Skip to content
FrameWorks Docs
Blog

Configuration Reference

This page is generated from the typed configuration structs of each service. It lists every variable declared in a service’s startup configuration, its default, and the release that introduced it.

A service refuses to start when a required variable in its startup configuration is missing or a value cannot be parsed, and it names every offending variable in one error. A value that is empty or only whitespace counts as unset. Secret values are redacted from the authenticated /debug/config endpoint.

Shared packages read two variables directly from the process environment. BUILD_ENV is read by the internal gRPC TLS helpers, which reject GRPC_ALLOW_INSECURE and require TLS to Foghorn when it is production or prod. LOG_LEVEL is read once when the logger is created, before configuration loads; each service then applies the LOG_LEVEL listed below. Services that are not listed have not adopted typed configuration.

bosun

Section titled “bosun”

Read by api_webhooks/cmd/bosun.

VariableTypeDefaultNotesSinceDescription
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
EMAIL_LOGO_URLstringv0.3.10Absolute URL of the logo image in outgoing emails. Empty uses the light logomark served under WEBAPP_PUBLIC_URL.
WEBAPP_PUBLIC_URLstringv0.3.0Public base URL of the web application. Links in outgoing emails and notifications and redirects back to the web application are built from it, and it serves the default email logo when EMAIL_LOGO_URL is empty.
SUPPORT_EMAILstringv0.3.10Support mailbox shown in the footer of outgoing emails and set as Reply-To on the emails that carry one. Empty uses [email protected].
BOSUN_PORTstring18013v0.3.11TCP port for the HTTP listener that serves health, readiness, and metrics. PORT overrides it.
PORTstringv0.3.11TCP port for the HTTP listener. Takes precedence over BOSUN_PORT when set.
BOSUN_GRPC_PORTstring19009v0.3.11TCP port for the gRPC listener that serves the webhook API. Also the port registered with Quartermaster.
BOSUN_HOSTstringbosunv0.3.11Host name this instance advertises when it registers with Quartermaster.
REGIONstringv0.3.11Region label attached to the audit events Bosun sends to Decklog. Empty lets Decklog stamp its own region.
SERVICE_TOKENstringrequired, secretv0.3.11Service token accepted on incoming gRPC calls and sent to Quartermaster, Purser, and Decklog.
JWT_SECRETstringrequired, secretv0.3.11HMAC secret that verifies the user JWTs Bridge forwards on incoming gRPC calls.
BOSUN_FIELD_ENCRYPTION_KEYstringrequired, secretv0.3.11Active master secret, at least 16 bytes, that encrypts webhook signing secrets at rest. Bosun’s own key: no other service holds it.
BOSUN_FIELD_ENCRYPTION_KEY_IDstringprimaryv0.3.11Non-secret label embedded in new signing-secret ciphertext to name the active key.
BOSUN_FIELD_ENCRYPTION_PREVIOUS_KEYSstringsecretv0.3.11JSON object of retired key IDs to master secrets, kept so signing secrets written with them stay readable after a key rotation.
QUARTERMASTER_GRPC_ADDRstringrequiredv0.3.11Quartermaster gRPC address for service registration.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.11TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
PURSER_GRPC_ADDRstringrequiredv0.3.11Purser gRPC address for the billing contact that receives the email when an endpoint is disabled automatically.
PURSER_GRPC_TLS_SERVER_NAMEstringv0.3.11TLS server name override for the Purser connection. Empty uses the canonical internal name.
DECKLOG_GRPC_ADDRstringrequiredv0.3.11Decklog gRPC address that receives the audit events of Bosun’s domain event outbox. Events wait in the outbox while Decklog is unreachable.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.11TLS server name override for the Decklog connection. Empty uses the canonical internal name.
KAFKA_BROKERSlistrequiredv0.3.11Comma-separated bootstrap brokers of the aggregator Kafka cluster. Bosun consumes domain.events and its mirrored copies there.
KAFKA_CLUSTER_IDstringlocalv0.3.11Kafka cluster identifier attached to the domain event consumer and the dead-letter producer.
MIRROR_REGION_PREFIXESlistv0.3.11Comma-separated MirrorMaker2 source cluster aliases whose mirrored domain.events copies are also consumed. Empty consumes only the local topic.
DECKLOG_DLQ_KAFKA_TOPICstringdecklog_events_dlqv0.3.11Kafka topic that receives domain event records whose payload does not decode.
BOSUN_ALLOW_PRIVATE_DESTINATIONSbooleanfalsev0.3.11Lets webhook endpoints use private (RFC 1918 / ULA) addresses, plain http, and .local host names, so an isolated staging or development cluster can deliver to a receiver on its own network. It never opens the platform itself: loopback, link-local, cloud metadata, the host’s own addresses, mesh-routed addresses, and *.internal names stay blocked. Never set it on a cluster that serves untrusted tenants.
SMTP_HOSTstringv0.3.11SMTP server host for the email sent when an endpoint is disabled automatically. Empty leaves those emails queued and retried.
SMTP_PORTstring587v0.3.11SMTP server port.
SMTP_USERstringv0.3.11SMTP user.
SMTP_PASSWORDstringsecretv0.3.11Password for SMTP_USER.
FROM_EMAILstring[email protected]v0.3.11Sender address for webhook emails.
FROM_NAMEstringFrameWorksv0.3.11Sender display name for webhook emails.
SMTP_ALLOW_INSECUREbooleanfalsev0.3.11Sends webhook emails to an SMTP server that does not offer STARTTLS. For an isolated development or test relay only; never set it in production.

bridge

Section titled “bridge”

Read by api_gateway/cmd/bridge.

VariableTypeDefaultNotesSinceDescription
PORTstring18000v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token for internal gRPC and HTTP calls.
JWT_SECRETstringrequired, secretv0.3.0HMAC secret that signs and verifies user session JWTs.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
BUILD_ENVstringv0.3.0Runtime environment selector. Empty, dev, or development enables development-only behavior; production or prod marks a production process.
BRIDGE_HOSTstringbridgev0.3.0Host name this instance advertises when it registers with Quartermaster.
HOSTNAMEstringbridgev0.3.0Node name recorded as the source of API usage events.
REGIONstringv0.3.0Region label attached to API usage events sent to Decklog.
COMMODORE_GRPC_ADDRstringrequiredv0.3.0Commodore gRPC address for authentication, streams, and tenant resources.
PERISCOPE_GRPC_ADDRstringrequiredv0.3.0Periscope Query gRPC address for analytics queries.
PURSER_GRPC_ADDRstringrequiredv0.3.0Purser gRPC address for billing, payments, and webhook forwarding.
QUARTERMASTER_GRPC_ADDRstringrequiredv0.3.0Quartermaster gRPC address for tenants, clusters, and service registration.
SIGNALMAN_GRPC_ADDRstringrequiredv0.3.0Local-region Signalman gRPC address for realtime events. GraphQL subscriptions use it when SIGNALMAN_GRPC_ADDRS is empty.
DECKLOG_GRPC_ADDRstringrequiredv0.3.0Decklog gRPC address that receives API usage events.
NAVIGATOR_GRPC_ADDRstringv0.3.0Navigator gRPC address for tenant alias domains. Empty disables the Navigator client.
DECKHAND_GRPC_ADDRstringv0.3.0Deckhand gRPC address for support messaging. Empty disables the Deckhand client.
SKIPPER_GRPC_ADDRstringv0.3.0Skipper gRPC address for the AI consultant. Empty disables the Skipper gRPC client.
LOOKOUT_GRPC_ADDRstringv0.3.8Lookout gRPC address for incidents. Empty disables the Lookout client.
BOSUN_GRPC_ADDRstringv0.3.11Bosun gRPC address for outbound webhook endpoints and deliveries. Empty disables the Bosun client, and the webhook API returns an unavailable error.
SIGNALMAN_GRPC_ADDRSstringv0.3.0Comma-separated local-region Signalman replica addresses that GraphQL subscription streams are opened against, tried in a tenant-rotated order. Empty uses SIGNALMAN_GRPC_ADDR.
SIGNALMAN_CONNECT_TIMEOUT_SECONDSinteger5v0.3.0Seconds an upstream Signalman subscription stream waits for a ready connection before trying the next replica. 0 uses 5.
WS_MAX_SUBSCRIPTIONS_PER_TENANTinteger100v0.3.8Maximum concurrent GraphQL subscriptions per tenant on one Bridge replica. 0 disables the limit.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that Bridge uses to verify internal gRPC servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC connections when no TLS material is configured. Development only.
COMMODORE_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Commodore connection. Empty uses the canonical internal name.
PERISCOPE_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Periscope Query connection. Empty uses the canonical internal name.
PURSER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Purser connection. Empty uses the canonical internal name.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
NAVIGATOR_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Navigator connection. Empty uses the canonical internal name.
SIGNALMAN_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for Signalman connections. Empty uses the canonical internal name.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Decklog connection. Empty uses the canonical internal name.
DECKHAND_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Deckhand connection. Empty uses the canonical internal name.
SKIPPER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Skipper gRPC connection. Empty uses the canonical internal name.
LOOKOUT_GRPC_TLS_SERVER_NAMEstringv0.3.8TLS server name override for the Lookout connection. Empty uses the canonical internal name.
BOSUN_GRPC_TLS_SERVER_NAMEstringv0.3.11TLS server name override for the Bosun connection. Empty uses the canonical internal name.
QUARTERMASTER_CACHE_TTL_SECONDSinteger60v0.3.0Seconds a cached Quartermaster lookup stays fresh.
QUARTERMASTER_CACHE_SWR_SECONDSinteger30v0.3.0Seconds a stale Quartermaster lookup is served while it revalidates.
QUARTERMASTER_CACHE_NEG_TTL_SECONDSinteger10v0.3.0Seconds a failed Quartermaster lookup is cached.
QUARTERMASTER_CACHE_MAXinteger10000v0.3.0Maximum entries in the Quartermaster lookup cache.
PERISCOPE_CACHE_TTL_SECONDSinteger30v0.3.0Seconds a cached Periscope analytics query stays fresh.
PERISCOPE_CACHE_SWR_SECONDSinteger15v0.3.0Seconds a stale Periscope analytics result is served while it revalidates.
PERISCOPE_CACHE_NEG_TTL_SECONDSinteger5v0.3.0Seconds a failed Periscope analytics query is cached.
PERISCOPE_CACHE_MAXinteger5000v0.3.0Maximum entries in the Periscope analytics query cache.
PERISCOPE_CACHE_LOAD_TIMEOUT_SECONDSinteger30v0.3.0Seconds a shared Periscope cache load may run before it is abandoned.
COOKIE_DOMAINstringv0.3.0Domain attribute for auth cookies, leading dot ignored. Empty scopes cookies to the Bridge host; set a parent domain to share them across subdomains.
WEBAPP_PUBLIC_URLstringv0.3.0Public web application URL returned by /auth/webapp-url for native client browser handoff. Re-read after an env-file reload.
GATEWAY_PUBLIC_URLstringv0.3.0Public Bridge URL. The MCP schema tools introspect its /graphql/ endpoint; empty uses http://localhost:8080/graphql/.
DOCS_PUBLIC_URLstringv0.3.0Public documentation URL linked from rate-limit responses. Empty omits the link. Re-read after an env-file reload.
PUBLIC_RATE_LIMIT_PER_MINUTEinteger60v0.3.0Requests per minute allowed per client IP for unauthenticated callers. Values below 1 use 60. Re-read after an env-file reload.
PUBLIC_RATE_LIMIT_BURSTinteger30v0.3.0Burst allowance per client IP for unauthenticated callers. Values below 1 use 30. Re-read after an env-file reload.
WEBHOOK_RATE_LIMIT_PER_MINinteger300v0.3.0Inbound payment-provider webhook requests allowed per minute per client IP. 0 or less disables the webhook rate limit.
STREAMING_SRT_PORTinteger8889v0.3.0SRT ingest port reported in the streamingConfig GraphQL query. Re-read after an env-file reload.
STREAMING_RTMP_PORTinteger1935v0.3.0RTMP ingest port reported in the streamingConfig GraphQL query. Re-read after an env-file reload.
BRAND_DOMAINstringv0.3.0Platform root domain for global streaming host names when cluster routing carries no base URL. Re-read after an env-file reload.
TRUSTED_PROXY_CIDRSstringv0.3.0Comma-separated CIDRs or IPs of reverse proxies whose forwarding headers identify the client. Re-read after an env-file reload.
USAGE_HASH_SECRETstringsecretv0.3.0HMAC key for the user and API token hashes in API usage records. Bridge, Commodore, Purser, and Quartermaster must share one value, so the token hash a domain event records joins Bridge’s usage rows for the same token. Empty in Bridge uses a random per-process key: hashes change on restart and match no domain event.
GRAPHQL_COMPLEXITY_LIMITinteger2000v0.3.0Maximum GraphQL operation complexity. 0 disables the limit.
GRAPHQL_MAX_DEPTHinteger10v0.3.0Maximum GraphQL selection depth. 0 disables the limit.
GRAPHQL_PLAYGROUND_ENABLEDstringv0.3.0Serves the GraphQL playground at /graphql/playground when true. Empty enables it unless GIN_MODE is release.
TELEMETRY_TOKEN_SECRETstringsecretv0.3.0Shared key that verifies player telemetry tokens. Empty drops serving-cluster attribution from player telemetry.
SKIPPER_SPOKE_URLstringhttp://skipper:18018/mcp/spokev0.3.0Skipper MCP spoke URL that Bridge proxies the ask_consultant tool to.
SKILL_FILES_DIRstringv0.3.0Directory checked first for SKILL.md, skill.json, and the other agent discovery files.
X402_GAS_WALLET_ADDRESSstringv0.3.0Wallet address substituted into did.json. Empty removes the verification method from did.json.

commodore

Section titled “commodore”

Read by api_control/cmd/commodore.

