Configuration
The Curiosity Studio can be configured using Environment Variables (recommended for Docker/Kubernetes) or Command Line Flags.
The following table lists the most important configuration options available.
General
| Environment Variable | Flag | Description |
|---|---|---|
MSK_PORT |
--port |
The port the server listens on (default: 8080). |
MSK_PORT_LOCAL |
--port-local |
Port for localhost-only access. |
MSK_LOG_LEVEL |
--log-level |
Logging verbosity (e.g., Information, Debug, Error). |
MSK_LOG_PATH |
--log-path |
Path to store log files. |
MSK_MAX_BODY_SIZE |
--max-body-size |
Maximum allowed size for HTTP request bodies. |
MSK_LIMIT_CONCURRENCY |
--limit-concurrency |
Limits the number of concurrent operations. |
Storage & Paths
| Environment Variable | Flag | Description |
|---|---|---|
MSK_GRAPH_STORAGE |
--storage |
Path to the directory where graph data is stored. |
MSK_GRAPH_NAME |
--graph-name |
Name of the graph database. |
MSK_GRAPH_TEMP_FOLDER |
--temp-folder |
Path for temporary files. |
MSK_GRAPH_JOURNAL_FOLDER |
--journal-folder |
Path for the graph journal (write-ahead log). |
MSK_GRAPH_BACKUP_FOLDER |
--backup-folder |
Path for storing backups. |
MSK_WW_FOLDER |
--www-folder |
Path to static web assets (frontend). |
High Availability & Clustering
| Environment Variable | Flag | Description |
|---|---|---|
MSK_REPLICA |
--replica |
If true, runs the instance as a Read-Only Replica. |
MSK_PRIMARY_ADDRESS |
--primary-address |
URL of the Primary instance (required for replicas). |
MSK_REPLICA_STORAGE |
--replica-storage |
Custom storage path for replica (if different from default). |
Authentication (SAML / SSO)
SSO credentials are not environment variables
The SSO and SAML settings below are workspace configuration stored in the graph, written by the
admin UI under Manage → Access → Single Sign-On. The identity-provider endpoints read them
straight from that stored configuration, so setting a matching environment variable has no effect —
the key names are listed here because they are what appears in a
configuration export, not because the
process reads them from the environment. MSK_SAML_CERT is the exception: the SAML certificate bag
is loaded at startup and does honour the environment variable (certificates can also be uploaded
from the UI).
| Stored key | Set in | Description |
|---|---|---|
MSK_SAML_CERT |
UI upload, or environment | SAML signing certificate(s), base64, ;-separated. |
MSK_SAML_APPLICATION_ID |
UI | Application ID for SAML. |
MSK_SAML_PROVIDER_ID |
UI | Provider ID for SAML. |
MSK_SAML_PROVIDER_ENDPOINT |
UI | SAML Identity Provider endpoint URL. |
MSK_SAML_ALLOWED_EMAIL_DOMAINS |
UI | Email domains allowed to sign in via SAML. |
OAuth Providers
| Stored key | Description |
|---|---|
MSK_GOOGLE_LOGIN_CLIENT_ID / ..._CLIENT_SECRET / MSK_GOOGLE_LOGIN_RESTRICT_TO_DOMAIN |
Google Sign-In credentials and optional account-domain restriction. |
MSK_AZURE_LOGIN_TENANT_ID / ..._CLIENT_ID / ..._CLIENT_SECRET |
Microsoft Entra ID credentials. See Microsoft Entra ID. |
MSK_AZURE_LOGIN_CREATE_SHAREPOINT, MSK_AZURE_CUSTOM_TENANT_NAME, MSK_AZURE_CUSTOM_SCOPES |
Microsoft SharePoint-on-login option, tenant label, and requested optional scopes. |
MSK_OKTA_LOGIN_DOMAIN / ..._AUTH_SERVER_NAME / ..._CLIENT_ID / ..._CLIENT_SECRET |
Okta credentials. |
MSK_AUTH0_LOGIN_DOMAIN / ..._AUTH_SERVER_NAME / ..._CLIENT_ID / ..._CLIENT_SECRET |
Auth0 credentials. |
| Environment Variable | Flag | Description |
|---|---|---|
MSK_MAIL_SERVER |
--mail-server |
SMTP Server address. |
MSK_MAIL_PORT |
--mail-port |
SMTP Port. |
MSK_MAIL_USERNAME |
--mail-user |
SMTP Username. |
MSK_MAIL_PASSWORD |
--mail-pass |
SMTP Password. |
MSK_MAIL_FROM_EMAIL |
--mail-from |
Sender email address. |
Security & Encryption
| Environment Variable | Flag | Description |
|---|---|---|
MSK_JWT_KEY |
--jwt-key |
Key used for signing JWT tokens. |
MSK_GRAPH_MASTER_KEY |
--master-key |
Master key for graph encryption. |
MSK_CERT_FILE |
--cert-file |
Path to SSL certificate file (PFX/PEM). |
MSK_CERT_PWD |
--cert-pwd |
Password for the SSL certificate. |
MSK_USE_HSTS |
--hsts |
Enable HTTP Strict Transport Security. |
External Services (Speech to Text, Blob Storage)
OCR always runs on the workspace's own machine and has no external service to configure. The OCR switch and the optional OCR models are in the admin UI; see OCR & File Extraction.
| Environment Variable | Flag | Description |
|---|---|---|
MSK_AZURE_STT_SUBSCRIPTIONKEY |
Azure Speech key. With an endpoint, speech to text is sent to Azure instead of running locally. | |
MSK_AZURE_STT_ENDPOINT |
Azure Speech endpoint. | |
MSK_BLOB_STORAGE_AWS_S3_BUCKET |
S3 Bucket for Blob Storage. | |
MSK_BLOB_STORAGE_AWS_REGION |
AWS region of the blob storage bucket. Required when a bucket is set. | |
MSK_BLOB_STORAGE_AWS_ACCESS_KEY_ID |
AWS access key for the blob storage bucket. | |
MSK_BLOB_STORAGE_AWS_SECRET_ACCESS_KEY |
AWS secret key for the blob storage bucket. | |
MSK_BLOB_STORAGE_AWS_PROFILE_NAME |
AWS profile name for the blob storage bucket. |