Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
115 lines (98 loc) · 6.12 KB
/
Copy path.env.example
File metadata and controls
115 lines (98 loc) · 6.12 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# Agent Vault – local development environment variables
# Copy to .env and fill in values. Loaded automatically by `make dev`.
# Alternatively, use the Infisical CLI to inject secrets:
# infisical run -- make dev
# See https://infisical.com/docs/cli/overview
# Server listen port (respected by PaaS platforms like Fly.io, Cloud Run, Heroku)
# PORT=14321
# PostgreSQL connection URL for production deployments. When set, Agent Vault
# uses Postgres instead of the built-in SQLite database. All instances must
# share the same DATABASE_URL. Supports sslmode parameter (e.g. ?sslmode=require).
# DATABASE_URL=postgres://user:password@host:5432/agentvault
# Postgres connection pool tuning (only used when DATABASE_URL is set)
# DB_MAX_OPEN_CONNS=25 # max open connections per instance
# DB_MAX_IDLE_CONNS=10 # max idle connections in the pool
# DB_CONN_MAX_LIFETIME=5m # max lifetime before a connection is recycled (Go duration)
# Master password — derives a KEK that wraps the data encryption key (DEK).
# If omitted, the DEK is stored unwrapped (passwordless mode).
# AGENT_VAULT_MASTER_PASSWORD=
# External base URL (for links in emails, invites, discovery). Its hostname is
# also added as a SubjectAltName on every MITM leaf cert so clients that
# TLS-verify against the proxy's own hostname (not the upstream SNI) succeed
# without a shim.
# Also read on the agent side by `agent-vault run` and the SDKs to locate the broker.
# AGENT_VAULT_ADDR=http://localhost:14321
# Agent-side credentials (read by `agent-vault run` and the SDKs in containerized
# / unattended deployments where there's no on-disk admin session).
# AGENT_VAULT_TOKEN= # bearer token: vault-scoped session OR long-lived agent token
# AGENT_VAULT_SESSION_TOKEN= # deprecated alias of AGENT_VAULT_TOKEN; honored with a one-time warning
# AGENT_VAULT_VAULT= # which vault to scope the run to (required in agent mode for both token types)
# SMTP (optional – if unset, email notifications are silently disabled)
# AGENT_VAULT_SMTP_HOST=
# AGENT_VAULT_SMTP_PORT=587
# AGENT_VAULT_SMTP_USERNAME=
# AGENT_VAULT_SMTP_PASSWORD=
# AGENT_VAULT_SMTP_FROM=
# AGENT_VAULT_SMTP_FROM_NAME=Agent Vault
# AGENT_VAULT_SMTP_TLS_MODE=opportunistic
# AGENT_VAULT_SMTP_TLS_SKIP_VERIFY=false
# Network security (optional)
# AGENT_VAULT_ALLOW_PRIVATE_RANGES=false # default false blocks RFC-1918, loopback, link-local, CGN, IPv6 ULA. Set true to allow all
# AGENT_VAULT_NETWORK_ALLOWLIST= # comma-separated CIDRs/IPs to allow when AGENT_VAULT_ALLOW_PRIVATE_RANGES=false (e.g. "10.163.0.0/16,192.168.1.1")
# # Bare IPv4 -> /32, bare IPv6 -> /128. IMDS (169.254.169.254, fd00:ec2::254) always blocked.
# AGENT_VAULT_TRUSTED_PROXIES= # comma-separated CIDRs for trusted reverse proxies (e.g. 10.0.0.0/8)
# Development (optional)
# AGENT_VAULT_DEV_MODE=false # when true, allows internal/localhost hosts on every service-ingest path (proposals AND direct upsert)
# Isolation mode for `agent-vault vault run` (optional)
# host (default, cooperative — runs on the host with HTTPS_PROXY) | container (non-cooperative Docker container with iptables egress lock)
# AGENT_VAULT_ISOLATION=host
# Infisical credential store (optional). Enables read-only vaults whose
# credentials are pulled from an Infisical instance instead of stored locally.
# Set one auth-method group; first match in priority order wins.
# INFISICAL_URL=https://app.infisical.com
# Universal Auth (recommended):
# INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=
# INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=
# Kubernetes Auth:
# INFISICAL_KUBERNETES_IDENTITY_ID=
# INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH=
# AWS IAM Auth:
# INFISICAL_AWS_IAM_AUTH_IDENTITY_ID=
# GCP IAM Auth (identity ID plus service-account key file):
# INFISICAL_GCP_AUTH_IDENTITY_ID=
# INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH=
# GCP ID Token Auth (identity ID only; SDK pulls a metadata-server token):
# INFISICAL_GCP_AUTH_IDENTITY_ID=
# LDAP Auth (all three required):
# INFISICAL_LDAP_AUTH_IDENTITY_ID=
# INFISICAL_LDAP_AUTH_USERNAME=
# INFISICAL_LDAP_AUTH_PASSWORD=
# MITM proxy body-size limits (optional)
# AGENT_VAULT_MAX_RESPONSE_BYTES=0 # max response body bytes streamed to agents (default 0 = unlimited)
# AGENT_VAULT_MAX_REQUEST_BYTES=1073741824 # max request body bytes forwarded to upstreams (default 1073741824 = 1 GiB)
# Observability (optional)
# AGENT_VAULT_LOG_LEVEL=info # info (default) | debug — debug emits one line per proxied request (no secret values)
# Request-log retention (optional) — controls the per-vault audit log of proxied requests.
# Bodies and query strings are never stored; only method/host/path/status/latency metadata.
# AGENT_VAULT_LOGS_MAX_AGE_HOURS=168 # Drop rows older than this (default 168 = 7 days).
# AGENT_VAULT_LOGS_MAX_ROWS_PER_VAULT=10000 # Keep at most this many rows per vault (default 10000).
# AGENT_VAULT_LOGS_RETENTION_LOCK=false # When true, ignore any owner UI overrides (operator pin).
# Rate limiting (optional) — tiered limits with sensible defaults.
# Profile: default | strict (≈0.5×) | loose (≈2×) | off (disable all limits).
# AGENT_VAULT_RATELIMIT_PROFILE=default
# When true, the owner UI cannot override rate-limit settings (operator pin).
# AGENT_VAULT_RATELIMIT_LOCK=false
# Fine-grained overrides (rare): AGENT_VAULT_RATELIMIT_<TIER>_<KNOB>
# where TIER ∈ AUTH | PROXY | AUTHED | GLOBAL
# and KNOB ∈ RATE | BURST | WINDOW | MAX | CONCURRENCY. Example:
# AGENT_VAULT_RATELIMIT_PROXY_BURST=50
# Telemetry (optional)
# Agent Vault reports anonymous usage events (command invocations, feature usage)
# to PostHog. No credential values or request payloads are ever included.
# Set to "false" to disable. Also overridable with --telemetry=false on the CLI.
# AGENT_VAULT_TELEMETRY=true
# Installer (install.sh only — not read by the server or CLI binary).
# Set to any non-empty value to disable the anonymous install/upgrade beacon.
# Must be passed to `sh`, not `curl`:
# curl -fsSL https://get.agent-vault.dev | AGENT_VAULT_NO_TELEMETRY=1 sh
# AGENT_VAULT_NO_TELEMETRY=1