VariableTypeDefaultNotesSinceDescription
PORTstring18001v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GRPC_PORTstring19001v0.3.0TCP port for the gRPC listener.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token for internal gRPC and HTTP calls.
JWT_SECRETstringrequired, secretv0.3.0HMAC secret that signs and verifies user session JWTs.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
BUILD_ENVstringv0.3.0Runtime environment selector. Empty, dev, or development enables development-only behavior; production or prod marks a production process.
SYSTEM_TENANT_IDstringv0.3.0UUID of the Quartermaster-owned system tenant. Empty uses the reserved ID 00000000-0000-0000-0000-000000000001; a value that is not a UUID fails startup.
EMAIL_LOGO_URLstringv0.3.10Absolute URL of the logo image in outgoing emails. Empty uses the light logomark served under WEBAPP_PUBLIC_URL.
WEBAPP_PUBLIC_URLstringv0.3.0Public base URL of the web application. Links in outgoing emails and notifications and redirects back to the web application are built from it, and it serves the default email logo when EMAIL_LOGO_URL is empty.
SUPPORT_EMAILstringv0.3.10Support mailbox shown in the footer of outgoing emails and set as Reply-To on the emails that carry one. Empty uses [email protected].
USAGE_HASH_SECRETstringrequired, secretv0.3.11HMAC key for the user and API token hashes in API usage records. Bridge, Commodore, Purser, and Quartermaster must share one value, so the token hash a domain event records joins Bridge’s usage rows for the same token.
FIELD_ENCRYPTION_KEY_IDstringprimaryv0.3.0Non-secret label embedded in new ciphertext envelopes to name the active field-encryption key.
FIELD_ENCRYPTION_PREVIOUS_KEYSstringsecretv0.3.0JSON object of retired key IDs to master secrets, kept so existing ciphertext stays readable.
FIELD_ENCRYPTION_LEGACY_SECRETSstringsecretv0.3.0Read-only v1 and v2 master secrets for decrypting historical ciphertext. Never used for new writes.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address for tenant, cluster, and registration calls.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
REGIONstringv0.3.0Region label attached to service events sent to Decklog.
COMMODORE_HOSTstringcommodorev0.3.0Host name this instance advertises when it registers with Quartermaster.
FIELD_ENCRYPTION_KEYstringrequired, secretv0.3.0Active master secret for application-field encryption. New ciphertext is written with it.
RESTREAM_ALLOW_PRIVATE_DESTINATIONSstringv0.3.0Allows multistream destinations that resolve to private addresses when set to true or 1.
RESTREAM_ALLOWED_PRIVATE_CIDRSstringv0.3.0Comma-separated CIDRs exempted from the private, loopback, and link-local multistream destination block.
RESTREAM_DENIED_CIDRSstringv0.3.0Comma-separated CIDRs never allowed as multistream destinations. Denials win over allowances.
PLAYBACK_WEBHOOK_ALLOW_PRIVATE_DESTINATIONSbooleanfalsev0.3.11Lets playback-auth webhook URLs use private (RFC 1918 / ULA) addresses, plain http, and .local host names, so an isolated staging or development cluster can authorize playback against a receiver on its own network. It never opens the platform itself: loopback, link-local, cloud metadata, the host’s own addresses, mesh-routed addresses, and *.internal names stay blocked. Must match Foghorn’s setting. Never set it on a cluster that serves untrusted tenants.
MEDIA_AUTHORITY_SIGNING_KEY_IDstringv0.3.0Key ID of the Ed25519 signer for media authority envelopes. Required outside development, together with MEDIA_AUTHORITY_SIGNING_PRIVATE_KEY_PEM_B64.
MEDIA_AUTHORITY_SIGNING_PRIVATE_KEY_PEM_B64stringsecretv0.3.0Base64-wrapped PKCS#8 Ed25519 private key PEM that signs media authority envelopes.
MEDIA_AUTHORITY_SEAL_RECIPIENTSstringv0.3.0Rendered by the CLI. Maps control-cell IDs to X25519 recipient keys and enables sealed-secret delivery in media authority.
NAVIGATOR_GRPC_ADDRstringv0.3.0Navigator gRPC address for tenant alias status. Empty disables tenant alias lookups.
PURSER_GRPC_ADDRstringpurser:19003v0.3.0Purser gRPC address for billing and user-limit checks.
DECKLOG_GRPC_ADDRstringdecklog:18006v0.3.0Decklog gRPC address for service events.
FOGHORN_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for Foghorn connections. Empty uses the canonical internal name.
NAVIGATOR_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Navigator connection. Empty uses the canonical internal name.
PURSER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Purser connection. Empty uses the canonical internal name.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Decklog connection. Empty uses the canonical internal name.
LISTMONK_URLstringv0.3.0Listmonk base URL. Together with LISTMONK_API_USERNAME and LISTMONK_API_TOKEN it enables newsletter subscription.
LISTMONK_API_USERNAMEstringv0.3.0Listmonk API user for newsletter subscription.
LISTMONK_API_TOKENstringsecretv0.3.0Listmonk API token for LISTMONK_API_USERNAME.
DEFAULT_MAILING_LIST_IDinteger1v0.3.0Listmonk list ID that newsletter subscriptions are added to.
TURNSTILE_AUTH_SECRET_KEYstringsecretv0.3.0Cloudflare Turnstile secret key for authentication bot checks. Empty disables Turnstile verification.
TURNSTILE_FAIL_OPENbooleanfalsev0.3.0Lets a request proceed when the Turnstile verification call itself fails. A rejected challenge is always refused.
PASSWORD_RESET_SECRETstringsecretv0.3.0HMAC key for hashing stored account tokens such as password reset tokens. Empty falls back to plain SHA-256.
CHANDLER_BASE_URLstringv0.3.0Public Chandler origin used for every thumbnail asset URL instead of the per-cluster Chandler origins learned from Quartermaster.
DEVICE_VERIFICATION_URLstringv0.3.0URL users visit to approve a device authorization code. Empty uses WEBAPP_PUBLIC_URL with /device appended. Re-read after an env-file reload.
PLATFORM_ROOT_DOMAINstringv0.3.0Root domain for the global ingest, edge, play, Chandler, and Livepeer host names returned on stream creation and for Mist admin edge domains. Empty falls back to BRAND_DOMAIN. Re-read after an env-file reload.
BRAND_DOMAINstringv0.3.0Root domain used when PLATFORM_ROOT_DOMAIN is empty. With both empty, global stream host names are omitted and Mist admin edge domains use frameworks.network. Re-read after an env-file reload.
SMTP_HOSTstringv0.3.0SMTP server for email verification and password reset messages. Empty skips sending them. Re-read after an env-file reload.
SMTP_PORTstring587v0.3.0SMTP server port. Re-read after an env-file reload.
SMTP_USERstringv0.3.0SMTP authentication user. Re-read after an env-file reload.
SMTP_PASSWORDstringsecretv0.3.0SMTP authentication password for SMTP_USER. Re-read after an env-file reload.
FROM_EMAILstring[email protected]v0.3.0Sender address for email verification and password reset messages. Re-read after an env-file reload.
FROM_NAMEstringv0.3.0Sender display name for email verification and password reset messages. Empty uses FrameWorks. Re-read after an env-file reload.
SMTP_ALLOW_INSECUREbooleanfalsev0.3.10Sends email verification and password reset messages to an SMTP server that does not offer STARTTLS. For an isolated development or test relay only; never set it in production. Re-read after an env-file reload.

bootstrap subcommand

Section titled “bootstrap subcommand”

Read by api_control/cmd/commodore.

VariableTypeDefaultNotesSinceDescription
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address for tenant, cluster, and registration calls.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
FIELD_ENCRYPTION_KEY_IDstringprimaryv0.3.0Non-secret label embedded in new ciphertext envelopes to name the active field-encryption key.
FIELD_ENCRYPTION_PREVIOUS_KEYSstringsecretv0.3.0JSON object of retired key IDs to master secrets, kept so existing ciphertext stays readable.
FIELD_ENCRYPTION_LEGACY_SECRETSstringsecretv0.3.0Read-only v1 and v2 master secrets for decrypting historical ciphertext. Never used for new writes.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
SYSTEM_TENANT_IDstringv0.3.0UUID of the Quartermaster-owned system tenant. Empty uses the reserved ID 00000000-0000-0000-0000-000000000001; a value that is not a UUID fails startup.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service token for resolving tenant aliases through Quartermaster.
JWT_SECRETstringsecretv0.3.0Included as legacy field-encryption key material for pull-stream source URIs. Required when the desired state declares pull streams.
FIELD_ENCRYPTION_KEYstringsecretv0.3.0Active field-encryption master secret. Required when the desired state declares pull streams.
PURSER_GRPC_ADDRstringpurser:19003v0.3.8Purser gRPC address for the node placement check that runs when a declared source location names nodes.
PURSER_GRPC_TLS_SERVER_NAMEstringv0.3.8TLS server name override for the Purser connection. Empty uses the canonical internal name.
FOGHORN_GRPC_TLS_SERVER_NAMEstringv0.3.8TLS server name override for the Foghorn connections of the node placement check. Empty uses the canonical internal name.

data-migrations subcommand

Section titled “data-migrations subcommand”

Read by api_control/cmd/commodore.

VariableTypeDefaultNotesSinceDescription
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
FIELD_ENCRYPTION_KEY_IDstringprimaryv0.3.0Non-secret label embedded in new ciphertext envelopes to name the active field-encryption key.
FIELD_ENCRYPTION_PREVIOUS_KEYSstringsecretv0.3.0JSON object of retired key IDs to master secrets, kept so existing ciphertext stays readable.
FIELD_ENCRYPTION_LEGACY_SECRETSstringsecretv0.3.0Read-only v1 and v2 master secrets for decrypting historical ciphertext. Never used for new writes.
FIELD_ENCRYPTION_KEYstringsecretv0.3.0Active field-encryption master secret that the field-encryption migration re-encrypts rows with. Required when that migration runs or verifies.
JWT_SECRETstringsecretv0.3.0Legacy field-encryption key for v1 and v2 ciphertext. Required by the field-encryption migration, which refuses to continue if it changes mid-run.
FIELD_ENCRYPTION_ALLOW_QUARANTINEstringv0.3.0Set to true or 1 to let field-encryption verification pass while undecryptable rows remain quarantined.
FIELD_ENCRYPTION_REQUEUE_QUARANTINEstringv0.3.0Operator-chosen token. A value different from the last one checkpointed restarts the field-encryption sweep and retries previously quarantined rows. Empty, 0, or false disables retries.
FIELD_ENCRYPTION_ACK_UNVERIFIED_LEGACY_KEYstringv0.3.0Set to I_ACCEPT_UNVERIFIED_LEGACY_KEY to start the field-encryption migration when no sampled v1 or v2 row decrypts with JWT_SECRET or the previous keys.

purser

Section titled “purser”

Read by api_billing/cmd/purser.

