> ## Documentation Index > Fetch the complete documentation index at: https://browser-mcp.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Configuration reference > Build settings, runtime environment, and Helm values. ## Build settings | Name | Default | Scope | | ----------------------- | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `EDITION` | `community` | `bun scripts/build.ts` and Docker `ARG EDITION`; `community` or `managed`. Selects one backend adapter at bundle time. | | `EXTENSION_MANAGED_URL` | `https://browser-mcp.click` | Extension build's upstream setting. Set the real HTTPS origin for releases. Changing it does not migrate installed extension settings. | | Docker `BUN_VERSION` | `1.4.0` | Bun build/runtime image version. Keep lockfile and CI compatibility in mind. | Changing `EDITION` at runtime does not change the product. Switching edition requires a different artifact and a reviewed auth migration; it is not a safe live feature toggle. ## Runtime environment | Name | Required | Notes | | ------------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `DATABASE_URL` | Both editions | PostgreSQL URL; credentials and TLS options belong in a secret. | | `PUBLIC_URL` | Both editions | Canonical origin without path/trailing slash; HTTPS for production. | | `LEGACY_PUBLIC_ORIGIN` | Optional, empty/disabled | One distinct normalized HTTPS DNS origin for safe dashboard GET/HEAD redirects only. No wildcard, list, credentials, whitespace, path, trailing slash, query, fragment, or explicit default `:443`. Legacy API/device/MCP/WebSocket requests return 410, never redirect. See [migration](/managed#canonical-domain-migration). | | `AUTH_SECRET` | Both editions | Strong, independent random secret; generate with `openssl rand -hex 32`. | | `SETTINGS_ENCRYPTION_KEY` | Both editions | Independent encryption key; preserve through backups and restores. | | `GITHUB_CLIENT_ID` | Managed | GitHub OAuth application client ID. | | `GITHUB_CLIENT_SECRET` | Managed | GitHub OAuth secret; never ship to client bundles. | `POSTGRES_PASSWORD` in `.env.example` configures the bundled development database; the server itself consumes `DATABASE_URL`. Compose builds its internal URL with the hostname `postgres`; source development uses the host URL in `.env`. ## Main Helm values | Path | Default | Purpose | | ------------------------------------- | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | `replicaCount` | `1` | Enforced; all other values rejected. | | `edition` | `community` | Default image tag suffix and managed-secret references. Must match the actual image. | | `image.repository` | `ghcr.io/ricsam/browser-mcp-community` | Artifact naming convention; verify publication or override. | | `image.tag` | empty | Resolves to `-`. | | `image.digest` | empty | If set, takes precedence over the tag. | | `imagePullSecrets` | `[]` | Existing pull secret references. | | `secrets.existingSecret` | empty, required | Precreated secret in `.Release.Namespace`. | | `secrets.keys.*` | uppercase env names | Custom key names for the existing secret. | | `config.publicUrl` | empty, required | Canonical public origin. | | `config.legacyPublicOrigin` | empty, disabled | Exact HTTPS origin mapped to `LEGACY_PUBLIC_ORIGIN`; redirects only, not a trusted transport/auth alias. Does not create ingress/DNS routes. | | `ingress.enabled` | `false` | Enable the public route. | | `ingress.className` | `traefik` | Ingress class. | | `ingress.host` | empty | Required when ingress is enabled. | | `ingress.tls` | `[]` | No TLS block for r5d; configure termination elsewhere as appropriate. | | `postgresql.enabled` | `true` | Disable to use external PostgreSQL. | | `postgresql.existingSecret` | empty | Defaults to the application secret for `POSTGRES_PASSWORD`. | | `postgresql.passwordKey` | `POSTGRES_PASSWORD` | Bundled database's password secret key. | | `postgresql.persistence.storageClass` | `rook-ceph-block` | Explicit Ceph RBD class, enforced for bundled RWO data. | | `postgresql.persistence.size` | `10Gi` | Requested persistent capacity. | | `migration.activeDeadlineSeconds` | `600` | Overall migration Job deadline. | | `migration.backoffLimit` | `3` | Job retries; migration remains mandatory. | | `resources` | requests 100m/256Mi, limits 1 CPU/1Gi | Server resource budget. | | `migration.resources` | requests 100m/128Mi, limits 1 CPU/512Mi | Migration and gate budgets. | | `postgresql.resources` | requests 100m/128Mi, limits 1 CPU/512Mi | Bundled database budget. | The chart uses non-root pods, a read-only root filesystem, dropped capabilities, `RuntimeDefault` seccomp, and no privilege escalation. Writable paths are dedicated PVC/emptyDir mounts. The main application container has no Kubernetes service account token mount. For the complete defaults, inspect `charts/browser-mcp/values.yaml` in the version you deploy.