vantage-docs/docs/reference/environment-variables.md

id, title, sidebar_label

id	title	sidebar_label
environment-variables	Environment variables	Environment variables

Everything the control plane reads from the environment, and what happens when it is absent.

Server

Name	Required	Default	Notes
GRPC_HOST	yes		The host:port agents dial. Boot fails without it. There is deliberately no fallback to the web host: that would hand every agent a port that does not speak gRPC
MONGO_URI	no	mongodb://localhost:27017	The database name is taken from the URI path, falling back to vantage. There is no separate MONGO_DB
REDIS_ADDR	no	localhost:6379	Sessions only
KEY_ENCRYPTION_KEY	yes in practice		64 hex characters (32 bytes) for AES-256-GCM. Required for private keys, vault secrets, OIDC client secrets and console credentials
GITEA_HOST	yes	gitea.example.com	Used to build the install scripts and agent download URLs. The default is a placeholder that will not resolve
GUACD_ADDR	no	guacd:4822	The browser console daemon
APP_ROOT_LABEL	no	vantage	The app root label for the host and session organisation guard
VANTAGE_WORKFLOW_LOG_DIR	no		Where workflow run logs are written

:::danger KEY_ENCRYPTION_KEY has no recovery path It encrypts SSH private keys, vault secrets, OIDC client secrets and console credentials. Lose it and all of them are unreadable. Back it up separately from the database it protects. :::

:::info A wrong APP_ROOT_LABEL fails quietly It does not error. It simply stops matching, and the host/session guard stops protecting anything. :::

Not configurable

The HTTP port (8080) and the gRPC port (9090) are fixed in the server. The HTTP_PORT and GRPC_PORT entries in the shipped Compose file are inert — remap with Docker's port publishing instead.

Agent

The agent reads no environment variables. Everything is in its config file.