diff --git a/enterprise/backend/src/metabase_enterprise/sso/integrations/sso_settings.clj b/enterprise/backend/src/metabase_enterprise/sso/integrations/sso_settings.clj
index d725cbfc7f84a6dfcfcdb282448d2d3222c1b871..00d33ac8a4697cecf8209c987784364709a7128b 100644
--- a/enterprise/backend/src/metabase_enterprise/sso/integrations/sso_settings.clj
+++ b/enterprise/backend/src/metabase_enterprise/sso/integrations/sso_settings.clj
@@ -47,7 +47,7 @@ don''t have one.")
 
 (defsetting saml-identity-provider-uri
   (deferred-tru "This is the URL where your users go to log in to your identity provider. Depending on which IdP you''re
-using, this usually looks like https://your-org-name.example.com or https://example.com/app/my_saml_app/abc123/sso/saml")
+using, this usually looks like `https://your-org-name.example.com` or `https://example.com/app/my_saml_app/abc123/sso/saml`")
   :feature :sso-saml
   :audit   :getter)
 
@@ -74,7 +74,7 @@ open it in a text editor, then copy and paste the certificate's contents here.")
 
 (defsetting saml-identity-provider-issuer
   (deferred-tru "This is a unique identifier for the IdP. Often referred to as Entity ID or simply 'Issuer'. Depending
-on your IdP, this usually looks something like http://www.example.com/141xkex604w0Q5PN724v")
+on your IdP, this usually looks something like `http://www.example.com/141xkex604w0Q5PN724v`")
   :feature :sso-saml
   :audit   :getter)
 
diff --git a/src/metabase/cmd/env_var_dox.clj b/src/metabase/cmd/env_var_dox.clj
index b4bb0d9eae9fa7cf975f75bb0a4966369b136bc3..39e930fd964a541b32b9bf2a6c6d5af00b8f0ff3 100644
--- a/src/metabase/cmd/env_var_dox.clj
+++ b/src/metabase/cmd/env_var_dox.clj
@@ -8,27 +8,36 @@
    [clojure.tools.namespace.find :as ns.find]
    [clojure.tools.reader.edn :as edn]
    [metabase.models.setting :as setting]
+   [metabase.query-processor.middleware.constraints :as qp.constraints]
    [metabase.util :as u]))
 
-(def env-vars-not-to-mess-with
-  "Flamber advises that people avoid touching these environment variables."
-  (set (edn/read-string (slurp (io/resource "metabase/cmd/resources/env-vars-to-avoid.edn")))))
-
-(defn get-settings
-  "Loads all of the metabase namespaces, which loads all of the defsettings,
-  which are registered in an atom in the settings namespace. Once settings are registered,
-  This function derefs that atom and puts the settings into a sorted map for processing."
-  []
-  (doseq [ns-symb (ns.find/find-namespaces (classpath/system-classpath))
-          :when (and
-                 (str/includes? (name ns-symb) "metabase")
-                 (not (str/includes? (name ns-symb) "test")))]
-    (require ns-symb))
-  (->> @setting/registered-settings
+(defn prep-settings
+  "Used to return a map from the registered settings atom."
+  [settings]
+  (->> settings
        (into (sorted-map))
        seq
        (map (fn [[_ v]] v))))
 
+(defn get-settings
+  "Loads all (or a set of) of the Metabase namespaces, which loads all of the defsettings,
+  which are registered in an atom in the settings namespace. Once settings are registered,
+  this function derefs that atom and puts the settings into a sorted map for processing."
+  ([]
+   (doseq [ns-symb (ns.find/find-namespaces (classpath/system-classpath))
+           :when (and
+                  (str/includes? (name ns-symb) "metabase")
+                  (not (str/includes? (name ns-symb) "test")))]
+     (require ns-symb))
+   (prep-settings @setting/registered-settings))
+  ;; Or supply a set of namespaces to load
+  ;; Primarily used for testing
+  ([ns-set]
+   (doseq [ns-symb (ns.find/find-namespaces (classpath/system-classpath))
+           :when (ns-set (name ns-symb))]
+     (require ns-symb))
+   (prep-settings @setting/registered-settings)))
+
 ;;;; Formatting functions
 
 (defn- format-type
@@ -36,21 +45,29 @@
   [env-var]
   (str "Type: " (name (:type env-var))))
 
+(defn- handle-defaults-set-elsewhere
+  "Handles defaults not set in the `defsetting.`"
+  [env-var]
+  (let [n (:name env-var)]
+    (cond (= :aggregated-query-row-limit n) (assoc env-var :default (:max-results (qp.constraints/default-query-constraints)))
+          (= :unaggregated-query-row-limit n) (assoc env-var :default (:max-results-bare-rows (qp.constraints/default-query-constraints)))
+          :else env-var)))
+
 (defn- format-default
-  "Helper function to specify how to format the default value of an enviromnent variable.
+  "Helper function to specify how to format the default value of an environment variable.
   for use in the environment variable docs."
   [env-var]
-  (let [d (:default env-var)]
+  (let [d (:default (handle-defaults-set-elsewhere env-var))]
     (str "Default: "
-         (if (false? d) "`false`"
-             (if (:default env-var)
-               (str "`" (:default env-var) "`")
-               "`null`")))))
+         (cond
+           (false? d) "`false`"
+           (nil? d) "`null`"
+           :else (str "`" d "`")))))
 
