Variable Reference — What the Data Lake Reads
This document lists only the variables that the data lake container actually reads. The authoritative source for defaults is plantpulse-datalake-cli/config/defaults.env inside the container, and any value passed from the host overrides it. The full set of host-side values (including DOCKER_*) is in the Environment Variable Reference.
For any variable in the table below whose «Can it be changed on the host?» column is No, the value does not reach the container even if it's in the sidecar, because Compose does not pass that name to the data lake. Its value is determined by defaults.env or the template.
Secrets — What Happens If They're Missing
The secrets known to pd fall into three lists. None of them have a default value anywhere; they only arrive via sidecar → Compose → environment variables.
| List | Variables | If missing |
|---|---|---|
| Required | PP_REDIS_PASSWORD PP_PG_PASSWORD PP_CASSANDRA_PASSWORD PP_S3_PASSWORD PP_MQ_PASSWORD PP_TSE_PASSWORD PP_SPARK_PASSWORD PP_HIVE_PASSWORD PP_GRAVITINO_PASSWORD PP_TEMPORAL_PASSWORD PP_KESTRA_DB_PASSWORD PP_KESTRA_ADMIN_PASSWORD PP_TLS_KEYSTORE_PASSWORD PP_CEP_API_KEY PP_DATA_GATEWAY_API_KEY | pd start stops with exit 3 and lists every missing name. Compose also requires them via :?, so the stack does not start at all |
| Worker Extra | PP_PG_REPLICA_PASSWORD | Required only on WORKER nodes |
| Optional | PP_DATALAKE_ADMIN_PASSWORD PP_DATALAKE_ADMIN_API_KEY PP_DATA_GATEWAY_WEB_PASSWORD PP_CEP_WEB_PASSWORD | Only that one feature is disabled. The stack starts normally. pd doctor tells you which name is missing |
How to change them is in Changing Passwords · API Keys. The derived value set (PP_TLS_TRUSTSTORE_PASSWORD · PP_REDIS_TRUSTSTORE_PASSWORD · PP_MQ_TRUSTSTORE_PASSWORD) is generated from the keystore password and is not set separately.
Node · Addresses
| Variable | Default | Meaning | Can be changed on the host? |
|---|---|---|---|
PP_MODE | MASTER | MASTER / WORKER. Workers are determined by worker-add.sh | Node file |
PP_HOST_IP | 10.99.0.100 (fixed IP on the Compose network) | This container's address. The basis for the advertised address | DOCKER_PP_IP |
PP_MASTER_IP | PP_HOST_IP | The address other machines use to connect to this data lake | Node file |
PP_SERVICE_IP | Empty value | Public IP behind NAT. Added to the TLS SAN | Node file DOCKER_PP_EXTERNAL_IP |
PP_KAFKA_ADVERTISED_HOST | Derived at startup | Address Kafka advertises to clients | Node file (only for NAT or a second interface) |
PP_CLUSTER_CORES | Host cores − 2 (4 ~ 30) | Core count advertised to Spark and others | DOCKER_PP_CLUSTER_CORES |
PP_DATA_DISK_NAME | Detected from the host | Device used to measure disk usage | DOCKER_PP_DATA_DISK_NAME |
PP_DATA_DIR · PP_TEMP_DIR · PP_BACKUP_DIR | /data1/pp-data · /data1/pp-temp · /data1/pp-backup | Volume mount locations | No (Compose literal) |
PP_LANG · PP_TZ | en · Asia/Seoul | Language · Time zone | Sidecar |
Storage
| Variable | Default | Can be changed on the host? |
|---|---|---|
PP_REDIS_USER · PP_REDIS_PORT | redis · 6379 | Account name only (not the port) |
PP_PG_USER · PP_POSTGRES_PORT · PP_DB_NAME | plantpulse · 5432 · pp | Account name · DB name (not the port) |
PP_CASSANDRA_USER · PP_CASSANDRA_PORT · PP_KEYSPACE | cassandra · 9042 · pp | Account name · Keyspace (not the port) |
PP_S3_USER · PP_S3_PORT · PP_S3_BUCKET | rustfs · 9000 · plantpulse | Account name only |
PP_PG_REPLICA_USER | replica | Sidecar |
PP_KEYSPACE · PP_DB_NAME · PP_TOPIC_PREFIX are identifiers that the data lake creates and applications read, so they are in the x-pp-secrets anchor in Compose to ensure both sides see the same values. Changing them after installation creates a new empty store under the new name, while the old data stays under the old name.
