Configuration reference

Build settings

Name	Default	Scope
`EDITION`	`community`	`bun scripts/build.ts` and Docker `ARG EDITION`; `community` or `managed`. Selects one backend adapter at bundle time.
`EXTENSION_MANAGED_URL`	`https://browser-mcp.click`	Extension build’s upstream setting. Set the real HTTPS origin for releases. Changing it does not migrate installed extension settings.
Docker `BUN_VERSION`	`1.4.0`	Bun build/runtime image version. Keep lockfile and CI compatibility in mind.

Changing EDITION at runtime does not change the product. Switching edition requires a different artifact and a reviewed auth migration; it is not a safe live feature toggle.

Runtime environment

Name	Required	Notes
`DATABASE_URL`	Both editions	PostgreSQL URL; credentials and TLS options belong in a secret.
`PUBLIC_URL`	Both editions	Canonical origin without path/trailing slash; HTTPS for production.
`LEGACY_PUBLIC_ORIGIN`	Optional, empty/disabled	One distinct normalized HTTPS DNS origin for safe dashboard GET/HEAD redirects only. No wildcard, list, credentials, whitespace, path, trailing slash, query, fragment, or explicit default `:443`. Legacy API/device/MCP/WebSocket requests return 410, never redirect. See migration.
`AUTH_SECRET`	Both editions	Strong, independent random secret; generate with `openssl rand -hex 32`.
`SETTINGS_ENCRYPTION_KEY`	Both editions	Independent encryption key; preserve through backups and restores.
`GITHUB_CLIENT_ID`	Managed	GitHub OAuth application client ID.
`GITHUB_CLIENT_SECRET`	Managed	GitHub OAuth secret; never ship to client bundles.

POSTGRES_PASSWORD in .env.example configures the bundled development database; the server itself consumes DATABASE_URL. Compose builds its internal URL with the hostname postgres; source development uses the host URL in .env.

Main Helm values

Path	Default	Purpose
`replicaCount`	`1`	Enforced; all other values rejected.
`edition`	`community`	Default image tag suffix and managed-secret references. Must match the actual image.
`image.repository`	`ghcr.io/ricsam/browser-mcp-community`	Artifact naming convention; verify publication or override.
`image.tag`	empty	Resolves to `<appVersion>-<edition>`.
`image.digest`	empty	If set, takes precedence over the tag.
`imagePullSecrets`	`[]`	Existing pull secret references.
`secrets.existingSecret`	empty, required	Precreated secret in `.Release.Namespace`.
`secrets.keys.*`	uppercase env names	Custom key names for the existing secret.
`config.publicUrl`	empty, required	Canonical public origin.
`config.legacyPublicOrigin`	empty, disabled	Exact HTTPS origin mapped to `LEGACY_PUBLIC_ORIGIN`; redirects only, not a trusted transport/auth alias. Does not create ingress/DNS routes.
`ingress.enabled`	`false`	Enable the public route.
`ingress.className`	`traefik`	Ingress class.
`ingress.host`	empty	Required when ingress is enabled.
`ingress.tls`	`[]`	No TLS block for r5d; configure termination elsewhere as appropriate.
`postgresql.enabled`	`true`	Disable to use external PostgreSQL.
`postgresql.existingSecret`	empty	Defaults to the application secret for `POSTGRES_PASSWORD`.
`postgresql.passwordKey`	`POSTGRES_PASSWORD`	Bundled database’s password secret key.
`postgresql.persistence.storageClass`	`rook-ceph-block`	Explicit Ceph RBD class, enforced for bundled RWO data.
`postgresql.persistence.size`	`10Gi`	Requested persistent capacity.
`migration.activeDeadlineSeconds`	`600`	Overall migration Job deadline.
`migration.backoffLimit`	`3`	Job retries; migration remains mandatory.
`resources`	requests 100m/256Mi, limits 1 CPU/1Gi	Server resource budget.
`migration.resources`	requests 100m/128Mi, limits 1 CPU/512Mi	Migration and gate budgets.
`postgresql.resources`	requests 100m/128Mi, limits 1 CPU/512Mi	Bundled database budget.

The chart uses non-root pods, a read-only root filesystem, dropped capabilities, RuntimeDefault seccomp, and no privilege escalation. Writable paths are dedicated PVC/emptyDir mounts. The main application container has no Kubernetes service account token mount. For the complete defaults, inspect charts/browser-mcp/values.yaml in the version you deploy.

Start here

Run a server

Reference

Configuration reference

Build settings

Runtime environment

Main Helm values

​Build settings

​Runtime environment

​Main Helm values

Build settings

Runtime environment

Main Helm values