 (defn- format-prefix
-  "Used to build an environment variable."
+  "Used to build an environment variable, like `MB_ENV_VAR_NAME`"
   [env-var]
-  (str "MB_" (u/->SCREAMING_SNAKE_CASE_EN (name (:name env-var)))))
+  (str "MB_" (u/->SCREAMING_SNAKE_CASE_EN (:munged-name env-var))))
 
 (defn- format-heading
   "Takes an integer and a string and creates a Markdown heading of level n."
@@ -60,36 +77,76 @@
 (defn- format-description
   "Helper function to specify description format for enviromnent variable docs."
   [env-var]
-  (->> (:description env-var)
+  (->> ((:description env-var))
        u/add-period
        ;; Drop brackets used to create source code links
        (#(str/replace % #"\[\[|\]\]" ""))))
 
-(defn format-added
-  "Used to specify when the environment variable was added, if that info exists."
+(def paid-message
+  "Used to mark an env var that requires a paid plan."
+  "> Only available on Metabase [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans.")
+
+(defn- format-paid
+  "Does the variable require a paid license?"
+  [env-var]
+  (if (nil? (:feature env-var))
+    ""
+    paid-message))
+
+(defn- format-export
+  "Whether the variable is exported in serialization settings."
   [env-var]
-  (when-let [a (:added (:doc env-var))]
-    (str "Added: " a)))
+  (if (true? (:export? env-var))
+    (str "[Exported as](../installation-and-operation/serialization.md): `" (:munged-name env-var) "`.")
+    ""))
 
 (defn- format-doc
-  "Includes additional documentation for an environment variable (`:commentary`), if it exists."
+  "Includes additional documentation for an environment variable, if it exists."
   [env-var]
   (when-let [d (:doc env-var)]
-    (:commentary d)))
+    d))
 
-(defn format-env-var-entry
+(defn- format-config-name
+  "Formats the configuration file name for an environment variable."
+  [env-var]
+  (if (= (:visibility env-var) :internal)
+    ""
+    (str "[Configuration file name](./config-file.md): `" (:munged-name env-var) "`")))
+
+(defn list-item
+  "Create a list item for an entry, like `- Default: 100`."
+  [entry]
+  (if (or (str/blank? entry)
+          (nil? entry))
+    ""
+    (str "- " entry)))
+
+(defn format-list
+  "Used to format metadata as a list."
+  [entries]
+  (str/join "\n" (remove str/blank? (map list-item entries))))
+
+(defn- format-env-var-entry
   "Preps a doc entry for an environment variable as a Markdown section."
   [env-var]
   (str/join "\n\n" (remove str/blank?
                            [(format-heading 3 (format-prefix env-var))
-                            (format-type env-var)
-                            (format-default env-var)
-                            (format-added env-var)
+                            (format-paid env-var)
+                            ;; metadata we should format as a list
+                            ;; Like `- Default: 100`
+                            (format-list [(format-type env-var)
+                                          (format-default env-var)
+                                          (format-export env-var)
+                                          (format-config-name env-var)])
                             (format-description env-var)
                             (format-doc env-var)])))
 
 ;;;; Filter functions
 
+(def env-vars-not-to-mess-with
+  "Flamber advises that people avoid touching these environment variables."
+  (set (edn/read-string (slurp (io/resource "metabase/cmd/resources/env-vars-to-avoid.edn")))))
+
 (defn- avoid?
   "Used to filter out environment variables with high foot-gun indices."
   [env-var]
@@ -108,6 +165,12 @@
   [env-var]
   (nil? (:deprecated env-var)))
 
+(defn- only-local?
+  "Used to filter out environment variables that are only local."
+  [env-var]
+  (or (= (:user-local env-var) :only)
+      (= (:database-local env-var) :only)))
+
 (defn format-env-var-docs
   "Preps relevant environment variable docs as a Markdown string."
   [settings]
@@ -115,6 +178,7 @@
        (filter setter?)
        (filter active?)
        (remove avoid?)
+       (remove only-local?)
        (map format-env-var-entry)))
 
 (defn- format-intro
@@ -122,10 +186,21 @@
   []
   (str (slurp "src/metabase/cmd/resources/env-var-intro.md") "\n\n"))
 
