Configuration

This page helps you configure the Reflex server and agent for your environment.

How to set a value

Use an environment variable, or an application.yaml in the config/ folder of the service’s working directory (reflex/config/ and agent/config/ in the release zip). Environment variables work in both. Put only the keys you want to change in the file.

reflex/config/application.yaml

auth:
  url: https://reflex.example.com
db:
  url: jdbc:postgresql://db.example.com:5432/reflex
  user: reflex
  password: change-me

Restart the service after a change. The full list is in server/settings.md (server) and agent/settings.md (agent).

Server

Basics and first user

Variable	Default	Purpose
PORT	7000	HTTP port.
AUTH_URL	http://localhost:7000	Public URL of the server. Use HTTPS in production. Agents and sign-in redirects use it.
AUTH_BASIC	true	Allow username and password sign-in.
DEFAULT_USER, DEFAULT_PASSWORD	admin, admin	Admin account, created only on the first start.

Database

Variable	Default	Purpose
DB_URL	jdbc:sqlite:database/reflex.db	JDBC URL. Use jdbc:postgresql://host:5432/reflex for PostgreSQL.
DB_USER, DB_PASSWORD	empty	Database credentials.

Security and encryption

Variable	Default	Purpose
ENCRYPTION_KEY	demo key	Encrypts stored secrets. Generate one with java -jar reflex.jar --generate. Changing it invalidates API tokens.
SECURITY_OUTBOUND_ALLOW_PRIVATE_NETWORKS	true	Let the server reach private addresses (agents, git, SFTP). Set false on shared deployments. Agents on a private network then stop working.

Single sign-on

Set the redirect (callback) URL at your provider to <AUTH_URL>/callback.

Variable	Purpose
OIDC_USE	true enables OpenID Connect.
OIDC_CLIENT_ID, OIDC_CLIENT_SECRET	Client credentials.
OIDC_DISCOVERY	Discovery URL (.../.well-known/openid-configuration).
OIDC_ADMIN_ROLE	Role claim that makes a user admin.
OIDC_NAME, OIDC_IMAGE	Label and icon on the login button.
AZURE_USE	true enables Microsoft Entra ID.
AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT	App registration values.
AZURE_ADMIN_ROLE	Role that makes a user admin.

Storage

Variable	Default	Purpose
PROJECTS_LOCATION	projects	Folder with project files.
ARTIFACTS_STORAGE	filesystem	Where screenshots, results and replays are kept: filesystem or s3.
ARTIFACTS_DIRECTORY	artifacts	Folder for filesystem storage.
ARTIFACTS_S3_BUCKET, _ENDPOINT, _ACCESS_KEY, _SECRET_KEY, _REGION	empty (region us-east-1)	S3 or MinIO connection, each prefixed with ARTIFACTS_S3. Set the endpoint for MinIO.
REPLAY_RETENTION_FAILED_DAYS, REPLAY_RETENTION_SUCCEEDED_DAYS	30, 3	How long replays are kept.

Agent

Variable	Default	Purpose
AGENT_KEY	dev	Shared key for agents registered by URL. Change it.
AGENT_PORT	7001	Port the agent listens on.
AGENT_HOST	0.0.0.0	Interface to bind. Use 127.0.0.1 for a local-only agent.
AGENT_URL	http://localhost:7000	Origin of the Reflex web UI (CORS). It is not the address you register.
AGENT_THREADS	cpu	Number of threads. cpu matches the CPU count.
REFLEX_SERVER, REFLEX_ENROLL	empty	Server URL and pair code for an agent that connects to the server. See Agents.
AGENT_FILES_CONFINE_TO_WORKSPACE	false	Block scripts from reading files outside their workspace. Set true on shared agents.
AGENT_SSH_STRICT_HOST_KEYS	false	Only connect over SSH and SFTP to known hosts.

Browsers and OCR

The agent downloads Chrome for Testing and a matching ChromeDriver on the first browser start. It supports Linux and Windows on amd64, and Linux arm64 with Chrome 153 or newer. macOS is not supported. Linux needs the Chromium shared libraries installed.

Variable	Default	Purpose
CHROME_VERSION	latest	Chrome for Testing version to download.
AGENT_BROWSER_PATH	empty	Use this system Chromium or Chrome instead of downloading one.
AGENT_CHROMEDRIVER_PATH	empty	ChromeDriver matching that browser. Selenium needs it; Playwright does not.
AGENT_SELENIUM_DOCKER	false	Run Selenium browsers in Docker containers. Needs the Docker socket.

On Linux arm64 with an older pinned Chrome, install the distribution packages and point to them:

sudo apt-get install chromium chromium-driver
export AGENT_BROWSER_PATH=/usr/bin/chromium
export AGENT_CHROMEDRIVER_PATH=/usr/bin/chromedriver

For OCR, put .traineddata files in the agent’s tessdata/ folder. The release includes English and Dutch.

Put custom plugin JARs and JDBC drivers for the Sql library in the agent’s plugins/ folder, then restart the agent.