Variable Reference — What the Data Lake Reads
This document collects only the variables that the data lake container actually reads. The source of truth for defaults is plantpulse-datalake-cli/config/defaults.env inside the container; values passed from the host override it. All host-side values (including DOCKER_*) are in the environment variable reference.
Variables in the table below whose «Changeable from host» column is No do not enter the container at all, even via the sidecar. The compose file does not pass that name to the data lake. The value is set by defaults.env or a template.
Secrets — What happens if missing
The secrets known to pd come in three lists. Values have no defaults anywhere; they enter only via sidecar → compose → environment variable.
| List | Variable | If missing |
|---|---|---|
| Required | PP_REDIS_PASSWORD PP_PG_PASSWORD PP_CASSANDRA_PASSWORD PP_MINIO_PASSWORD PP_MQ_PASSWORD PP_TSE_PASSWORD PP_SPARK_PASSWORD PP_HIVE_PASSWORD PP_GRAVITINO_PASSWORD PP_TEMPORAL_PASSWORD PP_KESTRA_DB_PASSWORD PP_KESTRA_ADMIN_PASSWORD PP_TLS_KEYSTORE_PASSWORD PP_CEP_API_KEY PP_DATA_GATEWAY_API_KEY | pd start stops with exit 3 and lists all missing names. Compose also demands :? and the stack does not start at all |
| Worker additional | PP_PG_REPLICA_PASSWORD | Required only on WORKER nodes |
| Optional | PP_DATALAKE_ADMIN_PASSWORD PP_DATALAKE_ADMIN_API_KEY PP_DATA_GATEWAY_WEB_PASSWORD PP_CEP_WEB_PASSWORD | That one feature only turns off. Stack starts normally. pd doctor tells you the name |
How to change them is in passwords · API keys. The derived value set (PP_TLS_TRUSTSTORE_PASSWORD · PP_REDIS_TRUSTSTORE_PASSWORD · PP_MQ_TRUSTSTORE_PASSWORD) is generated from the keystore password and is not set separately.
Node · Address
| Variable | Default | Meaning | Changeable from host |
|---|---|---|---|
PP_MODE | MASTER | MASTER / WORKER. Workers are set by worker-add.sh | Node file |
PP_HOST_IP | 10.99.0.100 (compose network static IP) | This container's address. Basis for advertised address | DOCKER_PP_IP |
PP_MASTER_IP | PP_HOST_IP | Address where other boxes connect to this data lake | Node file |
PP_SERVICE_IP | Empty | Public IP behind NAT. Goes into TLS SAN | Node file DOCKER_PP_EXTERNAL_IP |
PP_KAFKA_ADVERTISED_HOST | Inferred at startup | Address Kafka advertises to clients | Node file (NAT · secondary interface only) |
PP_CLUSTER_CORES | Host cores − 2 (4–30) | Number of cores reported to Spark and others | DOCKER_PP_CLUSTER_CORES |
PP_DATA_DISK_NAME | Detected from host | Device to measure disk usage on | DOCKER_PP_DATA_DISK_NAME |
PP_DATA_DIR · PP_TEMP_DIR · PP_BACKUP_DIR | /data1/pp-data · /data1/pp-temp · /data1/pp-backup | Volume mount points | No (compose literals) |
PP_LANG · PP_TZ | en · Asia/Seoul | Language · timezone | Sidecar |
Storage
| Variable | Default | Changeable from host |
|---|---|---|
PP_REDIS_USER · PP_REDIS_PORT | redis · 6379 | Account name only (port is no) |
PP_PG_USER · PP_POSTGRES_PORT · PP_DB_NAME | plantpulse · 5432 · pp | Account name · database name (port is no) |
PP_CASSANDRA_USER · PP_CASSANDRA_PORT · PP_KEYSPACE | cassandra · 9042 · pp | Account name · keyspace (port is no) |
PP_MINIO_USER · PP_MINIO_PORT · PP_MINIO_BUCKET | minio · 9000 · plantpulse | Account name only |
PP_PG_REPLICA_USER | replica | Sidecar |
PP_KEYSPACE · PP_DB_NAME · PP_TOPIC_PREFIX are identifiers that the data lake creates and the app reads, so they live in the compose x-pp-secrets anchor so both sides see them the same. If you change them after installation, a new empty storage appears under the new name and old data remains under the old name.