+(defn- non-defsetting-env-vars
+  "Retrieves environment variables not specified via `defsetting`."
+  []
+  (str "\n\n" (slurp "src/metabase/cmd/resources/other-env-vars.md") "\n"))
+
+(defn prep-dox
+  "Preps the environment variable docs for printing."
+  []
+  (apply str (format-intro)
+         (str/join "\n\n" (format-env-var-docs (get-settings)))
+         (non-defsetting-env-vars)))
+
 (defn generate-dox!
   "Prints the generated environment variable docs to a file."
   []
   (println "Generating docs for environment variables...")
-  (spit (io/file "docs/configuring-metabase/environment-variables.md") (apply str (format-intro)
-                                                                              (str/join "\n\n" (format-env-var-docs (get-settings)))))
+  (spit (io/file "docs/configuring-metabase/environment-variables.md") (prep-dox))
   (println "Done."))
diff --git a/src/metabase/cmd/resources/other-env-vars.md b/src/metabase/cmd/resources/other-env-vars.md
new file mode 100644
index 0000000000000000000000000000000000000000..8d447773fce2b45aa9c0924eabffe2afcfd82554
--- /dev/null
+++ b/src/metabase/cmd/resources/other-env-vars.md
@@ -0,0 +1,532 @@
+## Other environment variables
+
+The following environment variables can only be set via the environment. They cannot be set by the configuration file.
+
+### `MAX_SESSION_AGE`
+
+Type: integer<br>
+Default: `20160`
+
+Session expiration, defined in minutes (default is 2 weeks), which will log out users after the defined period and require re-authentication.
+
+Note: This setting is not an idle/inactivity timeout. If you set this to 15 minutes, your users have to login (or re-authenticate) again every 15 minutes. Use [MB_SESSION_TIMEOUT](#mb_session_timeout) to control timeout based on inactivity.
+
+Use [MB_SESSION_COOKIES](#mb_session_cookies) to also expire sessions, when browser is closed.
+
+Also see the [Changing session expiration](../people-and-groups/changing-session-expiration.md) documentation page.
+
+### `MB_APPLICATION_DB_MAX_CONNECTION_POOL_SIZE`
+
+Type: integer<br>
+Default: `15`<br>
+Since: v35.0
+
+Maximum number of connections to the Metabase application database.
+
+Change this to a higher value if you notice that regular usage consumes all or close to all connections. When all connections are in use, Metabase might feel slow or unresponsive when clicking around the interface.
+
+To see how many connections are being used, check the Metabase logs and look for lines that contains the following: `… App DB connections: 12/15 …`. In this example, 12 out of 15 available connections are being used.
+
+See [MB_JDBC_DATA_WAREHOUSE_MAX_CONNECTION_POOL_SIZE](#mb_jdbc_data_warehouse_max_connection_pool_size) for setting maximum connections to the databases connected to Metabase.
+
+### `MB_ASYNC_QUERY_THREAD_POOL_SIZE`
+
+Type: integer<br>
+Default: `50`<br>
+Since: v35.0
+
+Maximum number of async Jetty threads. If not set, then [MB_JETTY_MAXTHREADS](#mb_jetty_maxthreads) will be used, otherwise it will use the default.
+
+### `MB_ATTACHMENT_TABLE_ROW_LIMIT`
+
+Type: integer<br>
+Default: `20`<br>
+
+Limits the number of rows Metabase will display in tables sent with dashboard subscriptions and alerts. Range: 1-100. To limit the total number of rows included in the file attachment for an email dashboard subscription, use [MB_UNAGGREGATED_QUERY_ROW_LIMIT](#mb_unaggregated_query_row_limit).
+
+### `MB_AUDIT_MAX_RETENTION_DAYS`
+
+Only available on Metabase [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans.<br>
+Type: integer<br>
+Default: 720 (Metabase keeps all rows)<br>
+
+Sets the maximum number of days Metabase preserves rows for the following application database tables:
+
+- `query_execution`
+- `audit_log`
+- `view_log`
+
+Twice a day, Metabase will delete rows older than this threshold.
+
+The minimum value is `30` days (Metabase will treat entered values of `1` to `29` the same as `30`). If set to `0`, Metabase will keep all rows.
+
+### `MB_COLORIZE_LOGS`
+
+Type: boolean<br>
+Default: `true`
+
+Color log lines. When set to `false` it will disable log line colors. This is disabled on Windows. Related to [MB_EMOJI_IN_LOGS](#mb_emoji_in_logs).
+
+### `MB_CONFIG_FILE_PATH`
+
+Type: string<br>
+Default: `config.yml`
+
+This feature requires the `config-text-file` feature flag on your token.
+
+### `MB_CUSTOM_GEOJSON_ENABLED`
+
+Type: boolean<br>
+Default: `true`
+
+Whether or not the use of custom GeoJSON is enabled.
+
+### `MB_DB_AUTOMIGRATE`
+
+Type: boolean<br>
+Default: `true`
+
+When set to `false`, Metabase will print migrations needed to be done in the application database and exit. Those migrations need to be applied manually. When `true`, Metabase will automatically make changes to the application database. This is not related to migrating away from H2.
+
+### `MB_DB_CONNECTION_URI`
+
+Type: string<br>
+Default: `null`
+
+A JDBC-style connection URI that can be used instead of most of `MB_DB_*` like [MB_DB_HOST](#mb_db_host). Also used when certain Connection String parameters are required for the connection. The connection type requirement is the same as [MB_DB_TYPE](#mb_db_type).
+
+Examples:
+
+```
+jdbc:postgresql://db.example.com:5432/mydb?user=dbuser&password=dbpassword
+
+jdbc:postgresql://db.example.com:5432/mydb?user=dbuser&password=dbpassword&ssl=true&sslfactory=org.postgresql.ssl.NonValidatingFactory
+
+jdbc:mysql://db.example.com:3306/mydb?user=dbuser&password=dbpassword
+```
+
+### `MB_DB_DBNAME`
+
+Type: string<br>
+Default: `null`
+
+The database name of the application database used with [MB_DB_HOST](#mb_db_host).
+
+### `MB_DB_FILE`
+
+Type: string<br>
+Default: `"metabase.db"`
+
+Location of H2 database file. Should not include the `.mv.db` (or `.h2.db`) file extension. Used when [MB_DB_TYPE](#mb_db_type) is set to`"h2"`.
+
+Can also be used when migrating away from H2 to specify where the existing data should be read from.
+
+### `MB_DB_HOST`
+
+Type: string<br>
+Default: `null`
+
+The host name or IP address of the application database. Used when [MB_DB_TYPE](#mb_db_type) is different than `"h2"`.
+
+### `MB_DB_IN_MEMORY`
+
+Type: boolean<br>
+Default: `null`
+
+Used for testing with [MB_DB_FILE](#mb_db_file).
+
+### `MB_DB_PASS`
+
+Type: string<br>
+Default: `null`
+
+The password for [MB_DB_HOST](#mb_db_host).
+
+### `MB_DB_PORT`
+
+Type: integer<br>
+Default: `null`
+
+The port for [MB_DB_HOST](#mb_db_host).
+
+### `MB_DB_TYPE`
+
+Type: string (`"h2"`, `"postgres"`, `"mysql"`)<br>
+Default: `"h2"`
+
+When `"h2"`, the application database is loaded from [MB_DB_FILE](#mb_db_file), otherwise [MB_DB_HOST](#mb_db_host) will be used to define application database.
+
+### `MB_DB_USER`
+
+Type: string<br>
+Default: `null`
+
+The username for [MB_DB_HOST](#mb_db_host).
+
+### `MB_DEV_ADDITIONAL_DRIVER_MANIFEST_PATHS`
+
+Type: string<br>
+Default: `null`
+
