's count it pages at or before any one address's ban. Counted only while VPN_RANGES is set.	60	Optional	release, operator
CERT_MIN_DAYS	Days left on the certificate served on 443 or 5432 below which the watch reports a problem. Keep it under a third of the certificate's lifetime, where renewal begins.	14	Optional	release, operator

Development only

Read by nothing in a deployed stack, and not read on a server installed from the bundle; these exist for people working on Winner AI itself. Leave them blank.

Variable	Meaning	Default	Required	Layers
AUTH0_TEST_ORG_NAME	Slug of the test organisation Auth0 asks for at sign-in.	none	Not read by the stack	none
AUTH0_TEST_MANAGER_EMAIL	The test manager account.	none	Not read by the stack	none
AUTH0_TEST_MANAGER_PASSWORD	Its password.	none	Not read by the stack	none
AUTH0_TEST_MEMBER_EMAIL	The test member account.	none	Not read by the stack	none
AUTH0_TEST_MEMBER_PASSWORD	Its password.	none	Not read by the stack	none
AUTH0_DEMO_PASSWORD	The shared password of demonstration accounts made while working on Winner AI itself.	none	Not read by the stack	none

Team settings

A manager changes these on Settings, which shows each value, what it means and the layer that set it. A team value wins over the operator's, and the operator's over the release default; Reset removes the team value. A default written "as" a variable is that variable's row above. Settings also shows fixed rows (Window, Prompt length, Judge batch, Summary bullets, Rubric, Generation exemplars, Mining version, Eligibility, Token cap, Licence grace and Versions): release constants that no layer changes.

Model

On Settings	Key	Release default	Who can change it	Meaning
Endpoint	llm_endpoint	as FLEETVIEW_LLM_ENDPOINT	operator; team, together with Model	Where every Prompt Coaching, Skills and Benchmarks model call goes.
Model	llm_model	as FLEETVIEW_LLM_MODEL	operator; team, together with Endpoint	The model that judges prompts, names workflows, writes skills and scores benchmark replays.
Provider	llm_provider	as FLEETVIEW_LLM_PROVIDER	operator only; read-only on Settings	Which API this host's model is called through, an OpenAI-compatible endpoint or Amazon Bedrock, while a team's own key always uses an OpenAI-compatible endpoint.
Region	llm_region	as FLEETVIEW_LLM_REGION	operator only; read-only on Settings	The AWS region of this host's Amazon Bedrock endpoint, unused unless the provider is Amazon Bedrock.
API key	llm_api_key	none	operator; team, its own key, sealed (needs FLEETVIEW_SETTINGS_KEYS)	The key sent with each model call. Settings shows only whether one is set and its last four characters.
Without a team key	llm_fallback	as FLEETVIEW_LLM_FALLBACK	operator only; read-only on Settings	Whether a team with no key of its own uses the host's model (host) or runs no model work (refuse).

Prompt Coaching

On Settings	Key	Release default	Who can change it	Meaning
Prompts judged per day	coaching_daily_budget	as FLEETVIEW_COACHING_DAILY_BUDGET	operator; team, 0 to 5000	The most prompts judged in any rolling day, which caps the coaching bill; 0 pauses coaching.
Frontier model families	frontier_model_families	opus, fable, gpt-5.6	team only	The model families that count as top tier for the coaching judge and the coaching band.

Skills

On Settings	Key	Release default	Who can change it	Meaning
Clusters named per sweep	skills_naming_budget	20	team only, 0 to 100	How many new repeated workflows the model names on each sweep, which bounds the skills bill; 0 pauses naming.
Prompt similarity	skills_similarity	80 (percent similar)	team only, 60 to 99	How alike two prompts must be to count as one workflow; a change regroups on the next sweep.
Prompts per workflow	skills_min_prompts	3	team only, 3 to 50	How many prompts a workflow needs before it is shown.
Sessions per workflow	skills_min_sessions	2	team only, 1 to 20	How many separate sessions those prompts must span.

Benchmarks

On Settings	Key	Release default	Who can change it	Meaning
Replay runs per day	benchmark_daily_runs	as FLEETVIEW_BENCHMARK_DAILY_RUNS	operator; team, 0 to 500	How many replays on cheaper models may run in any rolling day, each a model call that is paid for; 0 pauses replays.
Quality threshold	benchmark_quality_threshold	as FLEETVIEW_BENCHMARK_QUALITY_THRESHOLD	operator; team, 0 to 100	The judged score a replay must reach, with every structured check passed, to count as Equivalent.
Context budget per turn	context_token_budget	150000	team only, 10000 to 1000000	The cache-read tokens a turn may carry before the context saving lever prices the rest as reclaimable.
Saving figure freshness	saving_lever_max_age_hours	24 hours	nobody: release only, read-only on Settings	How old a stored subagent or context saving may be before it reads Stale and leaves the total.
Routes to try	benchmark_routes	as FLEETVIEW_BENCHMARK_ROUTES	operator; team	For each model, the cheaper models replays run on and Prompt Coaching may recommend; live traffic is never rerouted.

