Server settings
Every setting below is read once at startup and requires a restart to change.
Built-in defaults are overridden by nonempty environment values.
For the first Pitot alpha, unset PITOT_ variables accept FANOUT_ equivalents with a names-only deprecation warning. Explicitly empty primary variables block fallback.
Unknown PITOT_ names fail startup; platform-injected service names are tolerated.
Vendor credentials and endpoints keep the vendor’s documented names.
| Environment variable | Type | Default |
|---|---|---|
PITOT_ADDR | string | 127.0.0.1:7520 |
PITOT_HEALTHCHECK_CERT_FILE | string | — |
PITOT_HEALTHCHECK_KEY_FILE | string | — |
PITOT_PPROF_ENABLED | boolean | false |
PITOT_PUBLIC_URL | string | — |
PITOT_QUERY_CACHE_TTL | duration | 10s |
PITOT_TLS_CERT_FILE | string | — |
PITOT_TLS_CLIENT_CA_FILE | string | — |
PITOT_TLS_KEY_FILE | string | — |
PITOT_TRUSTED_PROXY_CIDRS | string | — |
PITOT_ADDR
Section titled “PITOT_ADDR”Binds the browser, API, MCP, OTLP/gRPC and OTLP/HTTP listener.
PITOT_HEALTHCHECK_CERT_FILE
Section titled “PITOT_HEALTHCHECK_CERT_FILE”Selects the client certificate pitot healthcheck presents; requires PITOT_HEALTHCHECK_KEY_FILE and PITOT_TLS_CLIENT_CA_FILE.
PITOT_HEALTHCHECK_KEY_FILE
Section titled “PITOT_HEALTHCHECK_KEY_FILE”Selects the private key for PITOT_HEALTHCHECK_CERT_FILE; requires PITOT_HEALTHCHECK_CERT_FILE.
PITOT_PPROF_ENABLED
Section titled “PITOT_PPROF_ENABLED”Exposes Go’s net/http/pprof handlers at /debug/pprof/* for CPU/heap/mutex/goroutine profiling under load. Off by default; the routes require an admin browser session with operations:read.
PITOT_PUBLIC_URL
Section titled “PITOT_PUBLIC_URL”Sets the external browser origin, MCP token audience, and trusted MCP request origin. Required for OIDC; HTTPS is required with MCP.
PITOT_QUERY_CACHE_TTL
Section titled “PITOT_QUERY_CACHE_TTL”The oldest a dashboard panel, exemplar or trace detail result served from memory may be, measured from the end of the time window it covers (for traces and exemplars, from when their run started). A result younger than half the TTL is served as is; one younger than the TTL is served while one background run refreshes it; an older one is rerun. A request with Cache-Control: no-cache, such as a dashboard’s manual refresh, always reruns. Zero disables the cache; concurrent identical requests still share one execution.
PITOT_TLS_CERT_FILE
Section titled “PITOT_TLS_CERT_FILE”Selects the TLS certificate file; requires PITOT_TLS_KEY_FILE.
PITOT_TLS_CLIENT_CA_FILE
Section titled “PITOT_TLS_CLIENT_CA_FILE”Selects a PEM CA bundle; when set, the listener requires client certificates signed by it. Requires PITOT_TLS_CERT_FILE and PITOT_TLS_KEY_FILE.
PITOT_TLS_KEY_FILE
Section titled “PITOT_TLS_KEY_FILE”Selects the TLS private key file; requires PITOT_TLS_CERT_FILE.
PITOT_TRUSTED_PROXY_CIDRS
Section titled “PITOT_TRUSTED_PROXY_CIDRS”Lists trusted proxy networks, separated by commas; empty trusts no forwarded client addresses.