VariableTypeDefaultNotesSinceDescription
PORTstring18003v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GRPC_PORTstring19003v0.3.0TCP port for the gRPC listener.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
GEOIP_MMDB_PATHstringv0.3.0Path to an MMDB city database used for IP geolocation. Empty disables GeoIP lookups; a set path that cannot be opened logs a warning and disables lookups.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token for internal gRPC and HTTP calls.
JWT_SECRETstringrequired, secretv0.3.0HMAC secret that signs and verifies user session JWTs.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
USAGE_HASH_SECRETstringrequired, secretv0.3.11HMAC key for the user and API token hashes in API usage records. Bridge, Commodore, Purser, and Quartermaster must share one value, so the token hash a domain event records joins Bridge’s usage rows for the same token.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address for tenant, cluster access, and registration calls.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
BUILD_ENVstringv0.3.0Runtime environment selector. Empty, dev, or development enables development-only behavior; production or prod marks a production process.
EMAIL_LOGO_URLstringv0.3.10Absolute URL of the logo image in outgoing emails. Empty uses the light logomark served under WEBAPP_PUBLIC_URL.
WEBAPP_PUBLIC_URLstringv0.3.0Public base URL of the web application. Links in outgoing emails and notifications and redirects back to the web application are built from it, and it serves the default email logo when EMAIL_LOGO_URL is empty.
SUPPORT_EMAILstringv0.3.10Support mailbox shown in the footer of outgoing emails and set as Reply-To on the emails that carry one. Empty uses [email protected].
ETH_RPC_ENDPOINTstringsecretv0.3.0Ethereum mainnet JSON-RPC endpoint. Empty uses https://ethereum-rpc.publicnode.com. Re-read after an env-file reload.
BASE_RPC_ENDPOINTstringsecretv0.3.0Base mainnet JSON-RPC endpoint. Empty uses https://base.publicnode.com. Re-read after an env-file reload.
ARBITRUM_RPC_ENDPOINTstringsecretv0.3.0Arbitrum One JSON-RPC endpoint. Empty uses https://arb1.arbitrum.io/rpc, except for the Livepeer deposit monitor, which requires it. Re-read after an env-file reload.
BASE_SEPOLIA_RPC_ENDPOINTstringsecretv0.3.0Base Sepolia JSON-RPC endpoint. Empty uses https://base-sepolia.publicnode.com. Re-read after an env-file reload.
ARBITRUM_SEPOLIA_RPC_ENDPOINTstringsecretv0.3.0Arbitrum Sepolia JSON-RPC endpoint. Empty uses https://sepolia-rollup.arbitrum.io/rpc. Re-read after an env-file reload.
ETHERSCAN_API_KEYstringsecretv0.3.0Etherscan API key for block explorer transaction lookups by the crypto payment monitor on every network. Re-read after an env-file reload.
CRYPTO_TREASURY_ETHEREUMstringv0.3.0Non-zero Ethereum mainnet treasury address that custody sweeps send funds to. Required to advertise deposits in production. Re-read after an env-file reload.
CRYPTO_TREASURY_BASEstringv0.3.0Non-zero Base mainnet treasury address that custody sweeps send funds to. Required to advertise deposits and x402 in production. Re-read after an env-file reload.
CRYPTO_TREASURY_ARBITRUMstringv0.3.0Non-zero Arbitrum One treasury address that custody sweeps send funds to. Required to advertise deposits and x402 in production. Re-read after an env-file reload.
CRYPTO_TREASURY_BASE_SEPOLIAstringv0.3.0Non-zero Base Sepolia treasury address that custody sweeps send funds to. Re-read after an env-file reload.
CRYPTO_TREASURY_ARBITRUM_SEPOLIAstringv0.3.0Non-zero Arbitrum Sepolia treasury address that custody sweeps send funds to. Re-read after an env-file reload.
CRYPTO_SWEEP_RELAYER_PRIVATE_KEY_ETHEREUMstringsecretv0.3.0Hex private key of the dedicated gas relayer that submits USDC custody sweeps on Ethereum mainnet. Required to advertise deposits in production. Re-read after an env-file reload.
CRYPTO_SWEEP_RELAYER_PRIVATE_KEY_BASEstringsecretv0.3.0Hex private key of the dedicated gas relayer that submits USDC custody sweeps on Base mainnet. Required to advertise deposits and x402 in production. Re-read after an env-file reload.
CRYPTO_SWEEP_RELAYER_PRIVATE_KEY_ARBITRUMstringsecretv0.3.0Hex private key of the dedicated gas relayer that submits USDC custody sweeps on Arbitrum One. Required to advertise deposits and x402 in production. Re-read after an env-file reload.
CRYPTO_SWEEP_RELAYER_PRIVATE_KEY_BASE_SEPOLIAstringsecretv0.3.0Hex private key of the dedicated gas relayer that submits USDC custody sweeps on Base Sepolia. Re-read after an env-file reload.
CRYPTO_SWEEP_RELAYER_PRIVATE_KEY_ARBITRUM_SEPOLIAstringsecretv0.3.0Hex private key of the dedicated gas relayer that submits USDC custody sweeps on Arbitrum Sepolia. Re-read after an env-file reload.
CRYPTO_SCAN_START_BLOCK_ETHEREUMstringv0.3.0Ethereum mainnet block where the crypto deposit scanner starts when it has no cursor. Unset, a network with no issued deposit addresses starts at the safe head; a network that already has addresses but lost its cursor requires it in production and otherwise starts 1000 blocks behind the safe head.
CRYPTO_SCAN_START_BLOCK_BASEstringv0.3.0Base mainnet block where the crypto deposit scanner starts when it has no cursor. Unset, a network with no issued deposit addresses starts at the safe head; a network that already has addresses but lost its cursor requires it in production and otherwise starts 1000 blocks behind the safe head.
CRYPTO_SCAN_START_BLOCK_ARBITRUMstringv0.3.0Arbitrum One block where the crypto deposit scanner starts when it has no cursor. Unset, a network with no issued deposit addresses starts at the safe head; a network that already has addresses but lost its cursor requires it in production and otherwise starts 1000 blocks behind the safe head.
CRYPTO_SCAN_START_BLOCK_BASE_SEPOLIAstringv0.3.0Base Sepolia block where the crypto deposit scanner starts when it has no cursor. Unset, a network with no issued deposit addresses starts at the safe head; a network that already has addresses but lost its cursor requires it in production and otherwise starts 1000 blocks behind the safe head.
CRYPTO_SCAN_START_BLOCK_ARBITRUM_SEPOLIAstringv0.3.0Arbitrum Sepolia block where the crypto deposit scanner starts when it has no cursor. Unset, a network with no issued deposit addresses starts at the safe head; a network that already has addresses but lost its cursor requires it in production and otherwise starts 1000 blocks behind the safe head.
CRYPTO_DEPOSITS_ENABLEDbooleantruev0.3.0Emergency breaker for new direct crypto invoice payments and prepaid top-ups. Existing deposits keep reconciling while it is false. Re-read after an env-file reload.
X402_PAYMENTS_ENABLEDbooleantruev0.3.0Emergency breaker for advertising, verifying, and settling new x402 payments. Submitted settlements keep reconciling while it is false. Re-read after an env-file reload.
WAIVE_USAGE_CHARGESbooleanfalsev0.3.0Rates metered usage at zero while subscription base fees still charge, and skips the metering completeness requirement for invoices. Re-read after an env-file reload.
X402_INCLUDE_TESTNETSbooleanfalsev0.3.0Includes Base Sepolia and Arbitrum Sepolia in x402 payments, crypto deposits, and sweeps. Testnet x402 payments stay refused in production. Sweeps and readiness checks re-read it after an env-file reload; the x402 handler and monitors read it at startup.
GATEWAY_PUBLIC_URLstringv0.3.0Public Bridge URL. Mollie webhooks target its /webhooks/billing/mollie path and x402 resource URLs are built from it; Mollie card payments and production x402 require it. Re-read after an env-file reload.
PAYMENT_CARD_PROVIDERstringv0.3.0Card provider for invoice payments, stripe or mollie. Empty selects the one fully configured provider and is rejected when both are configured. A card provider is offered only when WEBAPP_PUBLIC_URL is set. Re-read after an env-file reload.
STRIPE_SECRET_KEYstringsecretv0.3.0Stripe API secret key. Enables the Stripe client and billing tier price sync at startup; checkout and provider availability re-read it after an env-file reload.
STRIPE_WEBHOOK_SECRETstringsecretv0.3.0Signing secret that verifies Stripe webhooks. Empty rejects every Stripe webhook. Re-read after an env-file reload.
MOLLIE_API_KEYstringsecretv0.3.0Mollie API key. Enables the Mollie client at startup; checkout and provider availability re-read it after an env-file reload.
SUPPLIER_NAMEstringv0.3.0Supplier legal name on billing documents and crypto invoices. Outside development Purser refuses to start without the complete SUPPLIER_* set, since every invoice, statement and credit note states it.
SUPPLIER_ADDRESSstringv0.3.0Supplier postal address on billing documents and crypto invoices.
SUPPLIER_VAT_NUMBERstringv0.3.0Supplier VAT number on billing documents and crypto invoices.
SUPPLIER_REGISTRATION_NUMBERstringv0.3.0Supplier company registration number on billing documents and crypto invoices.
SUPPLIER_COUNTRYstringv0.3.0Supplier country, normalized to a two-letter country code, for crypto invoices and crypto deposit readiness.
VIES_ENDPOINTstringv0.3.0EU VIES SOAP endpoint that validates customer VAT numbers. Empty uses the European Commission service. Re-read after an env-file reload.
HD_WALLET_XPUBstringsecretv0.3.0Extended public key that initializes HD wallet deposit address state at startup when the database has none. A different stored key is kept and the mismatch is logged.
X402_GAS_WALLET_PRIVKEYstringsecretv0.3.0Hex private key of the gas wallet that submits self-facilitated x402 settlements and funds Livepeer TicketBroker deposits.
X402_GAS_WALLET_ADDRESSstringv0.3.0Gas wallet address. Empty derives it from X402_GAS_WALLET_PRIVKEY; a mismatch blocks self-facilitated x402 and the Livepeer deposit monitor.
X402_TOPUP_USD_CENTSinteger500v0.3.0Minimum amount in US cents an x402 quote asks for; a larger prepaid deficit plus buffer raises it. A value outside 1 to 10000 logs a warning and uses 500.
X402_PREPAID_BUFFER_EUR_CENTSinteger500v0.3.0Euro cents of prepaid credit an x402 quote adds on top of any negative balance. Zero or negative uses 500. Re-read after an env-file reload.
X402_FACILITATOR_PROVIDERstringv0.3.0x402 facilitator. self settles through the gas wallet, cdp uses the Coinbase CDP facilitator, and hosted uses X402_FACILITATOR_URL. Empty means self.
X402_FACILITATOR_URLstringv0.3.0HTTPS base URL of the cdp or hosted x402 facilitator. Empty uses the Coinbase CDP URL for cdp.
CDP_API_KEY_IDstringv0.3.0Coinbase CDP API key ID for the cdp x402 facilitator.
CDP_API_KEY_SECRETstringsecretv0.3.0Coinbase CDP API key secret for the cdp x402 facilitator. Literal backslash-n sequences are converted to newlines.
X402_RECOVERY_WINDOW_HOURSinteger168v0.3.0Hours back the x402 reconciler looks for failed settlements to recover. Zero or negative uses 168.
X402_REORG_DEPTH_BLOCKSinteger50v0.3.0Blocks the x402 reconciler waits past a settlement block before treating a missing receipt as reorganized. Zero or negative uses 50.
X402_RPC_ERROR_LIMITinteger5v0.3.0Consecutive RPC errors per network after which the x402 reconciler logs a warning and emits a billing event. Zero or negative uses 5.
LIVEPEER_DEPOSIT_LOW_THRESHOLDstring0.1v0.3.0ETH TicketBroker deposit and reserve level below which the Livepeer deposit monitor funds a gateway. An unparsable value logs a warning and uses 0.1.
LIVEPEER_TOPUP_AMOUNTstring0.2v0.3.0ETH amount the Livepeer deposit monitor sends per TicketBroker funding. An unparsable value logs a warning and uses 0.2.
LIVEPEER_FUNDING_DAILY_CAPstring1v0.3.0Maximum ETH the Livepeer deposit monitor spends on TicketBroker funding per day. An unparsable or non-positive value logs a warning and uses 1.
CRYPTO_SWEEP_ETH_DUST_WEIstring100000000000000v0.3.0Wei left in each ETH source address when a custody sweep is planned. An unparsable or negative value uses 100000000000000. Re-read after an env-file reload.
SMTP_HOSTstringv0.3.0SMTP server for billing notification emails. Emails are sent only when SMTP_HOST, SMTP_USER, SMTP_PASSWORD, and FROM_EMAIL are set.
SMTP_PORTinteger587v0.3.0SMTP server port for billing notification emails. 0 uses 587.
SMTP_USERstringv0.3.0SMTP user for billing notification emails.
SMTP_PASSWORDstringsecretv0.3.0Password for SMTP_USER.
FROM_EMAILstringv0.3.0Sender address of billing notification emails.
FROM_NAMEstringv0.3.0Sender display name of billing notification emails. Empty uses FrameWorks.
SMTP_ALLOW_INSECUREbooleanfalsev0.3.10Sends billing notification emails to an SMTP server that does not offer STARTTLS. For an isolated development or test relay only; never set it in production.
KAFKA_BROKERSlistkafka:9092v0.3.0Comma-separated Kafka bootstrap brokers for the billing usage report consumer.
KAFKA_CLUSTER_IDstringlocalv0.3.0Kafka cluster identifier passed to the billing usage report consumer.
KAFKA_CLIENT_IDstringpurserv0.3.0Kafka client ID of the billing usage report consumer.
KAFKA_GROUP_IDstringpurser-ingestv0.3.0Kafka consumer group of the billing usage report consumer.
BILLING_KAFKA_TOPICstringbilling.usage_reportsv0.3.0Kafka topic the billing usage report consumer reads.
REGIONstringv0.3.0Region label attached to service events sent to Decklog.
PURSER_HOSTstringpurserv0.3.0Host name this instance advertises when it registers with Quartermaster.
CLUSTER_ACCESS_MATERIALIZATION_SECRETstringrequired, secretv0.3.0Shared with Quartermaster. Signs the commercial and owner grant materialization and revocation envelopes Purser sends to Quartermaster. Read at startup; a rotation takes effect when Purser and Quartermaster restart.
COMMODORE_GRPC_ADDRstringcommodore:19001v0.3.0Commodore gRPC address for stream termination and cache invalidation when balances or suspensions change.
PERISCOPE_GRPC_ADDRstringperiscope-query:19004v0.3.0Periscope Query gRPC address for invoice usage enrichment such as unique viewer counts and geographic breakdowns.
DECKLOG_GRPC_ADDRstringdecklog:18006v0.3.0Decklog gRPC address for service events.
COMMODORE_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Commodore connection. Empty uses the canonical internal name.
PERISCOPE_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Periscope Query connection. Empty uses the canonical internal name.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Decklog connection. Empty uses the canonical internal name.
LIVEPEER_DEPOSIT_MONITOR_ENABLEDbooleanfalsev0.3.0Starts the Livepeer TicketBroker deposit monitor, which funds low gateway deposits on Arbitrum from the X402_GAS_WALLET_PRIVKEY wallet. When true, an invalid wallet key or ARBITRUM_RPC_ENDPOINT stops startup.

bootstrap subcommand

Section titled “bootstrap subcommand”

Read by api_billing/cmd/purser.

VariableTypeDefaultNotesSinceDescription
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address for tenant, cluster access, and registration calls.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
SERVICE_TOKENstringsecretv0.3.0Shared service token for Quartermaster calls. Required when the desired state declares customer_billing.

bootstrap-validate subcommand

Section titled “bootstrap-validate subcommand”

Read by api_billing/cmd/purser.

VariableTypeDefaultNotesSinceDescription
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address for tenant, cluster access, and registration calls.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service token for listing clusters through Quartermaster.

data-migrations subcommand

Section titled “data-migrations subcommand”

Read by api_billing/cmd/purser.

VariableTypeDefaultNotesSinceDescription
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.

quartermaster

Section titled “quartermaster”

Read by api_tenants/cmd/quartermaster.

VariableTypeDefaultNotesSinceDescription
PORTstring18002v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GRPC_PORTstring19002v0.3.0TCP port for the gRPC listener.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
GEOIP_MMDB_PATHstringv0.3.0Path to an MMDB city database used for IP geolocation. Empty disables GeoIP lookups; a set path that cannot be opened logs a warning and disables lookups.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token for internal gRPC and HTTP calls.
JWT_SECRETstringrequired, secretv0.3.0HMAC secret that signs and verifies user session JWTs.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
USAGE_HASH_SECRETstringrequired, secretv0.3.11HMAC key for the user and API token hashes in API usage records. Bridge, Commodore, Purser, and Quartermaster must share one value, so the token hash a domain event records joins Bridge’s usage rows for the same token.
REGIONstringv0.3.0Region label attached to service events sent to Decklog.
QUARTERMASTER_HOSTstringquartermasterv0.3.0Host name this instance advertises when it registers itself.
QUARTERMASTER_HTTP_TLS_CERT_FILEstringv0.3.0Certificate for serving the HTTP listener over TLS. Set together with QUARTERMASTER_HTTP_TLS_KEY_FILE.
QUARTERMASTER_HTTP_TLS_KEY_FILEstringv0.3.0Private key for QUARTERMASTER_HTTP_TLS_CERT_FILE.
CLUSTER_ACCESS_MATERIALIZATION_SECRETstringrequired, secretv0.3.0Shared with Purser. Authenticates the commercial and owner grant materialization and revocation envelopes. Read at startup; a rotation takes effect when Purser and Quartermaster restart.
CAPACITY_CONSENT_REVIEW_KEY_IDstringv0.3.0Key ID of the Ed25519 key that signs capacity consent reviews. Set together with CAPACITY_CONSENT_REVIEW_PRIVATE_KEY_PEM_B64.
CAPACITY_CONSENT_REVIEW_PRIVATE_KEY_PEM_B64stringsecretv0.3.0Base64-wrapped PKCS#8 Ed25519 private key PEM that signs capacity consent reviews.
BRAND_DOMAINstringframeworks.networkv0.3.0Platform root domain used to build public service host names.
NAVIGATOR_DNS_HEALTH_STALE_SECONDSinteger300v0.3.0Age in seconds after which a physical endpoint health report is too old to publish. Navigator reads the same key so both apply one freshness gate.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0gRPC address this instance advertises and dials for its own registration.
NAVIGATOR_GRPC_ADDRstringv0.3.0Navigator gRPC address. Empty disables DNS features.
DECKLOG_GRPC_ADDRstringdecklog:18006v0.3.0Decklog gRPC address for service events.
PURSER_GRPC_ADDRstringpurser:19003v0.3.0Purser gRPC address for billing status lookups.
COMMODORE_GRPC_ADDRstringcommodore:19001v0.3.0Commodore gRPC address for media authority refresh delivery.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the self-registration connection and for gRPC health watches of Quartermaster instances. Empty uses the canonical internal name.
NAVIGATOR_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Navigator connection and for gRPC health watches of Navigator instances. Empty uses the canonical internal name.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Decklog connection and for gRPC health watches of Decklog instances. Empty uses the canonical internal name.
PURSER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Purser connection and for gRPC health watches of Purser instances. Empty uses the canonical internal name.
COMMODORE_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Commodore connection and for gRPC health watches of Commodore instances. Empty uses the canonical internal name.
FOGHORN_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for gRPC health watches of Foghorn instances. Empty uses foghorn.internal.
PERISCOPE_QUERY_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for gRPC health watches of Periscope Query instances. Empty uses periscope-query.internal.
SIGNALMAN_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for gRPC health watches of Signalman instances. Empty uses signalman.internal.
DECKHAND_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for gRPC health watches of Deckhand instances. Empty uses deckhand.internal.
SKIPPER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for gRPC health watches of Skipper instances. Empty uses skipper.internal.
LOOKOUT_GRPC_TLS_SERVER_NAMEstringv0.3.8TLS server name override for gRPC health watches of Lookout instances. Empty uses lookout.internal.
BOSUN_GRPC_TLS_SERVER_NAMEstringv0.3.11TLS server name override for gRPC health watches of Bosun instances. Empty uses bosun.internal.
QM_HEALTH_POLL_INTERVAL_SECONDSinteger30v0.3.0Seconds between health poll rounds over registered service instances, varied by up to 25 percent. Must be positive.
QM_HEALTH_TIMEOUT_MSinteger2000v0.3.0HTTP client timeout in milliseconds for health probes. Each probe is also capped at 2 seconds, and 0 leaves only that cap.
QM_HEALTH_MAX_CONCURRENCYinteger8v0.3.0Maximum concurrent HTTP health probes. Zero or negative uses 8.
QM_HEALTH_BATCH_SIZEinteger200v0.3.0Maximum service instances probed in one poll round. Zero or negative uses 200.
QM_HEALTH_MIN_AGE_SECONDSstringv0.3.0Minimum age in seconds of an instance’s last health result before it is probed again. Empty or negative uses QM_HEALTH_POLL_INTERVAL_SECONDS.
QM_HEALTH_GRPC_WATCHbooleantruev0.3.0Keeps a gRPC health Watch stream open to each registered gRPC instance so status changes are recorded as they happen.
QM_HEALTH_WATCH_REFRESH_SECONDSinteger60v0.3.0Seconds between refreshes of the set of watched gRPC instances. Must be positive when QM_HEALTH_GRPC_WATCH is true.
QM_HEALTH_WATCH_BACKOFF_SECONDSinteger300v0.3.0Seconds an instance is skipped after its gRPC health watch cannot be set up or is not implemented.
QM_HEALTH_WATCH_DIAL_TIMEOUT_MSinteger2000v0.3.0Minimum connect timeout in milliseconds for a gRPC health watch connection.
QM_HEALTH_WATCH_MAX_CONCURRENCYintegerv0.3.0Maximum concurrent gRPC health watch streams. Unset, zero, or negative uses QM_HEALTH_MAX_CONCURRENCY.

bootstrap subcommand

Section titled “bootstrap subcommand”

Read by api_tenants/cmd/quartermaster.

