---
title: "Server settings"
summary: "Settings for the listener that serves the browser, API, chat, MCP and both OTLP transports."
description: "The shared HTTP and OTLP listener, the public URL, TLS, and proxy trust."
status: preview
generated: true
read_when:
  - "You are putting Pitot behind a reverse proxy."
  - "Browser sessions are not getting Secure cookies."
---

Every setting below is read once at startup and requires a restart to change.
Built-in defaults are overridden by nonempty environment values.
For the first Pitot alpha, unset `PITOT_` variables accept `FANOUT_` equivalents with a names-only deprecation warning. Explicitly empty primary variables block fallback.
Unknown `PITOT_` names fail startup; platform-injected service names are tolerated.
Vendor credentials and endpoints keep the vendor's documented names.

| Environment variable | Type | Default |
|---|---|---|
| `PITOT_ADDR` | string | `127.0.0.1:7520` |
| `PITOT_HEALTHCHECK_CERT_FILE` | string | — |
| `PITOT_HEALTHCHECK_KEY_FILE` | string | — |
| `PITOT_PPROF_ENABLED` | boolean | `false` |
| `PITOT_PUBLIC_URL` | string | — |
| `PITOT_QUERY_CACHE_TTL` | duration | `10s` |
| `PITOT_TLS_CERT_FILE` | string | — |
| `PITOT_TLS_CLIENT_CA_FILE` | string | — |
| `PITOT_TLS_KEY_FILE` | string | — |
| `PITOT_TRUSTED_PROXY_CIDRS` | string | — |

## Notes

### `PITOT_ADDR`

Binds the browser, API, MCP, OTLP/gRPC and OTLP/HTTP listener.

### `PITOT_HEALTHCHECK_CERT_FILE`

Selects the client certificate pitot healthcheck presents; requires PITOT_HEALTHCHECK_KEY_FILE and PITOT_TLS_CLIENT_CA_FILE.

### `PITOT_HEALTHCHECK_KEY_FILE`

Selects the private key for PITOT_HEALTHCHECK_CERT_FILE; requires PITOT_HEALTHCHECK_CERT_FILE.

### `PITOT_PPROF_ENABLED`

Exposes Go's net/http/pprof handlers at /debug/pprof/* for CPU/heap/mutex/goroutine profiling under load. Off by default; the routes require an admin browser session with operations:read.

### `PITOT_PUBLIC_URL`

Sets the external browser origin, MCP token audience, and trusted MCP request origin. Required for OIDC; HTTPS is required with MCP.

### `PITOT_QUERY_CACHE_TTL`

The oldest a dashboard panel, exemplar or trace detail result served from memory may be, measured from the end of the time window it covers (for traces and exemplars, from when their run started). A result younger than half the TTL is served as is; one younger than the TTL is served while one background run refreshes it; an older one is rerun. A request with Cache-Control: no-cache, such as a dashboard's manual refresh, always reruns. Zero disables the cache; concurrent identical requests still share one execution.

### `PITOT_TLS_CERT_FILE`

Selects the TLS certificate file; requires PITOT_TLS_KEY_FILE.

### `PITOT_TLS_CLIENT_CA_FILE`

Selects a PEM CA bundle; when set, the listener requires client certificates signed by it. Requires PITOT_TLS_CERT_FILE and PITOT_TLS_KEY_FILE.

### `PITOT_TLS_KEY_FILE`

Selects the TLS private key file; requires PITOT_TLS_CERT_FILE.

### `PITOT_TRUSTED_PROXY_CIDRS`

Lists trusted proxy networks, separated by commas; empty trusts no forwarded client addresses.