+Used during development of third-party drivers. Set the value to have that plugin manifest get loaded during startup. Specify multiple plugin manifests by comma-separating them.
+
+### `MB_DISABLE_SESSION_THROTTLE`
+
+Type: boolean<br>
+Default: `false`
+
+When `true`, this will disable session throttling. **Warning:** It is not recommended to disable throttling, since it is a protective measure against brute-force attacks.
+
+Use [MB_SOURCE_ADDRESS_HEADER](#mb_source_address_header) to set the IP address of the remote client from e.g. a reverse-proxy.
+
+### `MB_EMOJI_IN_LOGS`
+
+Type: boolean<br>
+Default: `true`
+
+Emojis on log lines. When set to `false` it will disable log line emojis. This is disabled on Windows. Related to [MB_COLORIZE_LOGS](#mb_colorize_logs).
+
+### `MB_ENABLE_TEST_ENDPOINTS`
+
+Type: boolean<br>
+Default: `null`
+
+When `true`, this will enable `/api/testing` endpoint. **Warning:** This should never be enabled in production system.
+
+### `MB_ENABLE_XRAYS`
+
+Type: boolean<br>
+Default: `true`
+
+Allow users to explore data using X-rays.
+
+### `MB_ENCRYPTION_SECRET_KEY`
+
+Type: string<br>
+Default: `null`
+
+When set, this will encrypt database credentials stored in the application database. Requirement: minimum 16 characters base64-encoded string.
+
+Also see documentation page [Encrypting database details at rest](../databases/encrypting-details-at-rest.md).
+
+### `MB_JDBC_DATA_WAREHOUSE_UNRETURNED_CONNECTION_TIMEOUT_SECONDS`
+
+Type: integer<br>
+Default: `1200`<br>
+Since: v47.4
+
+Metabase's query processor will normally kill connections when their queries time out, but in practice some connections can be severed and go undetected by Metabase, staying alive even after a query returns or times out. This environment variable tells Metabase how long to wait before killing connections if no response is received from the connection.
+
+This variable affects connections that are severed and undetected by Metabase (that is, in situations where Metabase never receives a connection closed signal and is treating an inactive connection as active). You may want to adjust this variable's value if your connection is unreliable or is a dynamic connections behind a SSH tunnel where the connection to the SSH tunnel host may stay active even after the connection from the SSH tunnel host to your database is severed.
+
+Unless set otherwise, the default production value for `metabase.query-processor.query-timeout-ms` is used which is 1,200,000 ms (i.e. 1,200 seconds or 20 minutes).
+
+### `MB_JETTY_ASYNC_RESPONSE_TIMEOUT`
+
+Type: integer<br>
+Default: `600000`<br>
+Since: v35.0
+
+Timeout of Jetty async threads, defined in milliseconds. The default is 10 minutes. Very few things might reach that timeout, since they return some type of data before, but things like CSV downloads might.
+
+### `MB_JETTY_DAEMON`
+
+Type: boolean<br>
+Default: `false`
+
+Use daemon threads.
+
+### `MB_JETTY_HOST`
+
+Type: string<br>
+Default: `localhost` for JAR, `0.0.0.0` for Docker
+
+Configure a host either as a host name or IP address to identify a specific network interface on which to listen. If set to `"0.0.0.0"`, Metabase listens on all network interfaces. It will listen on the port specified in [MB_JETTY_PORT](#mb_jetty_port).
+
+### `MB_JETTY_JOIN`
+
+Type: boolean<br>
+Default: `true`
+
+Blocks the thread until server ends.
+
+### `MB_JETTY_MAXIDLETIME`
+
+Type: integer<br>
+Default: `200000`
+
+Maximum idle time for a connection, in milliseconds.
+
+### `MB_JETTY_MAXQUEUED`
+
+Type: integer<br>
+Default: _"FIX ME"_
+
+Maximum number of requests to be queued when all threads are busy.
+
+### `MB_JETTY_MAXTHREADS`
+
+Type: integer<br>
+Default: `50`
+
+Maximum number of threads.
+
+Change this to a higher value if you notice that regular usage consumes all or close to all threads. When all threads are in use Metabase might feel slow or unresponsive when clicking around the interface.
+
+To see how many threads are being used, check the Metabase logs and look for lines that contain the following: `… Jetty threads: 45/50 …`, which in this case would indicate 45 out of 50 available threads are being used.
+
+Related [MB_ASYNC_QUERY_THREAD_POOL_SIZE](#mb_async_query_thread_pool_size).
+
+### `MB_JETTY_MINTHREADS`
+
+Type: integer<br>
+Default: `8`
+
+Minimum number of threads.
+
+### `MB_JETTY_PORT`
+
+Type: integer<br>
+Default: `3000`
+
+Configure which port to use for HTTP. It will listen on the interface specified in [MB_JETTY_HOST](#mb_jetty_host).
+
+### `MB_JETTY_REQUEST_HEADER_SIZE`
+
+Type: integer<br>
+Default: `8192`<br>
+Since: v36.0
+
+Maximum size of a request header, in bytes. Increase this value if you are experiencing errors like "Request Header Fields Too Large".
+
+### `MB_JETTY_SSL`
+
+Type: boolean<br>
+Default: `null`
+
+When set to `true`, will enable HTTPS with the options configured in the `MB_JETTY_SSL_*` variables.
+
+Also see the [Customizing Jetty web server](customizing-jetty-webserver.md) documentation page.
+
+### `MB_JETTY_SSL_CLIENT_AUTH`
+
+Type: boolean<br>
+Default: `null`
+
+Configure Java SSL client authentication. When set to `true`, client certificates are required and verified by the certificate authority in the TrustStore.
+
+### `MB_JETTY_SSL_KEYSTORE`
+
+Type: string<br>
+Default: `null`
+
+Path to Java KeyStore file.
+
+### `MB_JETTY_SSL_KEYSTORE_PASSWORD`
+
+Type: string<br>
+Default: `null`
+
+Password for Java KeyStore file.
+
+### `MB_JETTY_SSL_PORT`
+
+Type: integer<br>
+Default: `null`
+
+Configure which port to use for HTTPS. It will listen on the interface specified in [MB_JETTY_HOST](#mb_jetty_host).
+
+### `MB_JETTY_SSL_TRUSTSTORE`
+
+Type: string<br>
+Default: `null`
+
+Path to Java TrustStore file.
+
+### `MB_JETTY_SSL_TRUSTSTORE_PASSWORD`
+
+Type: string<br>
+Default: `null`
+
+Password for Java TrustStore file.
+
+### `MB_LANDING_PAGE`
+
+Only available on Metabase [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans.<br>
+Type: string<br>
+Default: `""`
+
+Default page to show people when they log in.
+
+### `MB_LOAD_ANALYTICS_CONTENT`
+
+Type: Boolean<br>
+Default: True
+
+If you want to exclude the [Metabase analytics](../usage-and-performance-tools/usage-analytics.md) collection, you can set `MB_LOAD_ANALYTICS_CONTENT=false`. Setting this environment variable to false can also come in handy when migrating environments, as it can simplify the migration process.
+
+### `MB_NO_SURVEYS`
+
+Type: boolean<br>
+Default: `false`<br>
+
+Metabase will send a sentiment survey to people who create a number of questions and dashboards to gauge how well the product is doing with respect to making things easy for creators.
+
+Metabase will only send these emails to people who have in the past 2 months:
+
+- Created at least 10 questions total
+- Created at least 2 SQL questions
+- Created at least 1 dashboard
+
+If you're whitelabeling Metabase, these survey emails will only be sent to admins for that instance who meet that criteria.
+
+If you don't want Metabase to send these emails, set `MB_NO_SURVEYS=true`.