VariableTypeDefaultNotesSinceDescription
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
GEOIP_MMDB_PATHstringv0.3.0Path to an MMDB city database used for IP geolocation. Empty disables GeoIP lookups; a set path that cannot be opened logs a warning and disables lookups.

decklog

Section titled “decklog”

Read by api_firehose/cmd/decklog.

VariableTypeDefaultNotesSinceDescription
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
PORTstring18006v0.3.0TCP port for the gRPC listener that receives events. Also the port registered with Quartermaster.
DECKLOG_METRICS_PORTstring18026v0.3.0TCP port for the HTTP listener that serves health, readiness, and metrics.
SERVICE_TOKENstringrequired, secretv0.3.0Service token required on incoming gRPC calls and sent on Quartermaster calls.
KAFKA_BROKERSlistrequiredv0.3.0Comma-separated Kafka bootstrap brokers that receive published events.
KAFKA_CLUSTER_IDstringrequiredv0.3.0Kafka cluster identifier attached to the producer client.
ANALYTICS_KAFKA_TOPICstringanalytics_eventsv0.3.0Default Kafka topic for analytics events.
SERVICE_EVENTS_KAFKA_TOPICstringservice_eventsv0.3.0Kafka topic for service events.
DECKLOG_RAW_TRIGGERS_TOPICstringv0.3.0Kafka topic that journals the original MistTrigger envelope of final and accounting triggers. Empty uses analytics.raw_mist_triggers; - disables the journal.
REGIONstringv0.3.0Region label backfilled onto events that arrive without a source region. Takes precedence over REGION_ID and DECKLOG_SOURCE_REGION.
REGION_IDstringv0.3.0Region label backfilled onto events without a source region when REGION is empty.
DECKLOG_SOURCE_REGIONstringv0.3.0Region label backfilled onto events without a source region when REGION and REGION_ID are empty.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address used for service registration.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
DECKLOG_HOSTstringdecklogv0.3.0Host name this instance advertises when it registers with Quartermaster.

signalman

Section titled “signalman”

Read by api_realtime/cmd/signalman.

VariableTypeDefaultNotesSinceDescription
PORTstring18009v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GRPC_PORTstring19005v0.3.0TCP port for the gRPC listener.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token for internal gRPC and HTTP calls.
JWT_SECRETstringrequired, secretv0.3.0HMAC secret that signs and verifies user session JWTs.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
KAFKA_BROKERSlistrequiredv0.3.0Comma-separated Kafka bootstrap brokers for the event consumer and the DLQ producer.
KAFKA_CLUSTER_IDstringrequiredv0.3.0Kafka cluster identifier attached to the consumer and DLQ producer clients.
KAFKA_GROUP_IDstringsignalman-groupv0.3.0Kafka consumer group. Each replica needs its own group so every replica receives every event for fan-out.
KAFKA_CLIENT_IDstringsignalmanv0.3.0Kafka client ID of the event consumer.
KAFKA_CONSUME_RESET_OFFSETstringlatestv0.3.0Where a consumer group without committed offsets starts. latest (case-insensitive) skips retained history; any other value starts from the Kafka client default.
ANALYTICS_KAFKA_TOPICstringanalytics_eventsv0.3.0Kafka topic of analytics events fanned out to subscribers.
SERVICE_EVENTS_KAFKA_TOPICstringservice_eventsv0.3.0Kafka topic of service events fanned out to subscribers.
DECKLOG_DLQ_KAFKA_TOPICstringdecklog_events_dlqv0.3.0Kafka topic that receives events whose fan-out handler failed.
MIRROR_REGION_PREFIXESlistv0.3.0Comma-separated MirrorMaker2 source cluster aliases whose mirrored analytics and service event topics are also consumed. Empty consumes only local topics.
SIGNALMAN_MAX_CONNECTIONS_PER_TENANTinteger0v0.3.0Maximum concurrent Subscribe streams per tenant. 0 or less disables the limit.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address used for service registration.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
SIGNALMAN_HOSTstringsignalmanv0.3.0Host name this instance advertises when it registers with Quartermaster.

periscope-ingest

Section titled “periscope-ingest”

Read by api_analytics_ingest/cmd/periscope.

VariableTypeDefaultNotesSinceDescription
PORTstring18005v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLICKHOUSE_ADDRlistrequiredv0.3.0Comma-separated ClickHouse native protocol host:port addresses.
CLICKHOUSE_DBstringrequiredv0.3.0ClickHouse database that holds the analytics tables.
CLICKHOUSE_USERstringrequiredv0.3.0ClickHouse user for this service.
CLICKHOUSE_PASSWORDstringrequired, secretv0.3.0Password for CLICKHOUSE_USER.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
SERVICE_TOKENstringrequired, secretv0.3.0Service token sent on Quartermaster calls and required by the /debug endpoints.
KAFKA_BROKERSlistrequiredv0.3.0Comma-separated Kafka bootstrap brokers for the event consumer and the DLQ producer.
KAFKA_CLUSTER_IDstringrequiredv0.3.0Kafka cluster identifier attached to the consumer and DLQ producer clients.
KAFKA_GROUP_IDstringperiscope-ingestv0.3.0Kafka consumer group shared by Periscope Ingest replicas.
KAFKA_CLIENT_IDstringperiscope-ingestv0.3.0Kafka client ID of the event consumer.
ANALYTICS_KAFKA_TOPICstringanalytics_eventsv0.3.0Kafka topic of analytics events projected into ClickHouse.
SERVICE_EVENTS_KAFKA_TOPICstringservice_eventsv0.3.0Kafka topic of service events projected into ClickHouse.
DECKLOG_DLQ_KAFKA_TOPICstringdecklog_events_dlqv0.3.0Kafka topic that receives analytics and service events whose handler failed with a non-retryable error.
RAW_MIST_TRIGGERS_KAFKA_TOPICstringanalytics.raw_mist_triggersv0.3.0Kafka topic of raw MistTrigger envelopes projected into raw_mist_triggers. - disables consumption on this instance.
MIRROR_REGION_PREFIXESlistv0.3.0Comma-separated MirrorMaker2 source cluster aliases. The mirrored copy of every consumed topic, including the raw MistTrigger topic, is also consumed for each alias. Empty consumes only local topics.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address used for service registration.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
PERISCOPE_INGEST_HOSTstringperiscope-ingestv0.3.0Host name this instance advertises when it registers with Quartermaster.
ENABLE_HEALTH_ENDPOINTbooleantruedeprecated in v0.3.0v0.3.0Ignored. The HTTP listener that serves health, readiness, and metrics always runs.

periscope-metering

Section titled “periscope-metering”

Read by api_analytics_query/cmd/periscope-metering.

VariableTypeDefaultNotesSinceDescription
PORTstring18021v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
SYSTEM_TENANT_IDstringv0.3.0UUID of the Quartermaster-owned system tenant. Empty uses the reserved ID 00000000-0000-0000-0000-000000000001; a value that is not a UUID fails startup.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLICKHOUSE_ADDRlistrequiredv0.3.0Comma-separated ClickHouse native protocol host:port addresses.
CLICKHOUSE_DBstringrequiredv0.3.0ClickHouse database that holds the analytics tables.
CLICKHOUSE_USERstringrequiredv0.3.0ClickHouse user for this service.
CLICKHOUSE_PASSWORDstringrequired, secretv0.3.0Password for CLICKHOUSE_USER.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service token for Quartermaster tenant lookups. Also guards the /debug endpoints.
KAFKA_BROKERSlistrequiredv0.3.0Comma-separated Kafka bootstrap brokers that receive billing usage reports.
METERING_SOURCE_IDstringrequiredv0.3.0Durable identity of the metered dataset, recorded on leases, cursors, and usage reports. Lowercase letters, digits, dot, underscore, and dash, at most 128 characters.
METERING_SOURCE_REGIONstringrequiredv0.3.0Region of the metered dataset recorded on usage reports. Lowercase letters, digits, dot, underscore, and dash, at most 64 characters.
METERING_WORKER_IDstringv0.3.0Lease owner ID of this replica. Empty uses the host name plus a random UUID, so the owner changes on restart.
BILLING_KAFKA_TOPICstringbilling.usage_reportsv0.3.0Kafka topic that usage reports are published to.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address used to resolve a tenant’s primary cluster.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle used to verify the Quartermaster gRPC server.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows a plaintext Quartermaster connection when no TLS material is configured. Development only.

periscope-query

Section titled “periscope-query”

Read by api_analytics_query/cmd/periscope.

VariableTypeDefaultNotesSinceDescription
PORTstring18004v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GRPC_PORTstring19004v0.3.0TCP port for the gRPC listener.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token for internal gRPC and HTTP calls.
JWT_SECRETstringrequired, secretv0.3.0HMAC secret that signs and verifies user session JWTs.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLICKHOUSE_ADDRlistrequiredv0.3.0Comma-separated ClickHouse native protocol host:port addresses.
CLICKHOUSE_DBstringrequiredv0.3.0ClickHouse database that holds the analytics tables.
CLICKHOUSE_USERstringrequiredv0.3.0ClickHouse user for this service.
CLICKHOUSE_PASSWORDstringrequired, secretv0.3.0Password for CLICKHOUSE_USER.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address used for service registration.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
PERISCOPE_QUERY_HOSTstringperiscope-queryv0.3.0Host name this instance advertises when it registers with Quartermaster.

chandler

Section titled “chandler”

Read by api_assets/cmd/chandler.

VariableTypeDefaultNotesSinceDescription
PORTstring18020v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
SERVICE_TOKENstringsecretv0.3.0Service token for Quartermaster calls and the bearer required by the internal cache-invalidation endpoint. Empty leaves that endpoint unregistered and disables /debug.
QUARTERMASTER_GRPC_ADDRstringv0.3.0Quartermaster gRPC address for the cluster storage lookup and registration. Empty joins QUARTERMASTER_HOST and QUARTERMASTER_GRPC_PORT.
QUARTERMASTER_HOSTstringquartermasterv0.3.0Quartermaster host used when QUARTERMASTER_GRPC_ADDR is empty.
QUARTERMASTER_GRPC_PORTstring19002v0.3.0Quartermaster gRPC port used when QUARTERMASTER_GRPC_ADDR is empty.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
CHANDLER_HOSTstringchandlerv0.3.0Host name this instance advertises when it registers with Quartermaster.
STORAGE_S3_BUCKETstringv0.3.0S3 bucket served without a CLUSTER_ID when CHANDLER_DEV_ALLOW_ENV_S3 is true. With a CLUSTER_ID the Quartermaster cluster row supplies the bucket.
STORAGE_S3_PREFIXstringv0.3.0Object key prefix paired with STORAGE_S3_BUCKET. With a CLUSTER_ID the Quartermaster cluster row supplies the prefix.
STORAGE_S3_REGIONstringus-east-1v0.3.0S3 region paired with STORAGE_S3_BUCKET. With a CLUSTER_ID the Quartermaster cluster row supplies the region.
STORAGE_S3_ENDPOINTstringv0.3.0S3-compatible endpoint paired with STORAGE_S3_BUCKET, addressed path-style. With a CLUSTER_ID the Quartermaster cluster row supplies the endpoint.
STORAGE_S3_ACCESS_KEYstringsecretv0.3.0Static S3 access key. Used together with STORAGE_S3_SECRET_KEY; otherwise the AWS default credential chain applies.
STORAGE_S3_SECRET_KEYstringsecretv0.3.0Static S3 secret key paired with STORAGE_S3_ACCESS_KEY.
CHANDLER_DEV_ALLOW_ENV_S3booleanfalsev0.3.0Serves the STORAGE_S3_* descriptor when CLUSTER_ID is empty. Without it a cluster-less instance refuses to serve an env bucket. Development only.
CACHE_MAX_BYTESinteger52428800v0.3.0Maximum total size in bytes of the in-memory object cache.
CACHE_TTL_SECONDSinteger30v0.3.0Seconds an object stays in the in-memory cache before it is fetched again.

foghorn

Section titled “foghorn”

Read by api_balancing/cmd/foghorn.

