Configuration

Settings come from environment variables with the prefix ONEOPEN_ (via pydantic-settings).

Core

Variable	Default	Description
`ONEOPEN_DATA_DIR`	`~/.oneopen`	Root data directory
`ONEOPEN_HOST`	`127.0.0.1`	Default bind host for `start` / `serve`
`ONEOPEN_PORT`	`8765`	Default bind port
`ONEOPEN_DEBUG`	`false`	Debug flag
`ONEOPEN_APP_NAME`	`OneOpen ML Studio`	Application display name

Deployment & auth

Variable	Default	Description
`ONEOPEN_DEPLOYMENT_MODE`	`local`	`local` \| `team` \| `enterprise`
`ONEOPEN_AUTH_REQUIRED`	`false`	Force auth even in local (Team/Enterprise enforce via mode)
`ONEOPEN_ALLOW_REGISTER`	`true`	Allow self-registration when auth is on
`ONEOPEN_SESSION_SECRET`	dev default	Change in Team/Enterprise
`ONEOPEN_COOKIE_SECURE`	`false`	Secure cookies (HTTPS); prefer on for enterprise
`ONEOPEN_ADMIN_EMAIL`	`admin@localhost`	Bootstrap admin email
`ONEOPEN_ADMIN_PASSWORD`	`admin`	Bootstrap admin password — use a strong value
`ONEOPEN_BOOTSTRAP_ON_START`	`false`	Create admin from `ONEOPEN_ADMIN_*` when DB has no users

Team/Enterprise first-time setup: open /setup after starting with ONEOPEN_DEPLOYMENT_MODE=team (or enterprise).

Database, queue, storage

Variable	Default	Description
`ONEOPEN_DATABASE_URL`	empty → SQLite	e.g. `postgresql+psycopg://…` for Team
`ONEOPEN_REDIS_URL`	empty	Redis for Celery; required for `oneopen worker`
`ONEOPEN_USE_CELERY`	empty	Auto when Redis set; or `true` / `false`
`ONEOPEN_S3_ENDPOINT`	empty	MinIO / S3 endpoint (empty → local FS)
`ONEOPEN_S3_ACCESS_KEY`	empty	Object storage access key
`ONEOPEN_S3_SECRET_KEY`	empty	Object storage secret
`ONEOPEN_S3_BUCKET`	`oneopen`	Bucket name
`ONEOPEN_S3_REGION`	`us-east-1`	Region
`ONEOPEN_S3_SECURE`	`false`	HTTPS to object storage

Plugins & enterprise stubs

Variable	Default	Description
`ONEOPEN_AUTO_INSTALL_PLUGINS`	`true`	Auto `pip install` missing training extras
`ONEOPEN_AUDIT_ENABLED`	`false`	Enterprise audit logging
`ONEOPEN_SSO_PROVIDER`	`none`	`none` \| `oidc` \| `saml` \| `ldap` (handshake not fully wired)
`ONEOPEN_SSO_ISSUER`	empty	SSO issuer URL
`ONEOPEN_SSO_CLIENT_ID`	empty	OIDC/SAML client id
`ONEOPEN_SSO_CLIENT_SECRET`	empty	OIDC/SAML client secret

Examples

Windows (PowerShell):

$env:ONEOPEN_DATA_DIR = "D:\oneopen-data"
$env:ONEOPEN_PORT = "9000"
oneopen start

Unix (Local):

export ONEOPEN_DATA_DIR=/data/oneopen
export ONEOPEN_PORT=9000
oneopen start

Team (Compose-style):

export ONEOPEN_DEPLOYMENT_MODE=team
export ONEOPEN_DATABASE_URL=postgresql+psycopg://oneopen:oneopen@localhost:5432/oneopen
export ONEOPEN_REDIS_URL=redis://localhost:6379/0
export ONEOPEN_SESSION_SECRET='replace-with-a-long-random-secret'
oneopen start --host 0.0.0.0
# then open http://localhost:8765/setup

CLI flags (--host, --port, init --data-dir) override the corresponding defaults for that process.

Derived paths

Given data_dir:

Path	Purpose
`{data_dir}/oneopen.db`	SQLite database (when `DATABASE_URL` is empty)
`{data_dir}/uploads/`	Fallback upload area
`{data_dir}/exports/`	Export artifacts
`{data_dir}/models/`	Weights, SAM checkpoints, runs
`{data_dir}/projects/{id}/`	Default project location
`{data_dir}/training_jobs/`	Training job JSON state

See Data layout for more detail.

Binding beyond localhost

Local: designed without mandatory auth. Prefer 127.0.0.1. Do not expose on untrusted networks.
Team / Enterprise: use auth (/setup), a strong ONEOPEN_SESSION_SECRET, and HTTPS/ONEOPEN_COOKIE_SECURE when terminating TLS.