Configuration

The backend is configured via environment variables set in the Kubernetes Deployment manifest, with additional options for ingress, RBAC, and TLS.

Backend Environment Variables

The backend is configured via environment variables, typically set in the Kubernetes Deployment manifest.

Variable	Required	Default	Description
`PORT`	No	`8080`	HTTP server listen port
`NAMESPACE`	Yes	—	Platform namespace (e.g., `ftn-ai`)
`APPS_NAMESPACE`	Yes	—	Workloads namespace (e.g., `apps`)
`JWT_SECRET`	Yes	—	Secret for JWT signing
`DB_HOST`	Yes	—	PostgreSQL host
`DB_PORT`	No	`5432`	PostgreSQL port
`DB_NAME`	Yes	—	Database name
`DB_USER`	Yes	—	Database user
`DB_PASSWORD`	Yes	—	Database password
`ADMIN_EMAIL`	Yes	—	Initial admin email
`ADMIN_PASSWORD`	Yes	—	Initial admin password
`DOMAIN`	Yes	—	Base domain for generating workload URLs

Frontend Environment Variables

Variable	Required	Description
`NEXT_PUBLIC_API_URL`	No	Backend API base URL (defaults to `/api` via proxy)

Ingress Configuration

All workloads use Traefik ingress with the following URL patterns:

Resource	URL Pattern
Platform UI	`https://<DOMAIN>`
Jupyter Notebook	`https://<DOMAIN>/jupyter/<name>/`
MCP Server	`https://<DOMAIN>/mcp/<name>/`
Ollama API	`https://<DOMAIN>/ollama/`

Ingress Priority

Traefik uses priority annotations to ensure specific routes take precedence over wildcard routes. The platform automatically sets appropriate priorities when creating ingress resources.

Kubernetes RBAC

The backend service account requires the following permissions:

rules:
- apiGroups: ["apps"]
  resources: ["deployments", "statefulsets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["pods", "services", "persistentvolumeclaims", "nodes"]
  verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["nodes", "pods"]
  verbs: ["get", "list"]

TLS / HTTPS

cert-manager is recommended for automatic TLS certificate management. Configure a ClusterIssuer pointing to Let’s Encrypt and annotate ingress resources with:

cert-manager.io/cluster-issuer: letsencrypt-prod

For local development, use letsencrypt-staging or a self-signed issuer.