Langy Environment Variables

The environment variable reference for the Langy agent pod and its control-plane integration, grouped by core, workers, egress, mirror lane, and GitHub.

The agent-side variables (LANGY_* apart from the one below) are set on the langyagent pod through the charts/langyagent ConfigMap and Secret. The control-plane variables (LANGY_AGENT_URL, LANGY_MIRROR_PROJECT_ID, GITHUB_LANGY_*, CREDENTIALS_SECRET) are set on the LangWatch app. Defaults shown are the values the chart or the Go service uses out of the box.

Also check: Setup, Register the GitHub App, Networking and egress.

Many LANGY_* names in the packages/langy and frontend code are exported TypeScript constants, Zod discriminators, and event-type identifiers, not deploy knobs. The variables below are the runtime configuration. The GitHub PR rate limit LANGY_GITHUB_PRS_PER_DAY is 20, hardcoded, not configurable.

Core

Variable	Description	Required	Default
LANGY_INTERNAL_SECRET	Shared bearer secret for calls in both directions between the app and the agent. Frames the worker streams back are signed separately, with a per-conversation key. Lives in the app Secret and is injected into the app, the workers, and the agent pod. The chart generates it when autogen.enabled is on; with your own Secret, add the key yourself.	Yes	chart-generated
LANGY_AGENT_URL	App-side URL of the agent pod (http://<release>-langyagent:80). Turns on the Langy backend when set. Wired automatically when langyagent.chartManaged=true.	When agent on	unset (chart-set)
ENVIRONMENT	Deployment environment. The agent refuses LANGY_UNSAFE_DEV_DISABLE_ISOLATION unless this is local, dev, development or test, so keep it production-like.	No	production (chart)

LANGY_INTERNAL_SECRET is a shared credential between the app and the agent. Store it in a secrets manager and never commit it or log it.

Workers

Variable	Description	Required	Default
LANGY_MAX_WORKERS	Max concurrent worker subprocesses before the pod returns 503.	No	20
LANGY_WORKER_IDLE_MS	Idle-worker reap timeout.	No	600000 (10 min)
LANGY_READINESS_TIMEOUT_MS	How long to wait for a freshly spawned worker to report ready. The Go default is 15000; the chart raises it to 60000 for gVisor cold boot.	No	60000 (chart)
LANGY_WORKSPACE_ROOT	Writable workspace root (an emptyDir mount).	No	/workspace

Egress

See Networking and egress for how these fit together and the limit on enforcement.

Variable	Description	Required	Default
LANGY_EGRESS_FQDN_FLOOR	Operator always-allowed FQDNs (the adapter floor).	No	github.com,api.github.com,codeload.github.com
LANGY_EGRESS_REQUIRE_TLS	Refuse cleartext and non-:443 forwards.	No	true
LANGY_EGRESS_ENFORCE_FLOOR	Make the floor a hard ceiling for projects with no allow-list.	No	false (monitor-only)
LANGY_EGRESS_SNI_CROSSCHECK	Cross-check the TLS SNI against the CONNECT authority (anti-domain-fronting).	No	true

Mirror lane

The mirror lane copies each turn’s trace into a LangWatch project you designate, so whoever runs the install can watch Langy work. It stays off until langyagent.mirror.existingSecretName names a Secret holding the mirror project’s API key; the endpoint resolves to the install’s own app automatically. See Watching Langy work.

Variable	Description	Required	Default
LANGY_MIRROR_TRACE_ENDPOINT	LangWatch base URL the mirror ships to. Set via langyagent.mirror.traceEndpoint only to mirror into a different deployment.	No	the install’s own app
LANGY_MIRROR_TRACE_KEY	The mirror project’s API key (a normal project key), read from the Secret named by langyagent.mirror.existingSecretName.	No	unset (mirror off)
LANGY_MIRROR_PROJECT_ID	The mirror project’s id, set on the app. A turn running inside that project is never mirrored into itself. The chart does not set it; use app.extraEnvs.	No	unset

LANGY_MIRROR_TRACE_KEY is a project API key. Store it in a Secret (mirror.existingSecretName), not inline in values.yaml.

GitHub

Set these on the control plane to enable bot-authored pull requests and coding-agent pull request linkage. The GitHub feature stays off until GITHUB_LANGY_APP_ID, GITHUB_LANGY_PRIVATE_KEY and GITHUB_LANGY_APP_SLUG are all set. See Register the GitHub App for the registration walkthrough.

Variable	Description	Required	Default
GITHUB_LANGY_APP_ID	GitHub App id (JWT iss).	For GitHub	unset (feature off)
GITHUB_LANGY_PRIVATE_KEY	App RSA private key PEM (mints install tokens). The only credential; control-plane only. Escape newlines as \n in a single-line value.	For GitHub	unset (feature off)
GITHUB_LANGY_WEBHOOK_SECRET	Verifies the X-Hub-Signature-256 on inbound webhooks. Optional: without it the instance still connects, mints tokens and opens pull requests, but it reconciles late. Linkage then waits for the outbound recheck, and an uninstall clears only when a live read gets a 404. See Restricted networks.	No	unset
GITHUB_LANGY_APP_SLUG	App slug for the install deep-link.	For GitHub	unset
GITHUB_LANGY_HOST	The GitHub host this instance connects to. Set it to a GitHub Enterprise Server hostname (no scheme, no path) to bind the instance to that server. One instance connects to one host.	No	github.com
CREDENTIALS_SECRET	Signs the GitHub install state round-trip and encrypts provider keys at rest. Falls back to NEXTAUTH_SECRET when unset. Already required, so GitHub adds no new variable. See Security.	Yes	none

GITHUB_LANGY_PRIVATE_KEY grants write access to installed repositories. Keep it in a secrets manager and never let it reach a worker.