Configuration

Everything is env-driven. Safe defaults ship in the compose file; every knob below overrides them.

Embedding provider

Variable	Values	Default	Meaning
DASH_EMBEDDING_PROVIDER	hash, ollama, openai	hash	Deterministic hash (no network) vs real semantic embeddings

Custom backends implement the EmbeddingProvider trait.

Persistence

Variable	Meaning
DASH_INGEST_PERSISTENCE_PATH	On-disk redb store for the ingestion service
DASH_RETRIEVAL_PERSISTENCE_PATH	On-disk redb store for the retrieval service
DASH_INGEST_WAL_PATH	Durable WAL file for ingestion
DASH_RETRIEVAL_WAL_PATH	Durable WAL file for retrieval

Unset persistence paths mean WAL-only mode (pre-redb behavior, bit-for-bit preserved).

WAL durability guardrails

Unsafe flush policies are rejected by default. Stress testing requires the explicit override:

DASH_INGEST_ALLOW_UNSAFE_WAL_DURABILITY=true

Auth

Variable	Meaning
DASH_INGEST_API_KEY / DASH_RETRIEVAL_API_KEY	Shared service keys
DASH_*_SCOPED_API_KEYS	key:tenant[,tenant...] scoped keys
DASH_*_REVOKED_API_KEYS	Hot-reloaded revocation list

JWT auth is HS256 with key rotation by kid, optional iss/aud checks, a fallback secrets list, and per-tenant claim enforcement. A multi-tenant allowlist is enforced in the authz layer.

Rate limits

DASH_*_RATE_LIMIT_*   # per-tenant rate limits

ANN tuning

DASH_*_ANN_*          # HNSW graph tuning knobs

Plus a graph-backed recall layer on top of ANN candidates.

Docker

Multi-stage, multi-arch (linux/amd64, linux/arm64), non-root runtime, healthcheck, dependency ordering, and a dev overlay with hot-reload. The compose file mounts a dash_data volume for the WAL and segments with safe durability defaults.