+
+### `MB_NS_TRACE`
+
+Type: string<br>
+Default: `""`
+
+Comma-separated namespaces to trace. **WARNING:** Could log sensitive information like database passwords.
+
+### `MB_PASSWORD_COMPLEXITY`
+
+Type: string (`"weak"`, `"normal"`, `"strong"`)<br>
+Default: `"normal"`
+
+Enforce a password complexity rule to increase security for regular logins. This only applies to new users or users that are changing their password. Related [MB_PASSWORD_LENGTH](#mb_password_length)
+
+- `weak` no character constraints
+- `normal` at least 1 digit
+- `strong` minimum 8 characters w/ 2 lowercase, 2 uppercase, 1 digit, and 1 special character
+
+### `MB_PASSWORD_LENGTH`
+
+Type: integer<br>
+Default: `6`
+
+Set a minimum password length to increase security for regular logins. This only applies to new users or users that are changing their password. Uses the length of [MB_PASSWORD_COMPLEXITY](#mb_password_complexity) if not set.
+
+### `MB_PLUGINS_DIR`
+
+Type: string<br>
+Default: `"plugins"`
+
+Path of the "plugins" directory, which is used to store the Metabase database drivers. The user who is running Metabase should have permission to write to the directory. When running the JAR, the default directory is `plugins`, created in the same location as the JAR file. When running Docker, the default directory is `/plugins`.
+
+The location is where custom third-party drivers should be added. Then Metabase will load the driver on startup, which can be verified in the log.
+
+### `MB_PREMIUM_EMBEDDING_TOKEN`
+
+Type: string<br>
+Default: `null`
+
+The license token used for Pro and Enterprise to enable premium features on the Enterprise edition. It is also used for the deprecated "Premium Embedding" functionality on the OSS edition.
+
+### `MB_QP_CACHE_BACKEND`
+
+Type: string<br>
+Default: `"db"`
+
+Current cache backend. Dynamically rebindable primarily for test purposes.
+
+### `MB_QUERY_CACHING_MIN_TTL`
+
+Type: integer<br>
+Default: `60`
+
+Metabase will cache all saved questions with an average query execution time longer than this many seconds.
+
+### `MB_QUERY_CACHING_TTL_RATIO`
+
+Type: integer<br>
+Default: `10`
+
+To determine how long each saved question's cached result should stick around, we take the query's average execution time and multiply that by whatever you input here. So if a query takes on average 2 minutes to run, and you input 10 for your multiplier, its cache entry will persist for 20 minutes.
+
+### `MB_SEARCH_TYPEAHEAD_ENABLED`
+
+Type: boolean<br>
+Default: `true`<br>
+Since: v39.0
+
+Show auto-suggestions when using the global search in the top navigation bar.
+
+### `MB_SEND_EMAIL_ON_FIRST_LOGIN_FROM_NEW_DEVICE`
+
+Type: boolean<br>
+Default: `true`<br>
+Since: v39.0
+
+Send email notification to user, when they login from a new device. Set to `false` to stop sending "We've noticed a new login on your Metabase account" emails for all users.
+
+Also, this variable controls the geocoding service that Metabase uses to know the location from where your users logged in. Setting this variable to false also disables this reverse geocoding functionality.
+
+### `MB_SEND_NEW_SSO_USER_ADMIN_EMAIL`
+
+Only available on Metabase [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans.<br>
+Type: boolean<br>
+Default: `true`
+
+Send email notifications to users in Admin group, when a new SSO users is created on Metabase.
+
+### `MB_SESSION_COOKIE_SAMESITE`
+
+Only available on Metabase [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans.<br>
+Type: string (`"none"`, `"lax"`, `"strict"`)<br>
+Default: `"lax"`
+
+See [Embedding Metabase in a different domain](../embedding/interactive-embedding.md#embedding-metabase-in-a-different-domain).
+
+Related to [MB_EMBEDDING_APP_ORIGIN](#mb_embedding_app_origin). Read more about [interactive Embedding](../embedding/interactive-embedding.md).
+
+Learn more about SameSite cookies: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
+
+### `MB_SESSION_COOKIES`
+
+Type: boolean<br>
+Default: `null`
+
+When set to `true`, the user login session will expire when the browser is closed. The user login session will always expire after the amount of time defined in [MAX_SESSION_AGE](#max_session_age) (by default 2 weeks).
+
+This overrides the "Remember me" checkbox when logging in.
+
+Also see the [Changing session expiration](../people-and-groups/changing-session-expiration.md) documentation page.
+
+### `MB_SETUP_TOKEN`
+
+Type: string<br>
+Default: `null`
+
+An UUID token used to signify that an instance has permissions to create the initial User. This is created upon the first launch of Metabase, by the first instance; once used, it is cleared out, never to be used again.
+
+### `MB_SHOW_LIGHTHOUSE_ILLUSTRATION`
+
+Only available on Metabase [Pro](https://www.metabase.com/product/pro) and [Enterprise](https://www.metabase.com/product/enterprise) plans.<br>
+Type: boolean<br>
+Default: `true`<br>
+Since: v44.0
+
+Display the lighthouse illustration on the home and login pages.
+
+### `MB_JETTY_SKIP_SNI`
+
+Type: string<br>
+Default: `"true"`<br>
+Since: v48.4
+
+Setting `MB_JETTY_SKIP_SNI=true` (the default setting) turns off the Server Name Indication (SNI) checks in the Jetty web server. Normally you would leave this enabled. If, however, you're terminating the Transport Layer Security (TLS) connection on Metabase itself, and you're getting an error like `HTTP ERROR 400 Invalid SNI`, consider either setting `MB_JETTY_SKIP_SNI=false`, or use another SSL certificate that exactly matches the domain name of the server.
+
+### `MB_SOURCE_ADDRESS_HEADER`
+
+Type: string<br>
+Default: `X-Forwarded-For`
+
+Identify the source of HTTP requests by this header's value, instead of its remote address. Related to [MB_DISABLE_SESSION_THROTTLE](#mb_disable_session_throttle).
+
+### `MB_SSL_CERTIFICATE_PUBLIC_KEY`
+
+Type: string<br>
+Default: `null`
+
+Base-64 encoded public key for this sites SSL certificate. Specify this to enable HTTP Public Key Pinning. Using HPKP is no longer recommended. See http://mzl.la/1EnfqBf for more information.
diff --git a/src/metabase/driver/sql_jdbc/connection.clj b/src/metabase/driver/sql_jdbc/connection.clj
index 1ac2e25791ba2c48498339f1dcd04369881c301c..231dc02e05467e2b70cfde71a4912592c9680f85 100644
--- a/src/metabase/driver/sql_jdbc/connection.clj
+++ b/src/metabase/driver/sql_jdbc/connection.clj
@@ -84,7 +84,12 @@
   :visibility :internal
   :type       :integer
   :default    15
-  :audit      :getter)
+  :audit      :getter
+  :doc "Change this to a higher value if you notice that regular usage consumes all or close to all connections.
+
+When all connections are in use then Metabase will be slower to return results for queries, since it would have to wait for an available connection before processing the next query in the queue.
+
+For setting the maximum, see [MB_APPLICATION_DB_MAX_CONNECTION_POOL_SIZE](#mb_application_db_max_connection_pool_size).")
 
