Configure ScenarioX Self-Hosted V1

Copy .env.example to .env in the extracted package directory. Replace every <...> placeholder before running ./scenariox start.

Release identity

Do not use latest or substitute a different image tag for one service. The image digest inventory applies to one release as a unit.

Database and storage secrets

Generate unique long random values for:

• POSTGRES_SUPERUSER_PASSWORD
• SCENARIOX_APP_DB_PASSWORD
• SCENARIOX_AUTH_DB_PASSWORD
• SCENARIOX_SESSION_DB_PASSWORD
• SCENARIOX_MIGRATOR_DB_PASSWORD
• S3_ACCESS_KEY
• S3_SECRET_KEY

Update DATABASE_URL, AUTH_DB_URL, and SESSION_DB_URL with the matching generated passwords. Keep the Compose service hostnames postgres, redis, and minio unless the deployment has been deliberately adapted and validated for external infrastructure.

Authentication keys

Set:

AUTH_JWT_PRIVATE_KEY_FILE=./secrets/scenariox-jwt-private.pem
AUTH_JWT_PUBLIC_KEY_FILE=./secrets/scenariox-jwt-public.pem
IDP_PROVIDER=local

The private key must not be readable by other host users. AUTH_JWT_PRIVATE_KEY_FILE and AUTH_JWT_PUBLIC_KEY_FILE are Docker Compose secret source paths; they control which host files are mounted into the service container. The algorithm is fixed at RS256 in V1 and is not operator-configurable. The operator accepts common owner/group-restricted modes and rejects world-readable key files.

Local administrator login is the supported V1 identity path. SSO and SCIM are not available in Self-Hosted V1.

AI provider

LLM_PROVIDER=anthropic
ANTHROPIC_API_KEY=<customer-anthropic-api-key>
LLM_MODEL=claude-sonnet-4-6

Anthropic is the only supported provider in V1. The API key remains on the orchestration service and is not injected into candidate workspaces.

Codex proof-of-concept mode

Codex direct-provider access is disabled by default and is not a production credential model. For an isolated proof of concept only, configure a low-scope, spend-capped ScenarioX key:

Copy .env.codex-poc.example to .env.codex-poc, then place only the key in that orchestrator-specific file:

OPENAI_API_KEY=<scenariox-managed-poc-key>

Keep the non-secret feature controls in .env:

CODEX_POC_ENABLED=true
CODEX_PROVIDER=openai
CODEX_MODEL=gpt-5.3-codex

Only workspace-orchestrator loads .env.codex-poc; other platform services do not receive the reusable key. In this mode the key is injected into the assigned candidate workspace and is therefore readable by the candidate shell. It is never baked into an image or persisted in runtime metadata. Candidate workspaces remain on internal networks and can reach OpenAI only through the bundled proxy, which permits HTTPS CONNECT to api.openai.com:443 and denies all other destinations. Keep this mode disabled outside the controlled POC; production Codex access requires Credential Broker-issued session references.

The customer package does not support Ollama. Customer Compose forces local-provider mode off and ships an OpenAI-only egress policy so assessed sessions cannot reach a host model. Ollama is available only from the repository's local-development stack and does not replace final acceptance against the production OpenAI provider.

Public hostnames and TLS

The bundled edge listens over HTTP. Production HTTPS termination is customer-managed and must sit in front of the edge.

Configure DNS and the external proxy for:

• the recruiter application hostname
• the candidate assessment hostname
• RUNTIME_HOST for workspace routing

Set CANDIDATE_AUTH_COOKIE_DOMAIN to the shared parent domain used by the candidate entry point and set CANDIDATE_AUTH_COOKIE_SECURE=true for production HTTPS.

Login rate limiting

The auth service throttles password login attempts to protect against credential stuffing.

Requires Redis (REDIS_URL must be reachable by the auth service). If Redis is unavailable, login returns 503.

Workspace limits

The template exposes CPU, memory, disk quota, pool size, and network isolation values. Treat the supplied values as defaults, not a validated sizing promise. Keep WORKSPACE_NETWORK_ISOLATION=true.

Validate configuration

./scenariox config-check
./scenariox preflight

Neither command prints configured secret values. Correct every reported error before pulling or starting images.