Analytics · Messaging · Time Series · Workflows
| Variable | Default | Can be changed on the host? |
|---|---|---|
PP_HIVE_USER · PP_HIVE_PORT · PP_HIVE_DB | hive · 9083 · hive-metastore-230 | Account name only |
PP_SPARK_USER · PP_SPARK_PORT · PP_SPARK_WEBUI_PORT · PP_KYUUBI_PORT | spark · 7077 · 4440 · 10000 | Account name only |
PP_GRAVITINO_USER · PP_GRAVITINO_ICEBERG_REST_PORT | gravitino · 19001 | Account name only |
PP_MQ_USER · PP_TOPIC_PREFIX | mq · pp | Sidecar |
PP_KAFKA_PORT · PP_KAFKA_TLS_PORT · PP_KAFKA_CONTROLLER_PORT | 9092 · 9094 · 9093 | No |
PP_MQTT_PORT · PP_MQTT_TLS_PORT | 1883 · 1884 | No |
PP_TSE_USER · PP_TSE_PORT · PP_TSE_TLS_PORT · PP_TSE_PROTOCOL | tse · 7800 · 7801 · http | Account name only |
PP_TSE_DATAPOINT_TTL | 31536000 (365 days) | No — template editing |
PP_TEMPORAL_USER · PP_TEMPORAL_PORT | temporal · 7233 | Account name only |
PP_KESTRA_DB_USER · PP_KESTRA_ADMIN_EMAIL · PP_KESTRA_PORT | kestra · admin@plantpulse.io · 8380 | Account name · Email |
PP_CEP_PORT · PP_CEP_TLS_PORT · PP_CEP_PROTOCOL | 7400 · 7401 · http | No |
PP_DATA_GATEWAY_PORT · PP_DATA_GATEWAY_TLS_PORT · PP_DATA_GATEWAY_PROTOCOL | 5500 · 5501 · http | No |
PP_TSE_DATAPOINT_TTL — The Lifetime of a Time Series Data PointThe time series engine stamps this TTL on every write (INSERT … USING TTL). Therefore, changing the value applies only to newly written rows; rows already written expire according to the old value. Raising it does not resurrect anything, and lowering it does not shorten existing rows. To change it, edit /etc/kopens/conf/plantpulse-timeseries-engine.conf.template.
Admin Console · Query Console
| Variable | Default | Meaning | Can be changed on the host? |
|---|---|---|---|
PP_DATALAKE_ADMIN_USER | admin | Admin console login name | Sidecar |
PP_DATALAKE_ADMIN_PASSWORD | Determined by the sidecar | Admin console password. If empty, only the console is disabled | passwd.sh |
PP_DATALAKE_ADMIN_API_KEY | None | X-API-Key for the log endpoint. If empty, only key authentication is disabled | passwd.sh |
PP_DATALAKE_ADMIN_PORT | 4949 | Listen port inside the container. 4950 is the same console's TLS port | No |
PP_DATALAKE_ADMIN_LOGS_ENABLED | true | If false, only the console's log screen is reduced | Sidecar |
PP_DATA_GATEWAY_WEB_USER · PP_DATA_GATEWAY_WEB_PASSWORD | admin · None | Data gateway console (SQL) login. If empty, only that console is closed | Sidecar |
PP_CEP_WEB_USER · PP_CEP_WEB_PASSWORD | admin · None | CEP console login. If empty, only that console is closed | Sidecar |
PP_BACKUP_SCHEDULE_ENABLED | true | Global backup timer switch | Sidecar |
The rest of the console settings set (PP_DATALAKE_ADMIN_PD_PATH · PP_DATALAKE_ADMIN_LOG_ROOT · PP_DATALAKE_ADMIN_BACKUP_HISTORY) is inserted by Compose as literals. There's no need to change them.
TLS
| Variable | Default | Meaning |
|---|---|---|
PP_TLS_ENABLED | true | Master switch |
PP_TLS_CERT_DIR | /var/security/plantpulse | Certificate directory |
PP_TLS_DOMAIN · PP_TLS_VALID_DAYS | plantpulse.io · 3650 | Certificate domain · Validity period |
PP_TLS_SAN_IPS · PP_TLS_SAN_DNS | Host IP · Host name | Certificate SAN. Must include the external access IP |
PP_TLS_NODE_NAMES · PP_MAX_WORKERS | master worker-1 … worker-5 · 5 | One certificate per worker. Both must match for the build to pass |
The certificate itself is created by the plantpulse-certs container → Security Settings
Variables Starting with PD_
PD_ are the data lake «local variables». Operators can set only two; the remaining 270 or so are either internal script variables or stamps baked into the image.
| Variable | Meaning |
|---|---|
PD_HOME | The tree where pd lives. Fixed by the image |
PD_OPTIONS | Component on/off JSON — {"enable-hive": false}. Any key omitted is ON. The current Compose stack does not pass this value to the container → FAQ |
PD_IMAGE_TAG · PD_IMAGE_BUILD_VERSION · PD_IMAGE_BUILT_AT · PD_IMAGE_VCS_REF | Image stamps. Do not touch them — pd env · pd doctor will attribute the wrong source |
Related Documents
- Environment Variable Reference — the full host-side set
- Where Are the Configuration Files
- How to Change Configuration