Configuration reference

Oriel loads oriel.toml by default and then applies environment overrides. A missing config file is allowed only when the path was not explicitly named.

Defaults

TOML key	Default
server.http_addr	:6743
server.public_url	empty
server.insecure	false
server.tls.cert_file	empty
server.tls.key_file	empty
ingest.grpc_addr	:4317
ingest.http_addr	:4318
ingest.http_on_server	false
ingest.max_attributes	128
ingest.max_attr_key_bytes	256
ingest.max_attr_val_bytes	8192
ingest.max_body_bytes	262144
ingest.max_events	128
ingest.max_links	64
ingest.max_batch_rows	200000
ingest.batch_max_rows	50000
ingest.batch_max_bytes	33554432
ingest.batch_interval	1s
ingest.batch_buffer_bytes	67108864
ingest.series_cap	2000000
query.deadline	25s
query.max_execution	15s
query.scan_budget_aggregate	4000000000
query.scan_budget_list	1000000000
flags.stale_after	720h
flags.unused_window	336h
flags.unused_threshold	0
flags.unused_detection	true
flags.scan_interval	15m
alert.allow_private_targets	false
span_metrics.enabled	false
span_metrics.retention_days	90
clickhouse.dsn	clickhouse://localhost:9000/oriel
metadata.dsn	empty, required for serving and metadata commands
valkey.dsn	valkey://localhost:6379/0
valkey.key_prefix	oriel
valkey.operation_timeout	500ms
valkey.ruleset_ttl	10m
valkey.session_cache_ttl	30s
valkey.token_cache_ttl	30s
rate_limit.enabled	true
rate_limit.window	1m
rate_limit.auth_attempts	10
rate_limit.signup_attempts	5
rate_limit.invitation_attempts	20
rate_limit.sdk_requests	600
auth.cookie_secret	empty; required when any OIDC provider is enabled
admin.allow_signup	false
admin.email_domain_allowlist	empty
admin.workspace_create_policy	instance_admins
admin.oidc_jit_provisioning	true
admin.invite_ttl_hours	168
admin.smtp.host	empty, disables invite email delivery
admin.smtp.port	0; invite mailer uses 587 when unset
admin.smtp.username	empty
admin.smtp.password	empty
admin.smtp.from	empty
admin.smtp.starttls	unset
self_observability.enabled	true
self_observability.interval	30s
self_observability.sample_ratio	1.0
log.level	info
log.format	auto