VariableTypeDefaultNotesSinceDescription
PORTstring18008v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
SYSTEM_TENANT_IDstringv0.3.0UUID of the Quartermaster-owned system tenant. Empty uses the reserved ID 00000000-0000-0000-0000-000000000001; a value that is not a UUID fails startup.
GEOIP_MMDB_PATHstringv0.3.0Path to an MMDB city database used for IP geolocation. Empty disables GeoIP lookups; a set path that cannot be opened logs a warning and disables lookups.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
BUILD_ENVstringv0.3.0Runtime environment selector. Empty, dev, or development enables development-only behavior; production or prod marks a production process.
REDIS_URLstringsecretv0.3.0Redis URL for state shared between Foghorn replicas. Used when REDIS_MODE is empty; empty with no REDIS_MODE runs without shared state.
REDIS_MODEstringv0.3.0Redis topology for the shared state client: single, sentinel, or cluster. Empty uses REDIS_URL. sentinel marks this instance as an HA replica: startup waits for the topology and exits if Redis or the HA command relay cannot be enabled, and a relay that is not ready reports unhealthy.
REDIS_ADDRSlistv0.3.0Comma-separated Redis, Sentinel, or cluster host:port addresses used when REDIS_MODE is set.
REDIS_MASTER_NAMEstringv0.3.0Sentinel master name. Required when REDIS_MODE is sentinel.
REDIS_USERNAMEstringv0.3.0Username for the Redis data connection when REDIS_MODE is set.
REDIS_PASSWORDstringsecretv0.3.0Password for the Redis data connection when REDIS_MODE is set.
REDIS_SENTINEL_USERNAMEstringv0.3.0Username for the Sentinel connection when REDIS_MODE is sentinel.
REDIS_SENTINEL_PASSWORDstringsecretv0.3.0Password for the Sentinel connection when REDIS_MODE is sentinel.
FOGHORN_PUBLIC_HTTP_BIND_ADDRstringv0.3.0Bind address of the public HTTP listener on PORT that serves playback, ingest, and Livepeer webhook routes. Empty listens on all interfaces.
FOGHORN_INTERNAL_HTTP_PORTstring18027v0.3.0TCP port of the internal HTTP listener that serves node administration, the dashboard, debug routes, and authenticated Mist source lookups.
FOGHORN_INTERNAL_HTTP_BIND_ADDRstring127.0.0.1v0.3.0Bind address of the internal HTTP listener.
FOGHORN_INTERNAL_GRPC_BIND_ADDRstring:18019v0.3.0host:port of the internal gRPC listener for mesh services, federation, and the HA command relay. It serves GRPC_TLS_CERT_PATH.
FOGHORN_EXTERNAL_GRPC_BIND_ADDRstring:18029v0.3.0host:port of the external gRPC listener for Helmsman control streams and edge provisioning. It serves Navigator-issued cluster certificates.
FOGHORN_INTERNAL_GRPC_PORTintegerv0.3.0gRPC port this instance registers with Quartermaster. 0 or unset uses the port of FOGHORN_INTERNAL_GRPC_BIND_ADDR.
FOGHORN_HOSTstringv0.3.0Host name registered with Quartermaster, used for the HA relay address when FOGHORN_RELAY_ADVERTISE_HOST is empty, and a fallback host for Mist balancer URLs.
FOGHORN_RELAY_ADVERTISE_ADDRstringv0.3.0host:port other replicas use to relay commands to this one. Overrides FOGHORN_RELAY_ADVERTISE_HOST and the port derived from FOGHORN_INTERNAL_GRPC_BIND_ADDR.
FOGHORN_RELAY_ADVERTISE_HOSTstringv0.3.0Host other replicas use to relay commands to this one, combined with the internal gRPC port. Production refuses a loopback fallback when no host is known.
FOGHORN_PUBLIC_BASEstringv0.3.0HTTP base URL Mist uses as its balancer source. Overrides the cluster-scoped Foghorn DNS name.
FOGHORN_URLstringv0.3.0Foghorn base URL for Mist balancer sources when no cluster DNS name applies. Preferred over the cluster DNS name when BUILD_ENV is dev, development, local, or test.
DECKLOG_GRPC_ADDRstringdecklog:18006v0.3.0Decklog gRPC address for trigger, routing, artifact, and federation events.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address for registration, cluster descriptors, served cluster assignments, and edge health.
COMMODORE_GRPC_ADDRstringcommodore:19001v0.3.0Commodore gRPC address for stream resolution and media authority replay.
PURSER_GRPC_ADDRstringpurser:19003v0.3.0Purser gRPC address for x402 settlement and billing checks.
NAVIGATOR_GRPC_ADDRstringv0.3.0Navigator gRPC address for cluster TLS bundles and ConfigSeed apply acknowledgements. Empty disables TLS bundle seeding.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Decklog connection. Empty uses the canonical internal name.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
COMMODORE_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Commodore connection. Empty uses the canonical internal name.
PURSER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Purser connection. Empty uses the canonical internal name.
NAVIGATOR_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Navigator connection. Empty uses the canonical internal name.
FOGHORN_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for connections to other Foghorn instances for federation and the HA command relay. Empty uses the canonical internal name.
COMMODORE_CACHE_TTLduration60sv0.3.0Freshness window of cached Commodore responses.
COMMODORE_CACHE_SWRduration30sv0.3.0Stale-while-revalidate window of cached Commodore responses.
COMMODORE_CACHE_NEG_TTLduration10sv0.3.0Lifetime of cached Commodore not-found responses.
COMMODORE_CACHE_MAXinteger10000v0.3.0Maximum cached Commodore responses. 0 or less uses 10000.
GEOIP_CACHE_TTLduration300sv0.3.0Freshness window of cached GeoIP lookups when a GeoIP database is loaded.
GEOIP_CACHE_SWRduration120sv0.3.0Stale-while-revalidate window of cached GeoIP lookups.
GEOIP_CACHE_NEG_TTLduration60sv0.3.0Lifetime of cached failed GeoIP lookups.
GEOIP_CACHE_MAXinteger50000v0.3.0Maximum cached GeoIP lookups. 0 or less uses 50000.
STREAM_CACHE_SWRstring30sv0.3.0Stale-while-revalidate duration of the trigger stream context cache. Values that are not durations use 30s.
BILLING_CACHE_SWRstring5mv0.3.0Stale-while-revalidate duration of the tenant billing decision cache. Values that are not durations use 5m.
BILLING_DENIED_CACHE_TTLstring30sv0.3.0Lifetime of a cached denied billing decision. Values that are not positive durations use 30s.
FOGHORN_REGISTRY_STALE_MAXstringv0.3.0How long past expiry a stream registry entry may be served while re-resolution fails transiently. 0 disables stale serving; empty keeps 5m; invalid or negative values log a warning and keep 5m.
STORAGE_S3_BUCKETstringv0.3.0S3 bucket for durable artifacts and thumbnails. When set, S3 must initialize and match the cell’s committed backend identity or startup fails.
STORAGE_S3_PREFIXstringv0.3.0Key prefix inside STORAGE_S3_BUCKET for this cell.
STORAGE_S3_REGIONstringus-east-1v0.3.0Region of STORAGE_S3_BUCKET.
STORAGE_S3_ENDPOINTstringv0.3.0S3-compatible endpoint URL. Empty uses the AWS endpoint for the region.
STORAGE_S3_ACCESS_KEYstringsecretv0.3.0Access key ID for STORAGE_S3_BUCKET. Credentials stay in Foghorn; edge nodes receive presigned URLs.
STORAGE_S3_SECRET_KEYstringsecretv0.3.0Secret access key for STORAGE_S3_ACCESS_KEY.
STORAGE_MODEstringv0.3.0Set to none to start a storage-less cell without STORAGE_S3_BUCKET. Otherwise a storage-less start requires Quartermaster to confirm the cluster has no S3 backend.
FOGHORN_DEFAULT_STORAGE_BASEstringv0.3.0Absolute local storage path used to rebuild DVR paths for nodes that report none. Must match HELMSMAN_STORAGE_LOCAL_PATH.
MEDIA_AUTHORITY_CELL_IDstringv0.3.0Control cell whose signed media authority this instance applies and requests replays for. Empty uses CLUSTER_ID; required when MEDIA_AUTHORITY_TRUST_SET is set.
MEDIA_AUTHORITY_TRUST_SETstringv0.3.0JSON object mapping trusted media authority signer key IDs to base64 raw Ed25519 public keys. Empty disables signed media authority apply and placement enforcement.
MEDIA_AUTHORITY_SEAL_KEY_IDstringv0.3.0Key ID of the private key that opens sealed secrets in media authority. Set together with MEDIA_AUTHORITY_SEAL_PRIVATE_KEY_PEM_B64.
MEDIA_AUTHORITY_SEAL_PRIVATE_KEY_PEM_B64stringsecretv0.3.0Base64-wrapped PKCS#8 PRIVATE KEY PEM that opens sealed secrets in media authority.
FOGHORN_INGEST_REJECT_OVER_ALLOWANCE_LOADstring0.5v0.3.0Cluster load between 0 and 1 above which over-allowance free-tier ingest is rejected. Values outside the open range use 0.5.
FOGHORN_INGEST_REJECT_FREE_LOADstring0.95v0.3.0Cluster load between 0 and 1 above which any free-tier ingest is rejected. Values outside the open range use 0.95.
FOGHORN_VIEWER_REJECT_OVER_ALLOWANCE_LOADstring0.8v0.3.0Cluster load between 0 and 1 above which over-allowance free-tier viewers are rejected. Values outside the open range use 0.8.
FOGHORN_VIEWER_REJECT_FREE_LOADstring0.95v0.3.0Cluster load between 0 and 1 above which any free-tier viewer is rejected. Values outside the open range use 0.95.
INGEST_RESOLVE_RATE_PER_MINstring60v0.3.0Per-client-IP refill rate of the unauthenticated ingest resolver, in requests per minute. Re-read on every request; values below 1 use 1.
INGEST_RESOLVE_BURSTstring10v0.3.0Per-client-IP burst of the ingest resolver rate limit. Re-read on every request; values below 1 use 1.
INGEST_RESOLVE_MAX_BUCKETSstring50000v0.3.0Maximum client IPs tracked by the ingest resolver rate limit before the least recently used is evicted.
TRUSTED_PROXY_CIDRSstringv0.3.0Comma-separated CIDRs or IPs of reverse proxies whose forwarding headers identify the client for rate limiting and routing. Re-read on every request.
LIVEPEER_VOD_DEADLINE_MSstring30000v0.3.0Per-segment gateway response budget in milliseconds stamped onto VOD Livepeer process configs. Values that are not positive integers use 30000.
LIVEPEER_VOD_MIN_SPEEDstring0.5v0.3.0Minimum sustained speed factor stamped onto VOD Livepeer process configs. Values that are not positive numbers use 0.5.
DVR_CLUSTER_MAX_WINDOW_SECONDSinteger0v0.3.0Cluster ceiling for DVR window length in seconds, applied on top of tier ceilings. 0 applies no cluster ceiling.
DVR_CLUSTER_MAX_ENTRIESinteger0v0.3.0Cluster ceiling for DVR playlist entries, applied on top of tier ceilings. 0 applies no cluster ceiling.
CHANDLER_BASE_URLstringv0.3.0Single local Chandler origin for every asset URL. Empty derives per-cluster Chandler origins from Quartermaster.
CHANDLER_INTERNAL_URLstringv0.3.0Comma-separated in-cell Chandler base URLs that receive thumbnail cache invalidations. Empty uses the Chandler base URL.
CHANDLER_HOSTstringchandlerv0.3.0Chandler host for the http fallback origin when no base URL is configured or derived.
CHANDLER_PORTstring18020v0.3.0Chandler port for the http fallback origin.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token for control-plane clients, internal gRPC, internal HTTP reads, the debug surface, and Chandler invalidations.
JWT_SECRETstringsecretv0.3.0HMAC secret that verifies platform operator JWTs on internal HTTP routes and node lifecycle gRPC methods. Empty leaves those routes to the service token only.
GRPC_METADATA_POLICYstringdenyv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
FOGHORN_BALANCER_CAPABILITY_SECRETstringrequired, secretv0.3.0HMAC secret that signs and verifies Mist balancer, source pull, processing source, and Livepeer transcode job capabilities.
FOGHORN_STATE_ENCRYPTION_KEYstringrequired, secretv0.3.0Secret from which the key that encrypts durable ingest admission push-target payloads is derived.
EDGE_TELEMETRY_JWT_PRIVATE_KEY_PEM_B64stringsecretv0.3.0Base64-wrapped EC private key PEM, SEC 1 or PKCS#8, that signs edge telemetry write tokens. Empty sends edge nodes no telemetry configuration.
CLUSTER_IDstringv0.3.0Media cluster this instance serves. Empty uses default for local state, registration, and storage identity; events and trigger enrichment carry the value as set.
NODE_IDstringv0.3.0Node this instance registers under in Quartermaster and records in trigger events.
REGIONstringv0.3.0Region label attached to events sent to Decklog.
FOGHORN_INSTANCE_IDstringv0.3.0Stable replica identity for HA state sync, leases, and served cluster assignments. Empty generates a per-process identity and skips served cluster assignment loading.
FOGHORN_PLATFORM_SHARED_CLUSTERSlistv0.3.0Comma-separated cluster IDs whose tenantless nodes may serve any tenant’s durable media, in addition to Quartermaster platform-official clusters.
BRAND_DOMAINstringframeworks.networkv0.3.0Platform root domain for cluster-scoped Foghorn, edge, telemetry, and certificate host names.
ACME_EMAILstringv0.3.0Contact email sent to edge nodes in their site configuration for ACME certificate issuance.
PLAYBACK_WEBHOOK_ALLOW_PRIVATE_DESTINATIONSbooleanfalsev0.3.11Lets playback-auth webhook calls connect to private (RFC 1918 / ULA) addresses, so an isolated staging or development cluster can authorize playback against a receiver on its own network. It never opens the platform itself: loopback, link-local, cloud metadata, the host’s own addresses, and mesh-routed addresses stay blocked. Must match Commodore’s setting. Never set it on a cluster that serves untrusted tenants.
FEDERATION_ENABLEDstringfalsev0.3.0Enables cross-cluster federation when exactly true; any other value leaves it off. Requires Quartermaster, an active platform-official cluster, Redis, and authenticated TLS.
FEDERATION_ALLOW_INSECURE_DEVbooleanfalsev0.3.0Allows federation together with GRPC_ALLOW_INSECURE. Isolated development only.
CPU_WEIGHTinteger500v0.3.0Load balancer CPU score weight. The five balancer weights apply only when all are greater than 0.
RAM_WEIGHTinteger500v0.3.0Load balancer memory score weight.
BANDWIDTH_WEIGHTinteger1000v0.3.0Load balancer bandwidth score weight.
GEO_WEIGHTinteger1000v0.3.0Load balancer geographic distance score weight.
STREAM_BONUSinteger50v0.3.0Load balancer score bonus for a node that already carries the stream.
EDGE_RELEASE_RECONCILE_INTERVAL_SECONDSinteger60v0.3.0Seconds between edge release reconciliation passes against Quartermaster.
FOGHORN_RESTART_RECONNECT_WINDOW_SECONDSinteger20v0.3.0Seconds an announced node restart keeps node health before the disconnect counts as unhealthy, clamped to 5 through 30. Read at startup.

data-migrations subcommand

Section titled “data-migrations subcommand”

Read by api_balancing/cmd/foghorn.

VariableTypeDefaultNotesSinceDescription
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.

helmsman

Section titled “helmsman”

Read by api_sidecar/cmd/helmsman.