Analytics · Messaging · Time series · Workflow
| Variable | Default | Changeable from host |
|---|---|---|
PP_HIVE_USER · PP_HIVE_PORT · PP_HIVE_DB | hive · 9083 · hive-metastore-230 | Account name only |
PP_SPARK_USER · PP_SPARK_PORT · PP_SPARK_WEBUI_PORT · PP_KYUUBI_PORT | spark · 7077 · 4440 · 10000 | Account name only |
PP_GRAVITINO_USER · PP_GRAVITINO_ICEBERG_REST_PORT | gravitino · 19001 | Account name only |
PP_MQ_USER · PP_TOPIC_PREFIX | mq · pp | Sidecar |
PP_KAFKA_PORT · PP_KAFKA_TLS_PORT · PP_KAFKA_CONTROLLER_PORT | 9092 · 9094 · 9093 | No |
PP_MQTT_PORT · PP_MQTT_TLS_PORT | 1883 · 1884 | No |
PP_TSE_USER · PP_TSE_PORT · PP_TSE_TLS_PORT · PP_TSE_PROTOCOL | tse · 7800 · 7801 · http | Account name only |
PP_TSE_DATAPOINT_TTL | 31536000 (365 days) | No — edit template |
PP_TEMPORAL_USER · PP_TEMPORAL_PORT | temporal · 7233 | Account name only |
PP_KESTRA_DB_USER · PP_KESTRA_ADMIN_EMAIL · PP_KESTRA_PORT | kestra · admin@plantpulse.io · 8380 | Account name · email |
PP_CEP_PORT · PP_CEP_TLS_PORT · PP_CEP_PROTOCOL | 7400 · 7401 · http | No |
PP_DATA_GATEWAY_PORT · PP_DATA_GATEWAY_TLS_PORT · PP_DATA_GATEWAY_PROTOCOL | 5500 · 5501 · http | No |
PP_TSE_DATAPOINT_TTL — Lifetime of one time series pointThe time series engine stamps this TTL on every write (INSERT … USING TTL). So if you change the value, it applies only to newly written rows, and already-written rows expire by the old value. Increasing it does not resurrect them, decreasing it does not shorten them. To change it, edit /etc/kopens/conf/plantpulse-timeseries-engine.conf.template.
Admin console · Query console
| Variable | Default | Meaning | Changeable from host |
|---|---|---|---|
PP_DATALAKE_ADMIN_USER | admin | Admin console login name | Sidecar |
PP_DATALAKE_ADMIN_PASSWORD | Set by sidecar | Admin console password. If empty, console only turns off | passwd.sh |
PP_DATALAKE_ADMIN_API_KEY | None | X-API-Key for log endpoint. If empty, key auth only turns off | passwd.sh |
PP_DATALAKE_ADMIN_PORT | 4949 | Listen port inside container. 4950 is TLS for the same console | No |
PP_DATALAKE_ADMIN_LOGS_ENABLED | true | If false, console log screen only turns off | Sidecar |
PP_DATA_GATEWAY_WEB_USER · PP_DATA_GATEWAY_WEB_PASSWORD | admin · None | Data gateway console (SQL) login. If empty, that console closes | Sidecar |
PP_CEP_WEB_USER · PP_CEP_WEB_PASSWORD | admin · None | CEP console login. If empty, that console closes | Sidecar |
PP_BACKUP_SCHEDULE_ENABLED | true | Global backup timer switch | Sidecar |
The remaining console settings (PP_DATALAKE_ADMIN_PD_PATH · PP_DATALAKE_ADMIN_LOG_ROOT · PP_DATALAKE_ADMIN_BACKUP_HISTORY) are put in by compose as literals. You would not change them.
TLS
| Variable | Default | Meaning |
|---|---|---|
PP_TLS_ENABLED | true | Master switch |
PP_TLS_CERT_DIR | /var/security/plantpulse | Certificate directory |
PP_TLS_DOMAIN · PP_TLS_VALID_DAYS | plantpulse.io · 3650 | Certificate domain · validity period |
PP_TLS_SAN_IPS · PP_TLS_SAN_DNS | Host IP · host name | Certificate SAN. Must include external access IP |
PP_TLS_NODE_NAMES · PP_MAX_WORKERS | master worker-1 … worker-5 · 5 | One certificate per worker. Both must match for build to pass |
The certificates themselves are created by the plantpulse-certs container → security setup
Variables starting with PD_
PD_ are data lake «local variables». Operators set only two of them; the rest are internal script variables or stamps baked into the image.
| Variable | Meaning |
|---|---|
PD_HOME | Tree where pd lives. Set by image |
PD_OPTIONS | Component on/off JSON — {"enable-hive": false}. Omitted keys turn on. Current compose stack does not pass this value to the container → FAQ |
PD_IMAGE_TAG · PD_IMAGE_BUILD_VERSION · PD_IMAGE_BUILT_AT · PD_IMAGE_VCS_REF | Image stamps. Do not touch — source attribution by pd env · pd doctor becomes false |