Configure OpenSourceOM

om reads process environment variables. It does not load .env. Docker Compose interpolates .env for the API service. Copy .env.example in the core repository and export only the variables you need in the shell that runs the CLI.

A database URL is built from the POSTGRES_* variables unless DATABASE_URL is set. The default URL is postgres://opensourceom:opensourceom@localhost:5432/opensourceom?sslmode=disable.

Process

Variable	Default	Used by
`OM_ENV`	`development`	API container label. The CLI stores it and does not branch on it.
`OM_LOG_LEVEL`	`info`	Reserved. The API logger is the standard library logger.
`OM_PUBLIC_URL`	`http://localhost:8080`	Browser origin for the console and optional OAuth callbacks. No trailing path.
`OM_API_PORT`	`8080`	`om serve`
`OM_AUTO_MIGRATE`	`true`	`om serve` applies pending migrations before it listens. Set `false` when `om migrate` should be the only schema change. `om migrate` itself ignores this variable.
`OM_ADMIN_EMAIL`	empty	When set, only this address can become the first admin.
`OM_SMTP_HOST` / `OM_SMTP_PORT` / `OM_SMTP_FROM`	empty / `587` / empty	Optional. When set, adding an admin emails the temporary password, and the sign-in page can email a password-reset link. Set `OM_PUBLIC_URL` so that link is a full address.
`OM_SMTP_USERNAME` / `OM_SMTP_PASSWORD`	empty	Optional SMTP authentication. Set both when the server requires a login.
`OM_GOOGLE_CLIENT_ID` / `OM_GOOGLE_CLIENT_SECRET`	empty	Google sign-in. Both are required. Callback `{OM_PUBLIC_URL}/auth/google/callback`.
`OM_GITHUB_CLIENT_ID` / `OM_GITHUB_CLIENT_SECRET`	empty	GitHub sign-in. Both are required. Callback `{OM_PUBLIC_URL}/auth/github/callback`.

Database

Variable	Default
`DATABASE_URL`	Built from the fields below
`POSTGRES_USER`	`opensourceom`
`POSTGRES_PASSWORD`	`opensourceom`
`POSTGRES_DB`	`opensourceom`
`POSTGRES_HOST`	`localhost`
`POSTGRES_PORT`	`5432`

Inside Compose, the API service sets POSTGRES_HOST=postgres. On your laptop, keep the CLI default of localhost.

Collectors

Variable	Default	Required for
`AWS_REGION`	`us-east-1`	`om scan aws` (one region per run)
`AZURE_SUBSCRIPTION_ID`	empty	`om scan azure`
`AZURE_LOCATION`	`eastus`	Fallback region on Azure node IDs
`GCP_PROJECT_ID`	empty	`om scan gcp`
`GCP_REGION`	`us-central1`	Region segment on GCP identity and bucket IDs
`K8S_CLUSTER`	`default`	Account id. Also the kubeconfig context when it is not `default` and a kubeconfig is used. In a pod with no `KUBECONFIG`, it is only the account id.
`K8S_NAMESPACE`	empty (all namespaces)	Limit `om scan k8s` to one namespace
`NVD_API_KEY`	empty	Higher NVD rate limits for `om enrich cve` when no catalog is set
`OM_CVE_CATALOG`	empty	JSON file used instead of NVD. `--catalog` overrides it.

AWS, Azure, and GCP credentials themselves come from each SDK’s default chain (AWS_ACCESS_KEY_ID, az login, GOOGLE_APPLICATION_CREDENTIALS, instance metadata, and so on). Core does not have its own credential store.

Exports

Variable	Used when
`SLACK_WEBHOOK_URL`	`om export findings run --format slack`
`JIRA_URL`	Jira site base URL
`JIRA_EMAIL`	Jira account email
`JIRA_API_TOKEN`	Jira API token
`JIRA_PROJECT`	Project key for created issues