VariableTypeDefaultNotesSinceDescription
PORTstring18007v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Unknown values keep the current log level.
MIST_API_USERNAMEstringtestv0.3.0MistServer API user for every Helmsman MistServer API client.
MIST_API_PASSWORDstringtestsecretv0.3.0Password for MIST_API_USERNAME.
HELMSMAN_STORAGE_LOCAL_PATHstringv0.3.0Local media storage root. Empty disables the storage manager, artifact relay, and artifact scans; artifact path lookups then use /var/lib/frameworks/edge-storage.
HELMSMAN_STORAGE_S3_BUCKETstringv0.3.0Cold storage bucket name reported to Foghorn in node registration and lifecycle updates. Helmsman holds no storage credentials.
HELMSMAN_STORAGE_S3_PREFIXstringv0.3.0Cold storage key prefix reported to Foghorn in node registration and lifecycle updates.
HELMSMAN_STORAGE_CAPACITY_BYTESstring0v0.3.0Logical storage capacity in bytes, reported to Foghorn and applied to disk-space accounting. 0 or a value that is not an unsigned integer uses the filesystem size.
HELMSMAN_CAP_INGESTstringtruev0.3.0Advertises the ingest role. Registration treats a value that is not a boolean as true; node lifecycle updates count only true or 1 as enabled.
HELMSMAN_CAP_EDGEstringtruev0.3.0Advertises the edge playback role. Registration treats a value that is not a boolean as true; node lifecycle updates count only true or 1 as enabled.
HELMSMAN_CAP_STORAGEstringtruev0.3.0Advertises the storage role. Registration treats a value that is not a boolean as true; node lifecycle updates count only true or 1 as enabled.
HELMSMAN_CAP_PROCESSINGstringtruev0.3.0Advertises the processing role. Registration treats a value that is not a boolean as true; node lifecycle updates count only true or 1 as enabled.
HELMSMAN_MAX_TRANSCODESstring0v0.3.0Video transcode slots a processing node advertises. 0 or a value that is not an integer advertises no ceiling.
HELMSMAN_WEBHOOK_URLstringhttp://localhost:18007v0.3.0Base URL of the Helmsman webhook routes that the managed MistServer trigger configuration points at.
HELMSMAN_RELAY_BASE_URLstringhttp://127.0.0.1:18007v0.3.0URL MistServer on this node uses to reach the Helmsman artifact relay. Set it only when MistServer reaches Helmsman through a service name.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that verifies Foghorn on the control connection and where Helmsman writes the CA bundle delivered in the config seed. Empty uses the system roots for the connection and /etc/frameworks/pki/ca.crt for the written bundle.
HELMSMAN_TLS_CERT_PATHstring/etc/frameworks/certs/cert.pemv0.3.0Path where Helmsman writes the edge TLS certificate delivered in the config seed.
HELMSMAN_TLS_KEY_PATHstring/etc/frameworks/certs/key.pemv0.3.0Path where Helmsman writes the private key for HELMSMAN_TLS_CERT_PATH.
HELMSMAN_TLS_BUNDLE_DIRstring/etc/frameworks/certs/bundlesv0.3.0Directory where Helmsman writes the per-bundle TLS certificate and key files delivered in the config seed.
CADDY_TLS_GROUPstringv0.3.0Group name or numeric ID given to written TLS files so Caddy can read them. Empty tries the caddy group, then the group of the parent directory.
CADDY_ADMIN_SOCKETstringv0.3.0Unix socket of the Caddy admin API used for config reloads and restarts. Takes precedence over CADDY_ADMIN_URL.
CADDY_ADMIN_URLstringv0.3.0Caddy admin API address used when CADDY_ADMIN_SOCKET is empty. Empty uses localhost:2019.
CADDY_CONFIG_PATHstring/etc/caddy/Caddyfilev0.3.0Caddyfile that Helmsman writes and posts to the Caddy admin API on reload.
CHANDLER_URLstringchandler:18020v0.3.0Chandler host:port that the Caddyfile rendered from the config seed reverse-proxies to.
MISTSERVER_HTTP_URLstringhttp://mistserver:8080v0.3.0MistServer HTTP output URL that the rendered Caddyfile reverse-proxies to. An http:// prefix is stripped.
HELMSMAN_BW_LIMIT_BYTES_PER_SECstringv0.3.0Operator-pinned node bandwidth limit in bytes per second, written to MistServer and reported to Foghorn. Takes precedence over the other bandwidth limit keys.
HELMSMAN_BW_LIMIT_BYTESstringv0.3.0Node bandwidth limit in bytes per second, used when HELMSMAN_BW_LIMIT_BYTES_PER_SEC is empty or 0.
HELMSMAN_BW_LIMIT_MBPSstringv0.3.0Node bandwidth limit in megabits per second, used when neither byte-based bandwidth limit key is set.
HELMSMAN_SUPERVISORstringv0.3.0Process supervisor used for in-place component updates: s6, systemd, or launchd. Any other value detects s6 supervision, then uses launchd on macOS and systemd elsewhere.
DEPLOY_MODEstringnativev0.3.0Deployment mode reported to Foghorn. A value other than native without s6 supervision refuses in-place component updates.
MIST_ONNX_PROFILEstringcpuv0.3.0ONNX runtime profile of the bundled MistServer, reported to Foghorn in node lifecycle updates.
FRAMEWORKS_TRIGGER_WAL_DIRstringv0.3.0Directory of the durable Mist trigger WAL. Empty uses trigger-wal under HELMSMAN_STATE_DIR.
FRAMEWORKS_INGEST_GENERATION_STORE_PATHstringv0.3.0Directory of the ingest generation fence store. Empty uses ingest-generation-fences under HELMSMAN_STATE_DIR.
FRAMEWORKS_CONTROL_OUTBOX_DIRstringv0.3.0Directory of the durable control outbox. Empty uses control-outbox under HELMSMAN_STATE_DIR, or the user cache directory when that is empty.
RESTREAM_ALLOW_PRIVATE_DESTINATIONSstringv0.3.0Allows multistream destinations that resolve to private addresses when set to true or 1.
RESTREAM_ALLOWED_PRIVATE_CIDRSstringv0.3.0Comma-separated CIDRs exempted from the private, loopback, and link-local multistream destination block.
RESTREAM_DENIED_CIDRSstringv0.3.0Comma-separated CIDRs never allowed as multistream destinations. Denials win over allowances. An invalid entry fails startup and, after a reload, push target activation.
HELMSMAN_VERSIONstringv0.3.0Helmsman version reported to Foghorn when no component version has been recorded on disk.
MIST_VERSIONstringv0.3.0MistServer version reported to Foghorn when no component version has been recorded on disk.
MISTSERVER_VERSIONstringv0.3.0MistServer version reported to Foghorn when MIST_VERSION and the recorded versions are empty.
CADDY_VERSIONstringv0.3.0Caddy version reported to Foghorn when no component version has been recorded on disk.
CONFIG_SCHEMA_VERSIONstringv0.3.0Edge configuration schema version reported to Foghorn when no version has been recorded on disk.
FRAMEWORKS_CONFIG_SCHEMA_VERSIONstringv0.3.0Edge configuration schema version reported to Foghorn when CONFIG_SCHEMA_VERSION and the recorded versions are empty.
GIN_MODEstringreleasev0.3.0Router mode. Helmsman runs on media nodes, so release is the default: Gin release mode, with CORS restricted to ALLOWED_ORIGINS. debug runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
NODE_IDstringrequiredv0.3.0Node identity registered with Foghorn and stamped on triggers. A persisted config seed that belongs to another node is refused.
FOGHORN_CONTROL_ADDRstringrequiredv0.3.0Foghorn control-stream gRPC address of the node’s cell: one host:port, or a comma-separated list of the cell’s Foghorn instances. Names are resolved before every dial and each address they resolve to is an instance. A refused, lost, or going-away connection moves to the next instance at once; backoff applies only after every instance failed in a row. The node keeps serving throughout.
MISTSERVER_URLstringrequiredv0.3.0Local MistServer API base URL used for the health check, the Mist admin proxy, stream control, and DTSH generation.
EDGE_PUBLIC_URLstringrequiredv0.3.0Client-facing edge URL reported to Foghorn as the playback base URL and written to the MistServer protocol public addresses.
HELMSMAN_STATE_DIRstringrequiredv0.3.0Durable sidecar state directory for node identity, the persisted config seed, the trigger WAL, the control outbox, and ingest generation fences.
FOGHORN_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Foghorn control connection. Empty uses the host of each public FOGHORN_CONTROL_ADDR entry, otherwise the canonical internal name. Set it when the entries are IP addresses of instances that serve a named certificate.
GRPC_TLS_CERT_PATHstringv0.3.0Client certificate presented on the Foghorn control connection. Used only together with GRPC_TLS_KEY_PATH.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
GRPC_ALLOW_INSECUREstringfalsev0.3.0Allows a plaintext Foghorn control connection when no TLS material is configured and the address is not a fully qualified name. A value that is not a boolean counts as false.
EDGE_ENROLLMENT_TOKENstringsecretv0.3.0Enrollment token presented to Foghorn when the node has no durable identity or rotates it.
HELMSMAN_ROTATE_NODE_IDENTITYstringfalsev0.3.0Requests a node identity rotation with EDGE_ENROLLMENT_TOKEN at startup. A value that is not a boolean counts as false.
HELMSMAN_ENROLLMENT_TOKEN_FILEstringv0.3.0Env file whose EDGE_ENROLLMENT_TOKEN is cleared after Foghorn accepts the enrollment.
HELMSMAN_RUNTIME_ENV_FILEstringv0.3.0Env file whose HELMSMAN_ROTATE_NODE_IDENTITY is cleared after Foghorn accepts the enrollment.
HELMSMAN_FREEZE_THRESHOLDstring0.85v0.3.0Usage fraction of the media storage space at which the storage manager starts freezing local artifacts to cold storage. The media storage space is the filesystem minus a fixed 10 GiB system reserve, further capped by HELMSMAN_STORAGE_CAPACITY_BYTES when set. A value that is not a number counts as 0.
HELMSMAN_TARGET_AFTER_FREEZEstring0.70v0.3.0Usage fraction of the media storage space the storage manager frees space down to once freezing starts. A value that is not a number counts as 0.
HELMSMAN_RELAY_TRUSTED_CIDRstringv0.3.0Comma-separated CIDRs whose direct peers reach the artifact relay like loopback. Invalid entries are ignored with a warning. Leave empty unless MistServer reaches Helmsman over a non-loopback address.
HELMSMAN_BLOCKING_GRACE_MSstring2000v0.3.0Milliseconds a blocking Mist trigger waits for the Foghorn control stream to reconnect before failing. A value that is not an integer uses 2000.
HELMSMAN_OPERATIONAL_MODEstringnormalv0.3.0Operational mode requested at registration: normal, draining, or maintenance. Foghorn stays authoritative and may override it.
HELMSMAN_BIND_ADDRstringv0.3.0Bind address of the edge API, MistServer webhook, and artifact relay listener on PORT. Empty binds all interfaces.
HELMSMAN_MANAGEMENT_PORTstring18017v0.3.0TCP port of the management listener that serves node mode, trigger WAL, and Prometheus node routes.
HELMSMAN_MANAGEMENT_BIND_ADDRstring127.0.0.1v0.3.0Bind address of the management listener. Must be a loopback address or localhost.

scrub-edge-credentials subcommand

Section titled “scrub-edge-credentials subcommand”

Read by api_sidecar/cmd/helmsman.

VariableTypeDefaultNotesSinceDescription
HELMSMAN_STATE_DIRstringv0.3.0Durable sidecar state directory that holds the credential cleanup request and completion markers.
NODE_IDstringv0.3.0Node identity whose accepted enrollment the cleanup request must match.
HELMSMAN_ENROLLMENT_TOKEN_FILEstringv0.3.0Env file whose EDGE_ENROLLMENT_TOKEN is cleared.
HELMSMAN_RUNTIME_ENV_FILEstringv0.3.0Env file whose HELMSMAN_ROTATE_NODE_IDENTITY is cleared.

lookout

Section titled “lookout”

Read by api_incidents/cmd/lookout.

VariableTypeDefaultNotesSinceDescription
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
EMAIL_LOGO_URLstringv0.3.10Absolute URL of the logo image in outgoing emails. Empty uses the light logomark served under WEBAPP_PUBLIC_URL.
WEBAPP_PUBLIC_URLstringv0.3.0Public base URL of the web application. Links in outgoing emails and notifications and redirects back to the web application are built from it, and it serves the default email logo when EMAIL_LOGO_URL is empty.
SUPPORT_EMAILstringv0.3.10Support mailbox shown in the footer of outgoing emails and set as Reply-To on the emails that carry one. Empty uses [email protected].
LOOKOUT_PORTstring18022v0.3.8TCP port for the HTTP listener that serves the Alertmanager webhook, health, readiness, and metrics. PORT overrides it.
PORTstringv0.3.8TCP port for the HTTP listener. Takes precedence over LOOKOUT_PORT when set.
LOOKOUT_GRPC_PORTstring19008v0.3.8TCP port for the gRPC listener that serves the incident API. Also the port registered with Quartermaster.
LOOKOUT_HOSTstringlookoutv0.3.8Host name this instance advertises when it registers with Quartermaster.
REGIONstringv0.3.8Region label attached to incident events sent to Decklog.
SERVICE_TOKENstringrequired, secretv0.3.8Service token accepted on incoming gRPC calls and sent to Quartermaster and Decklog.
JWT_SECRETstringsecretv0.3.8HMAC secret that verifies user JWTs on incoming gRPC calls. Empty accepts only the service token.
LOOKOUT_ALERTMANAGER_TOKENstringrequired, secretv0.3.8Bearer token Alertmanager presents on the /v1/alertmanager webhook. Re-read after an env-file reload.
QUARTERMASTER_GRPC_ADDRstringrequiredv0.3.8Quartermaster gRPC address for cluster ownership lookups and service registration.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.8TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
DECKLOG_GRPC_ADDRstringrequiredv0.3.8Decklog gRPC address for realtime incident events.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.8TLS server name override for the Decklog connection. Empty uses the canonical internal name.
KAFKA_BROKERSlistrequiredv0.3.8Comma-separated bootstrap brokers of the aggregator Kafka cluster. Lookout publishes the incident topic there and consumes the local service events topic.
KAFKA_CLUSTER_IDstringlocalv0.3.8Kafka cluster identifier attached to the incident producer and the service events consumer.
LOOKOUT_NOTIFY_EMAIL_TOlistv0.3.8Comma-separated operator addresses that receive critical incident emails. Empty disables the email channel. Re-read after an env-file reload.
LOOKOUT_SLACK_WEBHOOK_URLstringsecretv0.3.8Slack incoming webhook URL for incident and operator activity notifications. Empty disables the Slack channel. Re-read after an env-file reload.
LOOKOUT_DISCORD_WEBHOOK_URLstringsecretv0.3.8Discord webhook URL for incident and operator activity notifications. Empty disables the Discord channel. Re-read after an env-file reload.
SMTP_HOSTstringv0.3.8SMTP server host for incident emails. Empty fails every email delivery. Re-read after an env-file reload.
SMTP_PORTstring587v0.3.8SMTP server port for incident emails. Re-read after an env-file reload.
SMTP_USERstringv0.3.8SMTP user for incident emails. Re-read after an env-file reload.
SMTP_PASSWORDstringsecretv0.3.8Password for SMTP_USER. Re-read after an env-file reload.
FROM_EMAILstring[email protected]v0.3.8Sender address for incident emails. Re-read after an env-file reload.
FROM_NAMEstringFrameWorksv0.3.8Sender display name for incident emails. Re-read after an env-file reload.
SMTP_ALLOW_INSECUREbooleanfalsev0.3.10Sends incident emails to an SMTP server that does not offer STARTTLS. For an isolated development or test relay only; never set it in production. Re-read after an env-file reload.
Section titled “navigator”

Read by api_dns/cmd/navigator.

