Configuration Guide

Environment Variables

Create apps/policyone/.env.local (not committed to source control):

# Database
DATABASE_URL=postgresql://policyone_app:localdevpass@localhost:5480/policyone

# Auth
AUTH_SECRET=<random 32+ char string>
# Optional per-adapter overrides:
LDAP_URL=
SAML_CERT=
OIDC_ISSUER=

# Server
PORT=3047

Database Setup

PolicyOne uses Drizzle ORM against a local PostgreSQL 15 instance managed by Docker Compose.

# Start the database
docker compose up -d

# Push all migrations (idempotent)
pnpm --filter @policyone/db migrate

# Seed demo data
pnpm --filter @policyone/db seed

The Docker Compose service exposes PostgreSQL on port 5480 to avoid conflicts with any existing local Postgres installation.

Drizzle Kit

Schema changes use the Drizzle Kit workflow:

# After editing a schema/*.ts file, generate a new migration
pnpm --filter @policyone/db generate

# Apply pending migrations
pnpm --filter @policyone/db migrate

Or use the Kalp Schema Editor VS Code extension (Cmd+Shift+P → "Kalp: Open Schema Editor") to add columns through a graphical UI that generates and applies the migration for you.

AI Provider Configuration

PolicyOne's AI Copilot (KALP) is pluggable. The provider (OpenAI, Anthropic, Azure OpenAI, Google Gemini or local Ollama), model and API key are configured per organization in Admin → AI Settings (/admin/ai-settings). Keys are encrypted with AES-256-GCM using ENCRYPTION_KEY and stored in security.ai_provider_settings; the UI only ever shows the last four characters.

AI API keys are never read from environment variables — do not put them in .env files, Docker Compose, or CI secrets.

If no provider is configured, the AI chat endpoint returns a 503 with a message directing an admin to AI Settings.

Auth Adapter Configuration

Auth adapters are configured per-tenant in the database via org.auth_provider_configs. For the default local development seed:

To switch a tenant to SSO in production, insert a row into org.auth_provider_configs with provider_type = 'oidc' and the relevant OIDC metadata, then restart the server.

Running in Development

# Install dependencies
pnpm install

# Start database
docker compose up -d

# Run migrations + seed
pnpm --filter @policyone/db migrate
pnpm --filter @policyone/db seed

# Start app (hot reload)
pnpm --filter policyone dev

Default URL: http://localhost:3047

Building for Production

pnpm --filter policyone build
pnpm --filter policyone start

PolicyOne is a standard Next.js application and can be deployed to any Node.js-capable host (self-hosted, Railway, Render, etc.).