Configuration Reference
Categories below reflect chart 1.2.36 surface area. Older chart versions may expose additional or fewer fields.
After Plexicus is running on your cluster, you need to wire up the external provider integrations that power its features. This page is the index — per-provider walkthroughs are linked below as they are published.
Source control is fully documented — see the
SCM Connection Reference for every provider's
flow, callback URLs, scopes and env vars. Guides for the remaining providers are
being added incrementally as the umbrella Helm chart stabilizes; until each one
is live, the Source of truth column links to the canonical reference (the
chart's secrets-management.md or the provider's own documentation), which is
enough to configure a working deployment today.
What Is Documented Here
Plexicus integrations fall into three categories. Only the first two are documented for self-hosted deployments.
✅ Customer-facing (documented)
Integrations where you bring your own credentials and your own external service. Self-hosted Plexicus connects to the endpoints you specify, using the keys you provide.
| Integration | Purpose | Required? | Source of truth |
|---|---|---|---|
| GitHub App | Scan GitHub repositories, open remediation pull requests, receive webhooks | Optional — required only to scan GitHub repositories | SCM Connection Reference → GitHub |
| GitHub OAuth | "Login with GitHub" for end users | Optional — shares the same app and the same /api/callback/github callback as the connector above | SCM Connection Reference → Callback URLs |
| GitLab OAuth | Scan GitLab repositories (gitlab.com) | Optional — required only to scan gitlab.com repositories. Self-managed GitLab needs no chart configuration: each connection carries its own client id and secret, entered in the UI | SCM Connection Reference → GitLab |
| Bitbucket OAuth | Scan Bitbucket Cloud repositories | Optional — required only to scan Bitbucket Cloud repositories. Bitbucket Server / Data Center is not supported | SCM Connection Reference → Bitbucket Cloud |
| Gitea / Forgejo | Scan self-hosted Gitea or Forgejo repositories | Optional, and not an OAuth integration — both connectors are personal-access-token only, configured per connection in the UI. No chart value or Secret key is involved | SCM Connection Reference → Gitea and Forgejo |
| Azure DevOps / TFVC | Scan Azure DevOps Git and TFVC repositories | Optional — personal-access-token only, configured per connection in the UI. No chart value or Secret key is involved | Azure DevOps |
| Google OAuth | "Login with Google" for end users | Optional | Callback URL https://<your-domain>/api/callback/google; set global.required.oauth.google.clientId and the NUXT_GOOGLE_CLIENT_SECRET Secret key |
| AI Piloting (Azure OpenAI / OpenAI / DeepInfra / DeepSeek) | AI-powered remediation and enrichment | Required for AI features. A scan with a failing AI step is not silently degraded — it is reported as failed, and the scan status can persist as degraded rather than clean | coming soon |
AI SAST scan credentials (PLEXICUS_AI_SCAN_API_KEY + embedding endpoint) | Chat LLM and mandatory BAAI/bge-m3 embedding index for every AI SAST scan (chart 1.2.27+, hard dependency — no opt-out) | Required for AI SAST scanning to work at all. DeepSeek serves no embedding model — the embedding endpoint needs a provider that does (DeepInfra) | See Self-Hosted Installation → Key catalog |
| SMTP | Email verification, invitations, password resets | Required unless explicitly waived. Set global.required.smtp.server, or declare global.required.smtp.deliveryMode: "disabled" to run without email. Leaving both unset is neither: register, invite, resend-verification and password reset all return 503. Under disabled, onboarding is admin-mediated — invite responses carry the verification link — and self-registrations are still never auto-verified | Self-Hosted Installation → Email delivery mode |
| Cloudflare Turnstile | Bot protection on public signup forms | Optional — leave empty to disable | coming soon |
| Object storage | Artifacts, scan reports, AI inputs/outputs | Required — any S3-compatible endpoint is the recommended production choice (AWS S3, Cloudflare R2, Ceph RGW, or your provider's object storage): set minio.enabled: false and point global.required.minio.service at it. The bundled MinIO subchart is a zero-dependency default for evaluation only, not a production recommendation. The service value must be a bare hostname — no https:// prefix, no trailing slash. Supply the access key ID and secret access key via the plexicus-fastapi and plexicus-worker Secrets, as OBJECT_STORAGE_ACCESS_KEY / OBJECT_STORAGE_SECRET_KEY (the minio.* value names predate generic S3 support and work the same for any provider). | docs/secrets-management.md (bundled with the chart artifact) |
| Image registry mirror | Mirror all custom images from your own registry — required for air-gapped or restricted networks | Optional | docs/image-registry.md (bundled with the chart artifact) |
| Infrastructure prerequisites (MongoDB, Redis, Temporal, MinIO, PostgreSQL) | Five infra services that the Plexicus chart depends on. Since chart 1.2.6, all five ship as opt-in bundled subcharts (enabled: false by default) — enable them in your values overlay or install as separate Helm releases; both approaches are documented in the install guides. Customers running their own already-managed instances can skip both and point Plexicus at the existing endpoint via global.required.*. | Required | getting-started.md and secrets-management.md (bundled with the chart artifact) |
| AI Pentest | AI-powered penetration testing service that creates per-scan Kubernetes Jobs | Ships with a complete implementation but disabled by default (strix.enabled: false); not yet officially enabled for self-hosted deployments | When enabled: strix.existingSecret containing TOOL_SERVER_TOKEN and an LLM API key |
🟡 Chart-internal (no setup needed)
Credentials that exist purely for service-to-service communication inside your cluster. Generate a strong random value once and use the same value across the relevant Kubernetes Secrets — no external provider account is involved.