VariableTypeDefaultNotesSinceDescription
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
BUILD_ENVstringv0.3.0Runtime environment selector. Empty, dev, or development enables development-only behavior; production or prod marks a production process.
PORTstringv0.3.0TCP port for the HTTP listener. Takes precedence over NAVIGATOR_PORT when set.
NAVIGATOR_PORTstringrequiredv0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and the internal TLS bundle endpoint. PORT overrides it.
NAVIGATOR_GRPC_PORTstringrequiredv0.3.0TCP port for the Navigator gRPC listener. Also the port registered with Quartermaster.
NAVIGATOR_HTTP_TLS_CERT_FILEstringv0.3.0Certificate for serving the HTTP listener over TLS. Set together with NAVIGATOR_HTTP_TLS_KEY_FILE.
NAVIGATOR_HTTP_TLS_KEY_FILEstringv0.3.0Private key for NAVIGATOR_HTTP_TLS_CERT_FILE.
NAVIGATOR_HOSTstringnavigatorv0.3.0Host name this instance advertises when it registers with Quartermaster.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token. Authenticates gRPC callers, the internal TLS bundle endpoint, and Navigator calls to Quartermaster.
FIELD_ENCRYPTION_KEYstringrequired, secretv0.3.0Key material from which Navigator derives the encryption key for stored certificate and CA private keys.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address for cluster, node, and bootstrap token lookups and self-registration.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
DECKLOG_GRPC_ADDRstringdecklog:18006v0.3.11Decklog gRPC address that receives custom domain domain events from Navigator’s outbox. Events wait in the outbox while Decklog is unreachable.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.11TLS server name override for the Decklog connection. Empty uses the canonical internal name.
REGIONstringv0.3.11Region label attached to domain events sent to Decklog. Empty lets Decklog stamp its own region.
BRAND_DOMAINstringrequiredv0.3.0Platform root domain whose DNS records and certificates Navigator manages. Also the certificate allowlist when NAVIGATOR_CERT_ALLOWED_SUFFIXES is empty; that use follows an env-file reload.
ACME_EMAILstringrequiredv0.3.0Contact email for the ACME accounts that issue platform certificates.
ACME_ENVstringv0.3.0ACME environment. staging uses the staging directories of Let’s Encrypt and Google Trust Services; any other value uses production. Re-read after an env-file reload.
NAVIGATOR_ACME_CA_ORDERstringv0.3.0Comma-separated CA preference order for new certificates (letsencrypt, google-trust). Empty uses Let’s Encrypt, then Google Trust Services when EAB credentials are set. Re-read after an env-file reload.
NAVIGATOR_GOOGLE_TRUST_DIRECTORY_URLstringv0.3.0ACME directory URL for Google Trust Services. Empty uses the public directory for the ACME_ENV environment. Re-read after an env-file reload.
NAVIGATOR_GOOGLE_TRUST_EAB_KIDstringv0.3.0External Account Binding key ID for Google Trust Services. Set together with NAVIGATOR_GOOGLE_TRUST_EAB_HMAC_KEY. Re-read after an env-file reload.
NAVIGATOR_GOOGLE_TRUST_EAB_HMAC_KEYstringsecretv0.3.0External Account Binding HMAC key for Google Trust Services. Re-read after an env-file reload.
NAVIGATOR_CERT_ALLOWED_SUFFIXESstringv0.3.0Comma-separated domain suffixes Navigator may issue certificates for. Empty falls back to BRAND_DOMAIN. Re-read after an env-file reload.
NAVIGATOR_PROXY_SERVICESstringv0.3.0Comma-separated service types whose Cloudflare records are proxied. Empty uses the built-in list of web surfaces; livepeer-gateway is never proxied.
CLOUDFLARE_API_TOKENstringrequired, secretv0.3.0Cloudflare API token for DNS records and load balancers. Also used for ACME DNS-01 challenges when CLOUDFLARE_DNS_API_TOKEN is empty.
CLOUDFLARE_ZONE_IDstringrequiredv0.3.0Cloudflare zone ID of the platform root domain.
CLOUDFLARE_ACCOUNT_IDstringrequiredv0.3.0Cloudflare account ID that owns the load balancer pools and monitors.
CLOUDFLARE_DNS_API_TOKENstringsecretv0.3.0Cloudflare token the ACME DNS-01 provider uses. Empty is filled from CLOUDFLARE_API_TOKEN at startup.
BUNNY_API_KEYstringsecretv0.3.0Bunny API key for media cluster and tenant alias DNS zones. Empty makes media cluster DNS fall back to Cloudflare.
BUNNY_API_BASE_URLstringv0.3.0Bunny API base URL. Empty uses the public Bunny API.
NAVIGATOR_DNS_TTL_A_RECORDinteger60v0.3.0TTL in seconds for the DNS records Navigator publishes outside Cloudflare load balancers.
NAVIGATOR_DNS_TTL_LBinteger60v0.3.0TTL in seconds for Cloudflare load balancer records.
NAVIGATOR_DNS_HEALTH_STALE_SECONDSinteger300v0.3.0Age in seconds after which a node health report is too old to publish in DNS. Quartermaster reads the same key so both apply one freshness gate.
NAVIGATOR_CF_MONITOR_INTERVALinteger60v0.3.0Interval in seconds between Cloudflare load balancer monitor probes.
NAVIGATOR_CF_MONITOR_TIMEOUTinteger5v0.3.0Timeout in seconds for one Cloudflare load balancer monitor probe.
NAVIGATOR_CF_MONITOR_RETRIESinteger2v0.3.0Retries before a Cloudflare load balancer monitor marks an origin unhealthy.
NAVIGATOR_DNS_RECONCILE_INTERVAL_SECONDSinteger60v0.3.0Interval in seconds between full DNS and certificate reconcile passes.
NAVIGATOR_DNS_RECORDS_ENABLEDbooleantruev0.3.11Publish public DNS records. Disable for isolated staging while retaining certificate management.
NAVIGATOR_ALIAS_APPLY_STATE_INTERVAL_SECONDSinteger15v0.3.0Interval in seconds between tenant alias DNS passes over the per-edge apply state.
NAVIGATOR_INTERNAL_CA_ROOT_CERT_FILEstringv0.3.0Root certificate file imported as the internal CA when none is stored. Set together with the intermediate certificate and key files.
NAVIGATOR_INTERNAL_CA_INTERMEDIATE_CERT_FILEstringv0.3.0Intermediate certificate file imported with NAVIGATOR_INTERNAL_CA_ROOT_CERT_FILE.
NAVIGATOR_INTERNAL_CA_INTERMEDIATE_KEY_FILEstringv0.3.0Intermediate private key file imported with NAVIGATOR_INTERNAL_CA_ROOT_CERT_FILE.
NAVIGATOR_INTERNAL_CA_ROOT_CERT_PEM_B64stringv0.3.0Base64-wrapped root certificate PEM imported as the internal CA when none is stored. Takes precedence over the file settings; set together with the intermediate certificate and key.
NAVIGATOR_INTERNAL_CA_INTERMEDIATE_CERT_PEM_B64stringv0.3.0Base64-wrapped intermediate certificate PEM imported with NAVIGATOR_INTERNAL_CA_ROOT_CERT_PEM_B64.
NAVIGATOR_INTERNAL_CA_INTERMEDIATE_KEY_PEM_B64stringsecretv0.3.0Base64-wrapped intermediate private key PEM imported with NAVIGATOR_INTERNAL_CA_ROOT_CERT_PEM_B64.

privateer

Section titled “privateer”

Read by api_mesh/cmd/privateer.

VariableTypeDefaultNotesSinceDescription
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
PORTstringv0.3.0TCP port for the HTTP health and metrics listener. Takes precedence over PRIVATEER_PORT when set.
PRIVATEER_PORTstring18012v0.3.0TCP port for the HTTP listener that serves health, readiness, and metrics. PORT overrides it.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token for mesh sync with Quartermaster and certificate calls to Navigator.
MESH_PRIVATE_KEY_FILEstringrequiredv0.3.0Path of the WireGuard private key. When the file is missing and MESH_JOIN_TOKEN is set, enrollment generates and writes it.
PRIVATEER_DATA_DIRstringv0.3.0Directory for enrollment state and the last known mesh. Empty uses /var/lib/privateer.
QUARTERMASTER_GRPC_ADDRstringv0.3.0Quartermaster gRPC address for mesh sync, or a comma-separated list of every Quartermaster replica; syncs fail over between them. Empty uses the address from persisted enrollment state; startup fails when neither is set.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
NAVIGATOR_GRPC_ADDRstringv0.3.0Navigator gRPC address for internal and ingress certificate sync. Empty disables certificate sync.
NAVIGATOR_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Navigator connection. Empty uses the canonical internal name.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle for verifying Quartermaster and Navigator. When the file is missing it is written from the NAVIGATOR_INTERNAL_CA_*_CERT_PEM_B64 values.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext gRPC to Quartermaster and Navigator when no CA bundle is configured. Development only.
PRIVATEER_STATIC_PEERS_FILEstringv0.3.0Seed peers file applied before the first Quartermaster sync. Empty uses the path from persisted enrollment state; enrollment writes /etc/privateer/static-peers.json when empty.
MESH_WIREGUARD_IPstringv0.3.0Mesh address of this node. Empty uses the address from persisted enrollment state; startup fails when neither is set.
MESH_LISTEN_PORTintegerv0.3.0UDP port of the WireGuard interface. Empty uses the port from persisted enrollment state, then 51820.
MESH_INTERFACEstringv0.3.0WireGuard interface name. Empty uses wg0.
MESH_NODE_TYPEstringv0.3.0Node type reported to Quartermaster and sent at enrollment. Empty uses core.
MESH_NODE_NAMEstringv0.3.0Node name reported to Quartermaster and sent at enrollment. Empty uses the host name.
NODE_IDstringv0.3.0Node identity for mesh sync and certificate issuance. Empty uses persisted enrollment state, then a generated ID stored on disk.
CLUSTER_IDstringv0.3.0Cluster this node belongs to; also the target cluster requested at enrollment. Empty uses persisted enrollment state; startup fails when neither is set.
MESH_EXTERNAL_IPstringv0.3.0Public address reported to Quartermaster and sent at enrollment.
MESH_INTERNAL_IPstringv0.3.0Private network address reported to Quartermaster and sent at enrollment.
PRIVATEER_SYNC_INTERVALduration30sv0.3.0Interval between mesh sync calls to Quartermaster.
PRIVATEER_SYNC_TIMEOUTduration10sv0.3.0Timeout for one mesh sync call to Quartermaster.
DNS_PORTinteger53v0.3.0Port of the internal DNS server, which listens on 127.0.0.1 over UDP and TCP.
UPSTREAM_DNSlistv0.3.0Comma-separated resolvers for names outside .internal. Entries without a port use 53. Empty answers those queries with REFUSED.
CERT_ISSUANCE_TOKENstringsecretv0.3.0Initial token for requesting internal service certificates from Navigator. Privateer mints replacements when it expires or is rejected.
GRPC_TLS_PKI_DIRstring/etc/frameworks/pkiv0.3.0Directory where synced internal service certificates and keys are written.
EXPECTED_INTERNAL_GRPC_SERVICESlistv0.3.0Comma-separated service types that need internal certificates on this node, in addition to those registered in Quartermaster.
PRIVATEER_CERT_SYNC_INTERVALduration5mv0.3.0Interval between internal and ingress certificate sync passes.
NAVIGATOR_INTERNAL_CA_ROOT_CERT_PEM_B64stringv0.3.0Base64-wrapped internal root certificate PEM written into GRPC_TLS_CA_PATH when that file is missing.
NAVIGATOR_INTERNAL_CA_INTERMEDIATE_CERT_PEM_B64stringv0.3.0Base64-wrapped internal intermediate certificate PEM written into GRPC_TLS_CA_PATH with the root certificate.
MESH_JOIN_TOKENstringsecretv0.3.0One-time enrollment token. Used only when MESH_PRIVATE_KEY_FILE does not exist yet.
BRIDGE_BOOTSTRAP_ADDRstringv0.3.0Bridge address for enrollment. Required when MESH_JOIN_TOKEN is used; an address without a scheme uses https.
FRAMEWORKS_BOOTSTRAP_INSECUREbooleanfalsev0.3.0Skips TLS verification of the Bridge enrollment request. Development and test only.

deckhand

Section titled “deckhand”

Read by api_ticketing/cmd/deckhand.

VariableTypeDefaultNotesSinceDescription
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
DECKHAND_PORTstring18015v0.3.0TCP port for the HTTP listener that serves the Chatwoot webhook, health, readiness, and metrics. Also the port registered with Quartermaster.
PORTstringdeprecated in v0.3.0, use DECKHAND_PORTv0.3.0Overrides DECKHAND_PORT for the HTTP listener and the registered port when set.
DECKHAND_GRPC_PORTstring19006v0.3.0TCP port for the gRPC listener that serves the support messaging API.
SERVICE_TOKENstringrequired, secretv0.3.0Service token accepted on incoming gRPC calls and sent to Quartermaster, Purser, and Decklog.
JWT_SECRETstringsecretv0.3.0HMAC secret that verifies user JWTs on incoming gRPC calls. Empty accepts only the service token.
CHATWOOT_API_TOKENstringrequired, secretv0.3.0Chatwoot API access token used for conversation and message calls.
CHATWOOT_HOSTstringchatwootv0.3.0Chatwoot host. Deckhand calls http://CHATWOOT_HOST:CHATWOOT_PORT.
CHATWOOT_PORTstring3000v0.3.0Chatwoot HTTP port paired with CHATWOOT_HOST.
CHATWOOT_ACCOUNT_IDinteger1v0.3.0Chatwoot account that holds support conversations.
CHATWOOT_INBOX_IDinteger1v0.3.0Chatwoot inbox in which new support conversations are created.
DECKHAND_WEBHOOK_RATE_LIMIT_PER_MINinteger600v0.3.0Chatwoot webhook requests allowed per client per minute. 0 or less disables the limit.
REDIS_ADDRstringv0.3.0Redis address for Chatwoot webhook deduplication. Empty or unreachable disables deduplication.
REGIONstringv0.3.0Region label attached to service events sent to Decklog.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address for tenant lookups, service events, and registration.
PURSER_GRPC_ADDRstringpurser:19003v0.3.0Purser gRPC address for billing context lookups.
DECKLOG_GRPC_ADDRstringdecklog:18006v0.3.0Decklog gRPC address for realtime service events.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
PURSER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Purser connection. Empty uses the canonical internal name.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Decklog connection. Empty uses the canonical internal name.
DECKHAND_HOSTstringdeckhandv0.3.0Host name this instance advertises when it registers with Quartermaster.

skipper

Section titled “skipper”

Read by api_consultant/cmd/skipper.

