mrhid6
bcc44fd44a
InitRedis now takes a username and password, read from REDIS_USERNAME and REDIS_PASSWORD, matching what admin has always done. Both empty keeps an unauthenticated Redis working; a password with an empty username is what a legacy requirepass instance needs, since go-redis then sends AUTH with one argument instead of two. This is what lets a Kubernetes install point at a managed Redis instead of the bundled one.
4.2 KiB
4.2 KiB
id, title, sidebar_label
| id | title | sidebar_label |
|---|---|---|
| environment-variables | Environment variables | Environment variables |
Everything the control plane reads from the environment, and what happens when it is absent.
Server
| Name | Required | Default | Notes |
|---|---|---|---|
GRPC_HOST |
yes | The host:port agents dial. Boot fails without it. There is deliberately no fallback to the web host: that would hand every agent a port that does not speak gRPC |
|
MONGO_URI |
no | mongodb://localhost:27017 |
The database name is taken from the URI path, falling back to vantage. There is no separate MONGO_DB |
REDIS_ADDR |
no | localhost:6379 |
Sessions only |
REDIS_USERNAME |
no | Redis 6+ ACL user. Leave empty against a legacy requirepass instance, which authenticates with the password alone |
|
REDIS_PASSWORD |
no | Leave empty for an unauthenticated Redis. Both of these exist so an install can use a managed Redis rather than the bundled one | |
KEY_ENCRYPTION_KEY |
yes in practice | 64 hex characters (32 bytes) for AES-256-GCM. Required for private keys, vault secrets, OIDC client secrets and console credentials | |
GITEA_HOST |
yes | gitea.example.com |
Used to build the install scripts and agent download URLs. The default is a placeholder that will not resolve |
GUACD_ADDR |
no | guacd:4822 |
The browser console daemon |
PROXY_ADVERTISE_HOST |
no | server |
The hostname guacd uses to reach the control plane's console relay. Wrong here and every console session fails at connect with guacd unable to resolve the relay |
PROXY_LISTEN_HOST |
no | 0.0.0.0 |
Interface the ephemeral relay listeners bind. Narrow it only if guacd shares a known interface |
APP_ROOT_LABEL |
no | vantage |
The app root label for the host and session organisation guard |
VANTAGE_WORKFLOW_LOG_DIR |
no | Where workflow run logs are written |
:::danger KEY_ENCRYPTION_KEY has no recovery path
It encrypts SSH private keys, vault secrets, OIDC client secrets and console
credentials. Lose it and all of them are unreadable. Back it up separately from
the database it protects.
:::
:::info A wrong APP_ROOT_LABEL fails quietly
It does not error. It simply stops matching, and the host/session guard stops
protecting anything.
:::
Not configurable
The HTTP port (8080) and the gRPC port (9090) are fixed in the server. The
HTTP_PORT and GRPC_PORT entries in the shipped Compose file are inert —
remap with Docker's port publishing instead.
Agent
The agent reads no environment variables. Everything is in its config file.