Environment overrides

Environment variable	TOML key
ORIEL_SERVER_HTTP_ADDR	server.http_addr
ORIEL_SERVER_PUBLIC_URL	server.public_url
ORIEL_SERVER_INSECURE	server.insecure
ORIEL_SERVER_TLS_CERT_FILE	server.tls.cert_file
ORIEL_SERVER_TLS_KEY_FILE	server.tls.key_file
ORIEL_INGEST_GRPC_ADDR	ingest.grpc_addr
ORIEL_INGEST_HTTP_ADDR	ingest.http_addr
ORIEL_INGEST_HTTP_ON_SERVER	ingest.http_on_server
ORIEL_INGEST_MAX_ATTRIBUTES	ingest.max_attributes
ORIEL_INGEST_MAX_ATTR_KEY_BYTES	ingest.max_attr_key_bytes
ORIEL_INGEST_MAX_ATTR_VAL_BYTES	ingest.max_attr_val_bytes
ORIEL_INGEST_MAX_BODY_BYTES	ingest.max_body_bytes
ORIEL_INGEST_MAX_EVENTS	ingest.max_events
ORIEL_INGEST_MAX_LINKS	ingest.max_links
ORIEL_INGEST_MAX_BATCH_ROWS	ingest.max_batch_rows
ORIEL_INGEST_BATCH_MAX_ROWS	ingest.batch_max_rows
ORIEL_INGEST_BATCH_MAX_BYTES	ingest.batch_max_bytes
ORIEL_INGEST_BATCH_INTERVAL	ingest.batch_interval
ORIEL_INGEST_BATCH_BUFFER_BYTES	ingest.batch_buffer_bytes
ORIEL_INGEST_SERIES_CAP	ingest.series_cap
ORIEL_QUERY_DEADLINE	query.deadline
ORIEL_QUERY_MAX_EXECUTION	query.max_execution
ORIEL_QUERY_SCAN_BUDGET_AGGREGATE	query.scan_budget_aggregate
ORIEL_QUERY_SCAN_BUDGET_LIST	query.scan_budget_list
ORIEL_FLAGS_STALE_AFTER	flags.stale_after
ORIEL_FLAGS_UNUSED_WINDOW	flags.unused_window
ORIEL_FLAGS_UNUSED_THRESHOLD	flags.unused_threshold
ORIEL_FLAGS_UNUSED_DETECTION	flags.unused_detection
ORIEL_FLAGS_SCAN_INTERVAL	flags.scan_interval
ORIEL_ALERT_ALLOW_PRIVATE_TARGETS	alert.allow_private_targets
ORIEL_SPAN_METRICS_ENABLED	span_metrics.enabled
ORIEL_SPAN_METRICS_RETENTION_DAYS	span_metrics.retention_days
ORIEL_CLICKHOUSE_DSN	clickhouse.dsn
ORIEL_METADATA_DSN	metadata.dsn
ORIEL_VALKEY_DSN	valkey.dsn
ORIEL_VALKEY_KEY_PREFIX	valkey.key_prefix
ORIEL_VALKEY_OPERATION_TIMEOUT	valkey.operation_timeout
ORIEL_VALKEY_RULESET_TTL	valkey.ruleset_ttl
ORIEL_VALKEY_SESSION_CACHE_TTL	valkey.session_cache_ttl
ORIEL_VALKEY_TOKEN_CACHE_TTL	valkey.token_cache_ttl
ORIEL_RATE_LIMIT_ENABLED	rate_limit.enabled
ORIEL_RATE_LIMIT_WINDOW	rate_limit.window
ORIEL_RATE_LIMIT_AUTH_ATTEMPTS	rate_limit.auth_attempts
ORIEL_RATE_LIMIT_SIGNUP_ATTEMPTS	rate_limit.signup_attempts
ORIEL_RATE_LIMIT_INVITATION_ATTEMPTS	rate_limit.invitation_attempts
ORIEL_RATE_LIMIT_SDK_REQUESTS	rate_limit.sdk_requests
ORIEL_AUTH_COOKIE_SECRET	auth.cookie_secret
ORIEL_ADMIN_ALLOW_SIGNUP	admin.allow_signup
ORIEL_ADMIN_WORKSPACE_CREATE_POLICY	admin.workspace_create_policy
ORIEL_ADMIN_OIDC_JIT_PROVISIONING	admin.oidc_jit_provisioning
ORIEL_ADMIN_INVITE_TTL_HOURS	admin.invite_ttl_hours
ORIEL_ADMIN_SMTP_HOST	admin.smtp.host
ORIEL_ADMIN_SMTP_PORT	admin.smtp.port
ORIEL_ADMIN_SMTP_USERNAME	admin.smtp.username
ORIEL_ADMIN_SMTP_PASSWORD	admin.smtp.password
ORIEL_ADMIN_SMTP_FROM	admin.smtp.from
ORIEL_ADMIN_SMTP_STARTTLS	admin.smtp.starttls
ORIEL_SELF_OBSERVABILITY_ENABLED	self_observability.enabled
ORIEL_SELF_OBSERVABILITY_INTERVAL	self_observability.interval
ORIEL_SELF_OBSERVABILITY_SAMPLE_RATIO	self_observability.sample_ratio
ORIEL_LOG_LEVEL	log.level
ORIEL_LOG_FORMAT	log.format

OIDC provider client secrets can be overridden with:

ORIEL_AUTH_OIDC_<SLUG>_CLIENT_SECRET

The slug is uppercased and hyphens become underscores.

Server

[server]
http_addr = ":6743"
public_url = "https://oriel.example.com"
insecure = false

[server.tls]
cert_file = ""
key_file = ""

Native TLS is enabled only when both cert_file and key_file are set.

Ingest

[ingest]
grpc_addr = ":4317"
http_addr = ":4318"
http_on_server = false
max_attributes = 128
max_attr_key_bytes = 256
max_attr_val_bytes = 8192
max_body_bytes = 262144
max_events = 128
max_links = 64
max_batch_rows = 200000
batch_max_rows = 50000
batch_max_bytes = 33554432
batch_interval = "1s"
batch_buffer_bytes = 67108864
series_cap = 2000000

Both ingest listeners use the same TLS configuration as the server when native TLS is configured.