VariableTypeDefaultNotesSinceDescription
PORTstring18018v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GRPC_PORTstring19007v0.3.0TCP port for the gRPC listener.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_METADATA_POLICYstringallowv0.3.0Handling of x-user-id and x-tenant-id metadata on gRPC calls authenticated with the service token: allow applies them to the request, audit applies and logs them, deny ignores them and logs a warning.
SYSTEM_TENANT_IDstringv0.3.0UUID of the Quartermaster-owned system tenant. Empty uses the reserved ID 00000000-0000-0000-0000-000000000001; a value that is not a UUID fails startup.
SERVICE_TOKENstringrequired, secretv0.3.0Shared service-to-service bearer token for internal gRPC and HTTP calls.
JWT_SECRETstringrequired, secretv0.3.0HMAC secret that signs and verifies user session JWTs.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
GRPC_TLS_CERT_PATHstringv0.3.0Certificate presented by this service’s gRPC listener.
GRPC_TLS_KEY_PATHstringv0.3.0Private key for GRPC_TLS_CERT_PATH.
DATABASE_URLstringrequired, secretv0.3.0Connection URL for this service’s PostgreSQL or YugabyteDB database.
CLUSTER_IDstringv0.3.0Cluster the instance registers under in Quartermaster. Empty lets Quartermaster resolve it.
NODE_IDstringv0.3.0Node the instance registers under in Quartermaster.
BUILD_ENVstringv0.3.0Runtime environment selector. Empty, dev, or development enables development-only behavior; production or prod marks a production process.
EMAIL_LOGO_URLstringv0.3.10Absolute URL of the logo image in outgoing emails. Empty uses the light logomark served under WEBAPP_PUBLIC_URL.
WEBAPP_PUBLIC_URLstringv0.3.0Public base URL of the web application. Links in outgoing emails and notifications and redirects back to the web application are built from it, and it serves the default email logo when EMAIL_LOGO_URL is empty.
SUPPORT_EMAILstringv0.3.10Support mailbox shown in the footer of outgoing emails and set as Reply-To on the emails that carry one. Empty uses [email protected].
SKIPPER_HOSTstringskipperv0.3.0Host name this instance advertises when it registers with Quartermaster.
REGIONstringv0.3.0Region label attached to usage events sent to Decklog.
PERISCOPE_GRPC_ADDRstringperiscope-query:19004v0.3.0Periscope Query gRPC address for heartbeat diagnostics and infrastructure monitoring.
PERISCOPE_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Periscope Query connection. Empty uses the canonical internal name.
PURSER_GRPC_ADDRstringpurser:19003v0.3.0Purser gRPC address for subscription tier checks and billing contacts.
PURSER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Purser connection. Empty uses the canonical internal name.
COMMODORE_GRPC_ADDRstringcommodore:19001v0.3.0Commodore gRPC address for tenant notification contacts and stream monitoring.
COMMODORE_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Commodore connection. Empty uses the canonical internal name.
DECKLOG_GRPC_ADDRstringdecklog:18006v0.3.0Decklog gRPC address for usage metering and websocket notifications.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Decklog connection. Empty uses the canonical internal name.
QUARTERMASTER_GRPC_ADDRstringquartermaster:19002v0.3.0Quartermaster gRPC address for tenant and cluster listings and service registration.
QUARTERMASTER_GRPC_TLS_SERVER_NAMEstringv0.3.0TLS server name override for the Quartermaster connection. Empty uses the canonical internal name.
LOOKOUT_GRPC_ADDRstringv0.3.8Lookout gRPC address used to attach investigation reports to incidents. Lookout-triggered investigations run only when this and KAFKA_BROKERS are set.
LOOKOUT_GRPC_TLS_SERVER_NAMEstringv0.3.8TLS server name override for the Lookout connection. Empty uses the canonical internal name.
KAFKA_BROKERSlistv0.3.0Comma-separated bootstrap brokers of the aggregator Kafka cluster that carries the Lookout incident topic. Empty disables Lookout-triggered investigations.
KAFKA_CLUSTER_IDstringlocalv0.3.0Kafka cluster identifier attached to the Lookout incident consumer.
LLM_PROVIDERstringv0.3.0Chat model provider: openai, anthropic, or ollama. Empty or unknown leaves Skipper without a chat model.
LLM_MODELstringv0.3.0Chat model name passed to LLM_PROVIDER.
LLM_API_KEYstringsecretv0.3.0API key for LLM_PROVIDER. Also the fallback key for embeddings, the utility model, and the reranker.
LLM_API_URLstringv0.3.0Base URL override for LLM_PROVIDER. Empty uses the provider default.
LLM_MAX_TOKENSinteger4096v0.3.0Maximum tokens the chat model generates per response; also reserved when deriving the prompt token budget.
LLM_CONTEXT_WINDOWinteger0v0.3.0Context window of the chat model in tokens. 0 uses the known window for recognized models.
SKIPPER_PROMPT_TOKEN_BUDGETinteger0v0.3.0Explicit prompt token budget. 0 derives it from the context window and LLM_MAX_TOKENS.
EMBEDDING_PROVIDERstringv0.3.0Embedding provider for knowledge search. Empty uses LLM_PROVIDER.
EMBEDDING_MODELstringv0.3.0Embedding model name. Empty uses LLM_MODEL.
EMBEDDING_API_KEYstringsecretv0.3.0API key for EMBEDDING_PROVIDER. Empty uses LLM_API_KEY.
EMBEDDING_API_URLstringv0.3.0Base URL override for EMBEDDING_PROVIDER. Empty uses LLM_API_URL.
EMBEDDING_DIMENSIONSinteger0v0.3.0Embedding vector size. 0 probes the embedding model at startup; a change truncates stored knowledge.
UTILITY_LLM_PROVIDERstringv0.3.0Provider of the utility model for query rewriting, HyDE, contextual retrieval, and social posts. Empty uses LLM_PROVIDER.
UTILITY_LLM_MODELstringv0.3.0Utility model name. Empty uses LLM_MODEL.
UTILITY_LLM_API_KEYstringsecretv0.3.0API key for the utility model. Empty uses LLM_API_KEY; the utility model is disabled when both are empty.
UTILITY_LLM_API_URLstringv0.3.0Base URL override for the utility model. Empty uses LLM_API_URL.
RERANKER_PROVIDERstringv0.3.0Cross-encoder reranker provider. Empty ranks knowledge results with the keyword heuristic.
RERANKER_MODELstringv0.3.0Reranker model name passed to RERANKER_PROVIDER.
RERANKER_API_KEYstringsecretv0.3.0API key for RERANKER_PROVIDER. Empty uses LLM_API_KEY.
RERANKER_API_URLstringv0.3.0Base URL override for RERANKER_PROVIDER.
SEARCH_PROVIDERstringv0.3.0Web search provider: tavily, brave, or searxng. Empty or unknown disables web search.
SEARCH_API_KEYstringsecretv0.3.0API key for SEARCH_PROVIDER.
SEARCH_API_URLstringv0.3.0Base URL override for SEARCH_PROVIDER. Required by searxng.
SKIPPER_SEARCH_LIMITinteger8v0.3.0Maximum knowledge and web search results returned to the model per search.
SKIPPER_REQUIRED_TIER_LEVELinteger3v0.3.0Minimum billing tier level for chat access and heartbeat analysis. 0 disables the tier check.
SKIPPER_CHAT_RATE_LIMIT_PER_HOURinteger0v0.3.0Chat requests allowed per tenant per hour. 0 or less means unlimited.
SKIPPER_CHAT_RATE_LIMIT_OVERRIDESstringv0.3.0Comma-separated tenant_id:limit pairs that replace the hourly chat limit for a tenant. Malformed or negative entries are ignored.
SKIPPER_MAX_HISTORY_MESSAGESinteger20v0.3.0Conversation messages loaded as history for each chat turn.
GATEWAY_PUBLIC_URLstringv0.3.0Public Bridge URL. Its /mcp path is the platform tool endpoint when no GATEWAY_MCP_URL or GATEWAY_MCP_URLS is set.
GATEWAY_MCP_URLstringv0.3.0Internal Bridge MCP endpoint for platform tools, used instead of the public URL.
GATEWAY_MCP_URLSlistv0.3.0Comma-separated Bridge MCP endpoints for platform tools. Takes precedence over GATEWAY_MCP_URL.
SKIPPER_ADMIN_TENANT_IDstringv0.3.0Tenant the embedded web UI acts as. Empty uses the tenant ID local.
SKIPPER_API_KEYstringsecretv0.3.0Key that authenticates the embedded web UI and signs its session cookie.
SKIPPER_WEB_UIbooleantruev0.3.0Serves the embedded web UI and its /admin/api routes.
SKIPPER_WEB_UI_INSECUREbooleanfalsev0.3.0Serves the embedded web UI without authentication when SKIPPER_API_KEY is empty. Otherwise the web UI stays disabled.
SITEMAPSlistv0.3.0Comma-separated sitemap URLs crawled into the knowledge base on a schedule.
SKIPPER_SITEMAPS_DIRstringv0.3.0Directory of sitemap files crawled into the knowledge base on a schedule.
DOCS_PUBLIC_URLstringv0.3.0Documentation base URL substituted into sitemap files.
MARKETING_PUBLIC_URLstringv0.3.0Marketing base URL substituted into sitemap files.
CRAWL_INTERVALduration24hv0.3.0Period over which the crawl scheduler revisits every known knowledge page.
CHUNK_TOKEN_LIMITinteger500v0.3.0Maximum tokens per embedded knowledge chunk. 0 or less keeps the embedder default.
CHUNK_TOKEN_OVERLAPinteger50v0.3.0Tokens shared between consecutive knowledge chunks. 0 or less keeps the embedder default.
SKIPPER_ENABLE_RENDERINGbooleanfalsev0.3.0Renders JavaScript pages with headless Chrome while crawling, when Chrome is available.
SKIPPER_CONTEXTUAL_RETRIEVALbooleanfalsev0.3.0Adds utility-model context summaries to crawled chunks before embedding. Needs a utility model.
SKIPPER_LINK_DISCOVERYbooleanfalsev0.3.0Follows links found on crawled pages in addition to sitemap entries.
SKIPPER_ENABLE_HYDEbooleanfalsev0.3.0Enables hypothetical document embeddings for knowledge search. Needs a utility model and an embedder.
SKIPPER_SSRF_ALLOWED_HOSTSlistv0.3.0Comma-separated host names the crawler may fetch even when they resolve to private addresses.
SKIPPER_CRAWL_ORIGIN_REWRITESstringv0.3.0JSON object mapping public origins to the origins the crawler fetches instead. Page identities and citations keep the public URL.
HEARTBEAT_INTERVALstring30mv0.3.0Interval between heartbeat analysis runs. An unparsable value logs a warning and uses 30m.
SKIPPER_SOCIAL_ENABLEDbooleanfalsev0.3.0Starts the social post drafting agent. Also needs SKIPPER_SOCIAL_NOTIFY_EMAIL and a chat or utility model.
SKIPPER_SOCIAL_INTERVALduration2hv0.3.0Interval between social post drafting runs.
SKIPPER_SOCIAL_MAX_PER_DAYinteger2v0.3.0Maximum social post drafts sent per day.
SKIPPER_SOCIAL_NOTIFY_EMAILstringv0.3.0Address that receives social post drafts. Empty disables the social agent.
FROM_EMAILstring[email protected]v0.3.0Sender address for notification, infrastructure, and social emails.
FROM_NAMEstringFrameWorksv0.3.0Sender display name for outgoing emails.
SMTP_HOSTstringv0.3.0SMTP server host for outgoing emails.
SMTP_PORTstring587v0.3.0SMTP server port for outgoing emails.
SMTP_USERstringv0.3.0SMTP user for outgoing emails.
SMTP_PASSWORDstringsecretv0.3.0Password for SMTP_USER.
TO_EMAILstringv0.3.0Fallback recipient for heartbeat reports and infrastructure alerts when no tenant contact resolves.
SKIPPER_NOTIFY_EMAILbooleanfalsev0.3.0Default for delivering heartbeat report notifications by email when a tenant has no preference.
SKIPPER_NOTIFY_WEBSOCKETbooleantruev0.3.0Default for delivering heartbeat report notifications over websocket when a tenant has no preference.
SKIPPER_NOTIFY_MCPbooleantruev0.3.0Default for delivering heartbeat report notifications over MCP when a tenant has no preference.
SMTP_ALLOW_INSECUREbooleanfalsev0.3.10Sends outgoing emails to an SMTP server that does not offer STARTTLS. For an isolated development or test relay only; never set it in production.

steward

Section titled “steward”

Read by api_forms/cmd/steward.

VariableTypeDefaultNotesSinceDescription
PORTstring18032v0.3.0TCP port for the HTTP listener that serves health, readiness, metrics, and HTTP APIs.
GIN_MODEstringdebugv0.3.0Router mode. release enables Gin release mode and restricts CORS to ALLOWED_ORIGINS; any other value runs the router in development mode.
ALLOWED_ORIGINSlistv0.3.0Comma-separated browser origins accepted by CORS when GIN_MODE is release.
LOG_LEVELstringinfov0.3.0Log level: debug, info, warn, or error. Any other value fails startup.
GRPC_TLS_CA_PATHstringv0.3.0CA bundle that internal gRPC clients use to verify servers.
GRPC_ALLOW_INSECUREbooleanfalsev0.3.0Allows plaintext internal gRPC when no TLS material is configured. Development only.
EMAIL_LOGO_URLstringv0.3.10Absolute URL of the logo image in outgoing emails. Empty uses the light logomark served under WEBAPP_PUBLIC_URL.
WEBAPP_PUBLIC_URLstringv0.3.0Public base URL of the web application. Links in outgoing emails and notifications and redirects back to the web application are built from it, and it serves the default email logo when EMAIL_LOGO_URL is empty.
SUPPORT_EMAILstringv0.3.10Support mailbox shown in the footer of outgoing emails and set as Reply-To on the emails that carry one. Empty uses [email protected].
TURNSTILE_FORMS_SECRET_KEYstringsecretv0.3.0Cloudflare Turnstile secret key for contact and subscribe forms. Empty disables Turnstile verification.
SMTP_HOSTstringv0.3.0SMTP server host for contact form emails. Empty reports the configuration health check as unhealthy.
SMTP_PORTstring587v0.3.0SMTP server port for contact form emails.
SMTP_USERstringv0.3.0SMTP user for contact form emails.
SMTP_PASSWORDstringsecretv0.3.0Password for SMTP_USER.
FROM_EMAILstring[email protected]v0.3.0Sender address for contact form emails.
FROM_NAMEstringFrameWorksv0.3.10Sender display name for contact form emails.
SMTP_ALLOW_INSECUREbooleanfalsev0.3.10Sends contact form emails to an SMTP server that does not offer STARTTLS. For an isolated development or test relay only; never set it in production.
TO_EMAILstringv0.3.0Recipient of contact form submissions. Empty sends to [email protected] and reports the configuration health check as unhealthy.
EMAIL_SUBJECT_PREFIXstringContact Formv0.3.0Subject prefix of contact form emails.
CONTACT_SUCCESS_MESSAGEstringThank you for your message! We'll get back to you soon.v0.3.0Message returned to the visitor after a contact form submission is sent.
LISTMONK_URLstringv0.3.0Listmonk base URL. Together with LISTMONK_API_USERNAME and LISTMONK_API_TOKEN it enables the subscribe endpoint.
LISTMONK_API_USERNAMEstringv0.3.0Listmonk API user for newsletter subscriptions.
LISTMONK_API_TOKENstringsecretv0.3.0Listmonk API token for LISTMONK_API_USERNAME.
DEFAULT_MAILING_LIST_IDinteger1v0.3.0Listmonk list ID that newsletter subscriptions are added to.
DECKLOG_GRPC_ADDRstringv0.3.9Decklog gRPC address for operator activity events about contact and subscribe submissions. Empty disables the events.
DECKLOG_GRPC_TLS_SERVER_NAMEstringv0.3.9TLS server name override for the Decklog connection. Empty uses the canonical internal name.
SERVICE_TOKENstringsecretv0.3.9Service token sent on Decklog calls. Used only when DECKLOG_GRPC_ADDR is set.
CLUSTER_IDstringv0.3.9Cluster ID stamped as the source cluster on operator activity events.
REGIONstringv0.3.9Region label stamped as the source region on operator activity events.