Skip to content
Hibouhibou

Environment Variables

All Hibou configuration is done via environment variables. Variables use the HIBOU_ prefix.

Server

Section titled “Server”
Variable Default Description
HIBOU_HOST 0.0.0.0 Network interface to bind
HIBOU_PORT 8585 HTTP port
HIBOU_DATABASE_URL postgres://hibou:hibou@localhost:5432/hibou?sslmode=disable PostgreSQL DSN
HIBOU_LOG_LEVEL info Minimum log level (debug, info, warn, error)
HIBOU_LOG_FORMAT console Output format (console, json)
HIBOU_SESSION_SECRET change-me-in-production Cookie encryption key (32+ chars recommended)
HIBOU_TRIVY_URL http://localhost:4954 Trivy server endpoint
HIBOU_OSV_URL https://api.osv.dev OSV advisory API base URL
HIBOU_CACHE_TTL 6h Advisory cache TTL (6h, 24h, 30m, etc.)

Metrics and storage usage

Section titled “Metrics and storage usage”
Variable Default Description
HIBOU_METRICS_ENABLED true Serve Prometheus /metrics. false removes it from every port.
HIBOU_METRICS_PORT 0 Serve Prometheus /metrics on this port only. 0 serves it on HIBOU_PORT.
HIBOU_METRICS_BEARER_TOKEN (empty) When set, /metrics requires Authorization: Bearer <token>.
HIBOU_METRICS_BEARER_TOKEN_FILE (empty) Read the bearer token from this file. Takes precedence over HIBOU_METRICS_BEARER_TOKEN.
HIBOU_STORAGE_USAGE_ENABLED true Sample Postgres and artifact-ledger storage usage.
HIBOU_STORAGE_USAGE_INTERVAL 15m Sampling interval (minimum 1m).
HIBOU_STORAGE_USAGE_INVENTORY_ENABLED false Also list the artifact backend to measure what it actually holds. On S3, each 1,000 keys is a billed LIST request.
HIBOU_STORAGE_USAGE_INVENTORY_INTERVAL 24h Minimum time between backend inventories (minimum 1h).
HIBOU_STORAGE_USAGE_INVENTORY_MAX_OBJECTS 1000000 Stop the inventory after this many objects and report it as truncated.

Forge Providers (Indexed)

Section titled “Forge Providers (Indexed)”

Forges are configured using a zero-indexed pattern. Replace N with 0, 1, 2, etc.

Variable Required Description
HIBOU_FORGE_N_TYPE Yes Provider type: github, forgejo, gitea, gitlab
HIBOU_FORGE_N_ID Yes Unique identifier for this instance
HIBOU_FORGE_N_URL Forgejo/GitLab Base URL of the forge instance
HIBOU_FORGE_N_CLIENT_ID Yes OAuth2 application client ID
HIBOU_FORGE_N_CLIENT_SECRET Yes OAuth2 application client secret
HIBOU_FORGE_N_WEBHOOK_SECRET Yes HMAC secret for webhook verification

Index Rules

Section titled “Index Rules”
  • Indexes start at 0 and increment by 1
  • Hibou stops reading at the first missing index (gap)
  • IDs must be unique across all forges
  • The URL field is required for Forgejo, Gitea, and GitLab (not required for GitHub)

Type-Specific Notes

Section titled “Type-Specific Notes”
Type URL Required Notes
github No Defaults to github.com
forgejo Yes Latest Forgejo release only (17 at the time of writing)
gitea Yes Uses same provider as forgejo
gitlab Yes Latest GitLab release only