| Credential | Used by | Action |
|---|---|---|
PLEXALYZER_TOKEN, PLEXALYZER_SECRET_KEY | Internal Plexalyzer scanning service | Generate any 32+ character random string |
SECRET_KEY (Django/FastAPI) | Session signing | Generate any 32+ character random string |
NUXT_SECRET_KEY | Frontend session signing | Generate any 32+ character random string |
| Bundled subchart passwords (MongoDB, Redis, MinIO, Temporal PostgreSQL) | Bundled databases | Generate strong passwords; reuse across the services that connect to each |
plexicus-license Secret (license.jwt, optionally license-key.pem) | fastapi, worker — mounted as files at /etc/plexicus/ with optional: false. A hard prerequisite: it must exist before helm install. Without it both pods sit in ContainerCreating with a FailedMount event for plexicus-license and write no logs. | Provided by Plexicus alongside your registry credentials — see step 5 of the install guide. |
NVD_API_KEY (optional, in plexicus-plexalyzer-code Secret) | plexalyzer-code — vulnerability enrichment rate limit | Optional. Request a free API key at nvd.nist.gov. Without it, enrichment works but at the unauthenticated rate limit (10 req/30 s). Plexicus does not supply this key; each deployment uses its own. |
Chart 1.2.0+ includes NetworkPolicy templates and PodDisruptionBudgets per service. NetworkPolicies operate at two independent levels: (1) per-service chart policies (<service>.networkPolicy.enabled: true, opt-in per service) add explicit allow rules for individual pods; (2) a cluster-level default-deny baseline (applied by the operator, not the chart) restricts all pod-to-pod traffic by default so the per-service allow rules have effect. Without a default-deny baseline in place, enabling per-service policies is redundant — all traffic is permitted anyway. See the Air-Gapped guide for a default-deny example. PodDisruptionBudgets have sensible defaults and require no action unless you want to adjust disruption budgets.
🔒 Plexicus-internal (intentionally not documented)
Some integrations exist in the platform code because Plexicus uses them on the managed SaaS offering at plexicus.ai. They are not relevant to self-hosted deployments and the chart ships with them disabled or empty by default.
Categories of integrations that fall under this policy:
- Commercial / billing systems
- Marketing automation
- Product analytics and telemetry
- Customer feedback platforms
- Application performance monitoring
- Push-notification services
- Marketplace listings
- Public-funnel URLs that point at
plexicus.ai
These are not documented for self-hosted, will not appear in any guide, and should remain unset. If you encounter env vars in the chart values that look related to any of the categories above, leave them empty — the chart is designed to behave correctly when these are unset.
Where to Look in the Meantime
Until each per-provider guide is published, the canonical references ship inside the chart artifact. After authenticating to the registry and pulling the chart with --untar, the bundled documentation is available locally:
helm pull oci://europe-west3-docker.pkg.dev/plexicus-registry/charts/plexicus \
--version $CHART_VERSION --untar
ls plexicus/docs/
The bundled files most relevant to configuration:
docs/secrets-management.md— every sensitive key per service, theexistingSecretpattern, and examplekubectl create secretcommands you can adapt directly.docs/image-registry.md— image mirroring procedure, air-gapped deployments, registry auth.values-customer.yaml.example— the canonical ~30-line starter overlay with inline comments for every customer knob.
These ship with the version of the chart you pulled and stay in sync with it.
Reporting Gaps
If you discover an environment variable that is not categorized here, or a feature that requires configuration not yet covered, open an issue at github.com/plexicus/docs — those reports prioritize which per-provider guide is published next.