> ## Documentation Index > Fetch the complete documentation index at: https://docs.kubestacks.com/llms.txt > Use this file to discover all available pages before exploring further. # Server configuration > The environment variables KubeStacks reads when it runs as a server, and the addresses it answers. The Helm chart sets these from its [values](/server/helm-values). They're for running the image another way, such as [with Docker](/server/docker), and for the few settings the chart has no value for, which you can set with `extraEnv`. KubeStacks reads them when it starts. One that doesn't make sense stops it, and its log says which and why. ## Where it runs The port to listen on. `0` picks any free port, and the log says which. The address to listen on: every interface unless set. The address people open it at, like `https://kubestacks.example.com`. Single sign-on needs it. With `https:`, cookies are sent over HTTPS only. Where it is below that address, like `/kubestacks`. ## The cluster it shows What it calls the cluster: `in-cluster` (or the kubeconfig's context) unless set. A kubeconfig to show a cluster from, instead of the cluster KubeStacks runs in. The kubeconfig's context to show: its current context unless set. Where the pod's service account token and CA certificate are, inside a cluster. ## Sign-in `token`, `oidc` or `proxy`. See [Ways to sign in](/server/overview#ways-to-sign-in). The OpenID Connect provider's issuer URL. Required with `oidc`. KubeStacks' client ID at the provider. Required with `oidc`. The client's secret. Unset for a public client. The scopes to ask for, separated by spaces. The ID token claim that names people. The ID token claim that lists their groups. The provider's name on the sign-in button: **Sign in with** this. `id` or `access`: pass people's own token on (the API server must trust the provider) instead of impersonating them. The header a proxy names people in. The header a proxy lists their groups in, separated by commas. Where signing out of the proxy is. Put before impersonated users' names. Put before impersonated groups' names. How long sessions last, in hours: at most 168, a week. How often pages' connections are checked, in seconds, at most 3600. Keep it shorter than the idle timeout of the proxies in front of KubeStacks. ## What people can do `true` or `1`: nobody changes anything through KubeStacks. Where usage history comes from unless people choose: `auto`, `off`, or `namespace/service:port`, with a path after it for vmselect (`vm/vmselect:8481/select/0/prometheus`). `true` or `1`: charts may come from private network addresses. Where to search for charts. Where the views everyone sees are. The helm to run: the one in the image unless set. ## Large clusters and slow API servers These work the same as in the desktop app, and the chart has no values for them: set them with `extraEnv`. The most objects a list loads. Lists are fetched in chunks of 500. How long the API server has to answer, in milliseconds. ```yaml values.yaml theme={"theme":{"light":"github-light","dark":"github-dark-default"}} extraEnv: - name: KUBESTACKS_MAX_LIST_ITEMS value: '10000' - name: KUBESTACKS_REQUEST_TIMEOUT_MS value: '45000' ``` ## Addresses it answers All of these are below the base path. | Address | What it's for | | - | - | | `GET healthz` | Health checks: answers `200 ok` while KubeStacks runs. | | `auth/callback` | Where your OpenID Connect provider sends people back. Register it as the redirect URI. | | `api/socket` | Each page's WebSocket. Proxies in front of KubeStacks must pass WebSockets here. | Every other address is KubeStacks' page and its files. The chart's settings, which set these for you. Use these to run the image outside Kubernetes. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.