> ## Documentation Index > Fetch the complete documentation index at: https://docs.mixpeek.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Configuration and secrets > The Secret the chart expects you to create, and the values only you can supply The chart does **not** create any Secret. Every workload it renders reads its configuration from one you create yourself: ```yaml theme={null} envFrom: - secretRef: name: mixpeek-engine-secrets ``` Create that Secret in the same namespace before you install. If it is missing the pods will not start, which is the safe failure: you get a clear event and nothing runs against the wrong configuration. ## The values only you can supply These five name infrastructure. Each one has a built-in default that points at **Mixpeek's** own buckets and projects, so leaving one out does not fail loudly. The pods start and that component talks to a resource you do not own. | Key | What it is | If you omit it | | ------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `AWS_BUCKET` | Bucket holding your source objects and extraction artifacts | Requests use a Mixpeek bucket name against **your** endpoint, so they fail with a `NoSuchBucket` naming a bucket you have never created | | `AWS_PUBLIC_BUCKET` | Bucket for publicly addressable assets | Same shape as above | | `MONGODB_API_DB` | Database name inside your MongoDB | Your data is written to a database named for Mixpeek's dev environment | | `GOOGLE_BUCKET_NAME` | GCS bucket, only if you enable Google-backed extractors | Uploads target a Mixpeek bucket name | | `GEMINI_PROJECT_ID` | GCP project for Gemini inference, only if you enable it | Inference is billed against a Mixpeek project id, which your credentials cannot open | | `GCS_STORAGE_BUCKET` | GCS bucket for processed artifacts, only with Google-backed storage | Writes target a Mixpeek bucket name | | `S3_VECTORS_BUCKET_NAME` | Bucket backing the S3 vector store, if you use that backend | Vector writes target a Mixpeek bucket name | | `S3_VECTORS_LOCAL_BUCKET` | Local-mode counterpart of the above | Same | | `LANGSMITH_PROJECT` | LangSmith tracing project, only if you enable tracing | Traces are attributed to a Mixpeek project | | `ENGINE_HEAD_SVC` | In-cluster address of the Ray head's Serve service | Defaults to a hostname in **Mixpeek's** namespace, which does not resolve in yours. The chart derives this for you when it installs the engine, so set it only if you run the engine separately. | Your credentials will not open a Mixpeek-owned resource, so the practical outcome is a permission or not-found error rather than data crossing between tenants. The problem is that the error names **our** resource and gives you nothing to act on. ## Connecting to your own object store | Key | Notes | | -------------------------------------------- | ------------------------------------------------------------------------------------------------ | | `AWS_ENDPOINT_URL` | Set this to your own S3-compatible endpoint. Leave it unset only if you are using AWS S3 itself. | | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | Credentials for that endpoint | | `AWS_REGION` | Region string your store expects | ## Everything else The Secret Mixpeek runs internally carries around 120 keys. Most are integrations the runtime does not need in your environment: payments, support desks, analytics, social connectors and error reporting. Set only what you use. Most keys you leave out stay unset, and the feature that reads them stays off. `SENTRY_DSN` is the exception, and it is the one to read the next section for. ## What leaves your environment Short answer: error reports, unless you turn them off. Nothing else. **`SENTRY_DSN` has a non-empty default that points at Mixpeek's Sentry project.** It is not part of the chart, so it appears in no manifest you can inspect, and leaving it unset does not disable it. The runtime only skips error reporting when the DSN is empty or `ENV` is `local`, and a deployed install is neither. Exceptions raised in your environment, with their stack traces and the context Sentry attaches, are sent to us. To stop that, set it explicitly to an empty value: ```yaml theme={null} SENTRY_DSN: "" ``` Point it at your own Sentry project instead if you want the reports and want them to stay yours. This default is being reconsidered so that error reporting is off unless you opt in. Until that ships, setting `SENTRY_DSN: ""` is what turns it off, and this page will say so plainly for as long as it is true. A fuller version of this, with per-model sizes and the source line for each claim, is in the Customer-Hosted control-plane boundary write-up your account team can share. ### What does not leave Checked the same way, so this list means something: | Channel | Behaviour with the shipped configuration | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Product analytics (PostHog) | Off. The client is a no-op without an API key, and the key has no default. | | Mixpeek control plane | Off. Every `CONTROL_PLANE_*` setting defaults to unset, and the request-forwarding prefix does nothing without a control-plane URL. | | Your objects and documents | Never leave. They are read from and written to the endpoints you configure above. | | Model weights | Two model sets are baked into the engine image. Four more are downloaded from `huggingface.co` the first time a replica loads them, so this path is outbound but carries nothing of yours. An environment with no route to `huggingface.co` starts Ray healthy and then leaves those applications unable to load. | `MIXPEEK_PRIVATE_TOKEN` is worth calling out: the API and the engine authenticate to each other with it, so set it to a value you generate, and use the same value for both.