Features and host

On Settings	Key	Release default	Who can change it	Meaning
Features on	features	as FLEETVIEW_FEATURES	operator sets the most that runs; a team can only switch one off	Which of Prompt Coaching, Skills and Benchmarks run for the team.
Sweep interval	jobs_interval_seconds	as FLEETVIEW_JOBS_INTERVAL_SECONDS	operator only; read-only on Settings	How often the jobs service visits every organisation and runs its features.
Model call timeout	llm_timeout_seconds	120 seconds	nobody in a deployment: the stack does not pass its variable through, so Settings shows the release default	How long one model call may take before it is abandoned.
Manager group	manager_group	as FLEETVIEW_MANAGER_GROUP	operator only; read-only on Settings	Without Auth0 Management credentials, the group from sign-in whose members are Managers.
Manager emails	manager_emails	as FLEETVIEW_MANAGER_EMAILS	operator only; read-only on Settings	Without Auth0 Management credentials, the addresses that are Managers when sign-in brings no usable groups.
Sign-in session	gate_session_seconds	as FLEETVIEW_GATE_SESSION_SECONDS	operator only; read-only on Settings	How long a sign-in lasts before the gate sends the person back to the provider to be admitted again.
Groups claim	groups_claim	https://fleetview.local/roles	operator only, as OAUTH2_PROXY_OIDC_GROUPS_CLAIM; read-only on Settings	The token claim the sign-in gate reads groups from.

Telemetry

On Settings	Key	Release default	Who can change it	Meaning
Error reporting	sentry_dsn	as FLEETVIEW_SENTRY_DSN	operator only; read-only on Settings	Where the backend and the jobs send error reports, timings and cron check-ins, without request bodies, local variables or error messages.
Error report environment	sentry_environment	as FLEETVIEW_SENTRY_ENVIRONMENT	operator only; read-only on Settings	The environment name every error report and check-in carries.
Timing sample rate	sentry_traces_sample_rate	0.02	operator only; read-only on Settings	The share of requests and jobs passes whose timings are sent, with no statement text, address or prompt.
Product analytics	posthog_key	as FLEETVIEW_POSTHOG_KEY	operator only; read-only on Settings	Whether usage events and page errors, never an error's message, go to the analytics project, which needs its key, its host and the identity hashing secret.
Analytics host	posthog_host	as FLEETVIEW_POSTHOG_HOST	operator only; read-only on Settings	The host usage events go to, which must be https and outside this host's network.
Page recording	posthog_replay	as FLEETVIEW_POSTHOG_REPLAY	operator only; read-only on Settings	Whether page sessions are recorded, with every text, input and attribute masked; in this release it shows off whatever it is set to.

Settings also shows Identity hashing: whether FLEETVIEW_TELEMETRY_SECRET is set, never its value.

The client

The options a person sets on a laptop. Everything else the winner client needs it reads from the control plane at winner login; the overrides below only replace what it discovers. Laptop client guide covers them, and Client reference has the detail.

Command	Option	Environment	Default	Meaning
winner login	--control-url	FLEETVIEW_CONTROL_URL	the URL recorded in ~/.agentsview/fleetview-control-url, which the installer and every successful login write; none is compiled in	The control plane to enroll against: the flag, then the variable, then the recorded URL. Plain http is accepted only to a loopback address.
winner login	--auth0-domain	FLEETVIEW_AUTH0_DOMAIN	none: read from the control plane	Override the Auth0 tenant.
winner login	--client-id	FLEETVIEW_AGENT_CLIENT_ID	none: read from the control plane	Override the native application's client id.
winner login	--audience	FLEETVIEW_AUDIENCE	none: read from the control plane	Override the API audience. The three Auth0 overrides apply only against a control plane without its own login; one that serves it ignores them. With all three set and the control plane's config unreadable, login signs in with them, and the session collector (agentsview) version check only warns.
winner login	--no-service	none	off	Enroll only: no background push, hostname reporter or automatic updates.
winner update	--control-url	FLEETVIEW_CONTROL_URL	the recorded URL	The control plane to converge against, resolved as for winner login.
winner update	--check	none	off	Report what would change and install nothing.
winner update	--force	none	off	Replace a winner that is not a release build (your own go build), or an agentsview whose version cannot be read.
winner push logs	-f, --follow; -n	none	off; 50 lines	Follow the log; how many lines to show.
winner push status	-v	none	off	Add the service manager's own report.
winner diagnostics	-o, --output	none	~/winner-diagnostics-<UTC time>.txt	The file to write; an existing file is never overwritten.
installer	none	FLEETVIEW_BIN_DIR	~/.local/bin	Where winner, and agentsview when the installer installs it, are placed.
installer	none	FLEETVIEW_CONTROL_URL	filled in by the control plane that serves the script	Needed only when the script runs from a checkout.
installer	none	FLEETVIEW_AGENT_URL	the control plane's download	Fetch the binary from a mirror instead.
installer	none	FLEETVIEW_AGENT_SHA256	none: the signed SHA256SUMS beside the binary	The expected digest, read only with FLEETVIEW_AGENT_URL; required for a mirror that is not https, or whose URL has no SHA256SUMS beside it. With it set the release signature is not checked: the digest is yours.
installer	none	FLEETVIEW_GH_TOKEN	none	A GitHub token for an https mirror that needs one.