 (setting/defsetting jdbc-data-warehouse-unreturned-connection-timeout-seconds
   "Kill connections if they are unreturned after this amount of time. In theory this should not be needed because the QP
diff --git a/src/metabase/public_settings.clj b/src/metabase/public_settings.clj
index 84a75a034a28ac53b3e87ceba438b8af7ed5cf29..279169277d1743c8019ff2db055ec6058e189395 100644
--- a/src/metabase/public_settings.clj
+++ b/src/metabase/public_settings.clj
@@ -177,7 +177,10 @@
                   ;; if the site URL isn't HTTPS then disable force HTTPS redirects if set
                   (when-not https?
                     (redirect-all-requests-to-https! false))
-                  (setting/set-value-of-type! :string :site-url new-value))))
+                  (setting/set-value-of-type! :string :site-url new-value)))
+  :doc "This URL is critical for things like SSO authentication, email links, embedding and more.
+        Even difference with `http://` vs `https://` can cause problems.
+        Make sure that the address defined is how Metabase is being accessed.")
 
 (defsetting site-locale
   (deferred-tru
@@ -357,7 +360,31 @@
   :type       :json
   :feature    :whitelabel
   :default    {}
-  :audit      :getter)
+  :audit      :getter
+  :doc "To change the user interface colors:
+
+```
+{
+ \"brand\":\"#ff003b\",
+ \"filter\":\"#FF003B\",
+ \"summarize\":\"#FF003B\"
+}
+```
+
+To change the chart colors:
+
+```
+{
+ \"accent0\":\"#FF0005\",
+ \"accent1\":\"#E6C367\",
+ \"accent2\":\"#B9E68A\",
+ \"accent3\":\"#8AE69F\",
+ \"accent4\":\"#8AE6E4\",
+ \"accent5\":\"#8AA2E6\",
+ \"accent6\":\"#B68AE6\",
+ \"accent7\":\"#E68AD0\"
+}
+```")
 