Set http_on_server = true to also mount OTLP/HTTP on the API/UI listener (server.http_addr) under /v1/traces, /v1/logs, and /v1/metrics. This only applies to oriel serve --role=all; the dedicated ingest.http_addr listener remains enabled by default. Profile OTLP/HTTP is also mounted at /v1/profiles.

The row limits clamp oversized attributes and log bodies with ORL-1009 warnings where possible. Request row count and buffer limits reject with ORL-1004. Backpressure returns ORL-1012. series_cap is the per-project active metric series ceiling.

Query

[query]
deadline = "25s"
max_execution = "15s"
scan_budget_aggregate = 4000000000
scan_budget_list = 1000000000

deadline bounds the HTTP query request. max_execution maps to ClickHouse max_execution_time. The scan budgets map to max_rows_to_read for aggregate and list-shaped OQL plans. See Query budgets and rate limits for operator guidance.

Alerts

[alert]
allow_private_targets = false

By default, alert delivery refuses webhook, ntfy, and SMTP targets that resolve to loopback, link-local, private, multicast, or unspecified addresses. Set allow_private_targets = true only for trusted deployments that intentionally deliver to internal endpoints.

Span metrics

[span_metrics]
enabled        = false
retention_days = 90

When enabled, the worker derives RED metrics from spans into metric_points (see Derived metrics). It is off by default because the series cardinality follows the spans’; retention_days sets how long the derived series are kept.

Feature flags

[flags]
stale_after      = "720h"
unused_window    = "336h"
unused_threshold = 0
unused_detection = true
scan_interval    = "15m"

The worker scans each project’s flags for staleness every scan_interval. A temporary flag idle longer than stale_after, a flag settled to one variation in every environment, an unmaintained flag, or a flag at or below unused_threshold evaluations over unused_window is flagged for cleanup. Detection is advisory and never archives or deletes a flag. The unused signal depends on evaluation telemetry; set unused_detection = false on deployments that do not emit it, such as query-only nodes or purely client-side SDKs, so live flags are not flagged for lack of data.

Storage

[clickhouse]
dsn = "clickhouse://oriel:oriel@localhost:9000/oriel"

[metadata]
dsn = "postgres://oriel:oriel@localhost:5432/oriel"

[valkey]
dsn = "valkey://localhost:6379/0"
key_prefix = "oriel"
operation_timeout = "500ms"
ruleset_ttl = "10m"
session_cache_ttl = "30s"
token_cache_ttl = "30s"

The metadata DSN is required. ClickHouse is required for ingest, query, worker, and most doctor checks. Valkey is required for serving and readiness; Oriel uses it for versioned feature-flag ruleset cache entries and SDK stream fanout while PostgreSQL remains authoritative.

Rate limits

[rate_limit]
enabled = true
window = "1m"
auth_attempts = 10
signup_attempts = 5
invitation_attempts = 20
sdk_requests = 600

Rate limits protect public auth, signup, invitation, and feature-flag SDK endpoints. They use Valkey fixed windows and are separate from OQL scan budgets.

OIDC

[auth]
cookie_secret = "replace-with-a-stable-secret"

[auth.oidc.company]
name = "Company SSO"
icon = "generic"
issuer = "https://id.example.com"
client_id = "oriel"
client_secret = "change-me"
redirect_url = ""
scopes = ["openid", "profile", "email"]
groups_claim = "groups"

If redirect_url is empty, Oriel derives it from server.public_url. When any OIDC provider is enabled, auth.cookie_secret must be set to a stable shared value; otherwise oriel serve refuses to start. Local password sessions do not use this setting.

Admin

[admin]
allow_signup = false
email_domain_allowlist = []
workspace_create_policy = "instance_admins"
oidc_jit_provisioning = true
invite_ttl_hours = 168

[admin.smtp]
host = ""
port = 587
username = ""
password = ""
from = "oriel@example.com"
starttls = true

workspace_create_policy accepts instance_admins, any_user, or nobody. An empty SMTP host disables invitation email delivery; invitation creation still returns a one-time accept link. The SMTP password is best supplied through ORIEL_ADMIN_SMTP_PASSWORD. The invite mailer uses Go’s SMTP delivery path, which negotiates STARTTLS when the server advertises it.

Logging

[log]
level = "info"
format = "auto"

level accepts debug, info, warn, and error. format accepts auto, json, and console.