 (defsetting application-font
   (deferred-tru "Replace “Lato” as the font family.")
@@ -379,7 +406,25 @@
   :export?    true
   :type       :json
   :audit      :getter
-  :feature    :whitelabel)
+  :feature    :whitelabel
+  :doc "Example value:
+
+```
+[
+  {
+    \"src\": \"https://example.com/resources/font-400\",
+    \"fontFormat\": \"ttf\",
+    \"fontWeight\": 400
+  },
+  {
+    \"src\": \"https://example.com/resources/font-700\",
+    \"fontFormat\": \"woff\",
+    \"fontWeight\": 700
+  }
+]
+```
+
+See [fonts](../configuring-metabase/fonts.md).")
 
 (defn application-color
   "The primary color, a.k.a. brand color"
@@ -398,7 +443,8 @@
   :type       :string
   :audit      :getter
   :feature    :whitelabel
-  :default    "app/assets/img/logo.svg")
+  :default    "app/assets/img/logo.svg"
+  :doc "Inline styling and inline scripts are not supported.")
 
 (defsetting application-favicon-url
   (deferred-tru "Upload a file to use as the favicon.")
diff --git a/src/metabase/public_settings/premium_features.clj b/src/metabase/public_settings/premium_features.clj
index 71687458b264b1a4abfff047d52b3bb7b4df9a85..067e391ef00cede33c138f793d01b515ae4240f0 100644
--- a/src/metabase/public_settings/premium_features.clj
+++ b/src/metabase/public_settings/premium_features.clj
@@ -84,6 +84,7 @@
   :visibility :admin
   :type       :integer
   :audit      :never
+  :setter     :none
   :default    0
   :getter     (fn []
                 (if-not ((requiring-resolve 'metabase.db/db-is-set-up?))
diff --git a/src/metabase/server/middleware/session.clj b/src/metabase/server/middleware/session.clj
index 9c2782cd1c6613e56f8dab58b4660fd8eb6e2e89..e4c392ca8a6b1ad38b3e5ac2117767e6589acfb6 100644
--- a/src/metabase/server/middleware/session.clj
+++ b/src/metabase/server/middleware/session.clj
@@ -103,7 +103,9 @@
                 (throw (ex-info (tru "Invalid value for session cookie samesite")
                                 {:possible-values possible-session-cookie-samesite-values
                                  :session-cookie-samesite normalized-value
-                                 :http-status 400}))))))
+                                 :http-status 400})))))
+  :doc "See [Embedding Metabase in a different domain](../embedding/interactive-embedding.md#embedding-metabase-in-a-different-domain). Related to [MB_EMBEDDING_APP_ORIGIN](#mb_embedding_app_origin). Read more about [interactive Embedding](../embedding/interactive-embedding.md). Learn more about [SameSite cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite).
+")
 
 (defmulti default-session-cookie-attributes
   "The appropriate cookie attributes to persist a newly created Session to `response`."
@@ -507,7 +509,8 @@
                                  :amount-must-be-positive            "Session timeout amount must be positive."
                                  :amount-must-be-less-than-100-years "Session timeout must be less than 100 years.")
                                {:status-code 400})))
-             (setting/set-value-of-type! :json :session-timeout new-value)))
+             (setting/set-value-of-type! :json :session-timeout new-value))
+  :doc "Has to be in the JSON format `\"{\"amount\":120,\"unit\":\"minutes\"}\"` where the unit is one of \"seconds\", \"minutes\" or \"hours\".")
 
 (defn session-timeout->seconds
   "Convert the session-timeout setting value to seconds."
diff --git a/test/metabase/cmd/env_var_dox_test.clj b/test/metabase/cmd/env_var_dox_test.clj
index 89525eb4b63195f931a2ab13951fede697ec4cc4..8d6a6ea886e952a6bb7b7ea6c5fb6db78ae172b8 100644
--- a/test/metabase/cmd/env_var_dox_test.clj
+++ b/test/metabase/cmd/env_var_dox_test.clj
@@ -1,63 +1,26 @@
 (ns metabase.cmd.env-var-dox-test
   (:require
+   [clojure.string :as str]
    [clojure.test :refer :all]
    [metabase.cmd.env-var-dox :as sut]))
 
-(def settings '({:description "Have we sent a follow up email to the instance admin?",
-                 :database-local :never,
-                 :cache? true,
-                 :user-local :never,
-                 :default false,
-                 :name :follow-up-email-sent,
-                 :type :boolean,
-                 :enabled? nil,
-                 :deprecated nil,
-                 :sensitive? false,
-                 :tag java.lang.Boolean,
-                 :on-change nil,
-                 :doc nil,
-                 :namespace metabase.task.follow-up-emails,
-                 :munged-name "follow-up-email-sent",
-                 :visibility :internal}
-                {:description "The email address users should be referred to if they encounter a problem.",
-                 :database-local :never,
-                 :cache? true,
-                 :user-local :never,
-                 :default nil,
-                 :name :admin-email,
-                 :type :string,
-                 :enabled? nil,
-                 :deprecated nil,
-                 :sensitive? false,
-                 :tag java.lang.String,
-                 :on-change nil,
-                 :doc nil,
-                 :namespace metabase.public-settings,
-                 :munged-name "admin-email",
-                 :visibility :authenticated}
-                {:description
-                 "Unique identifier to be used in Snowplow analytics, to identify this instance of Metabase. This is a public setting since some analytics events are sent prior to initial setup.",
-                 :database-local :never,
-                 :cache? true,
-                 :user-local :never,
-                 :default nil,
-                 :name :analytics-uuid,
-                 :base metabase.models.setting/uuid-nonce-base,
-                 :enabled? nil,
-                 :deprecated nil,
-                 :sensitive? false,
-                 :tag java.lang.String,
-                 :on-change nil,
-                 :doc false, ;; Because it's false, we should exclude this setting from documentation
-                 :namespace metabase.analytics.snowplow,
-                 :munged-name "analytics-uuid",
-                 :visibility :public}))
+(def ns-set (sut/get-settings #{"metabase.public-settings"}))
 
-(def expected-docs '("### `MB_FOLLOW_UP_EMAIL_SENT`\n\nType: boolean\n\nDefault: `false`\n\nHave we sent a follow up email to the instance admin?"
-                     "### `MB_ADMIN_EMAIL`\n\nType: string\n\nDefault: `null`\n\nThe email address users should be referred to if they encounter a problem."))
+(def settings-filtered (filter #(#{:active-users-count ;; active-users-count should be excluded
+                                   :aggregated-query-row-limit
+                                   :admin-email}
+                                 (:name %))
+                               ns-set))
+
+(def admin-email-docs "### `MB_ADMIN_EMAIL`\n\n- Type: string\n- Default: `null`\n- [Configuration file name](./config-file.md): `admin-email`\n\nThe email address users should be referred to if they encounter a problem.")
+(def aggregated-query-row-limit-docs "### `MB_AGGREGATED_QUERY_ROW_LIMIT`\n\n- Type: integer\n- Default: `10000`\n- [Exported as](../installation-and-operation/serialization.md): `aggregated-query-row-limit`.\n- [Configuration file name](./config-file.md): `aggregated-query-row-limit`\n\nMaximum number of rows to return for aggregated queries via the API.")
+
+(def expected-docs (str/join "\n\n"
+                             [admin-email-docs
+                              aggregated-query-row-limit-docs]))
 
 (deftest test-env-var-docs
   (testing "Environment docs are formatted as expected."
-    (let [generated-docs (sut/format-env-var-docs settings)]
+    (let [generated-docs (sut/format-env-var-docs settings-filtered)]
       (is (= expected-docs
-             generated-docs)))))
+             (str/join "\n\n" generated-docs))))))