Configuration Reference

All three customer-facing Arbitex services — Platform, Cloud Portal, and Outpost — are configured entirely through environment variables. This page is the authoritative reference for every supported variable across all services, organized by service and functional category.

Variables marked Required must be set before the service will start. Variables with a default listed as "" are optional and the feature they control is disabled or falls back to an alternative when unset.

Note

Secrets backends. In development, secrets (API keys, signing keys, passwords) may be passed directly as environment variables. In staging and production, use a dedicated secrets backend:

• env — reads values from process environment. Rejected in production for sensitive variables.
• vault — reads from HashiCorp Vault KV at the path and mount configured below.
• azure_keyvault — reads from Azure Key Vault at AZURE_KEYVAULT_URL.
• file — reads from a JSON file at SECRETS_FILE.

Set SECRETS_BACKEND on both Platform and Cloud to select the active backend.

Note

Hot-reload vs restart-required. Most configuration changes require a service restart to take effect. A small set of operational parameters — log level, rate-limit tiers, policy sync interval — are hot-reloaded by the Outpost without a restart. See the CLI Reference for the outpost config reload command.

---

Platform

The Platform service (arbitex-platform) is the core API gateway. It handles AI provider routing, DLP, audit, compliance enforcement, and the admin API used by Cloud and Outpost.

Database and Cache

Variable	Type	Default	Description
DATABASE_URL	string	postgresql+asyncpg://arbitex:arbitex@localhost:5432/arbitex	Async SQLAlchemy connection string. Required.
DATABASE_URL_SYNC	string	auto-derived	Sync connection string for Alembic migrations. Auto-derived from DATABASE_URL if not set.
REPORTING_DATABASE_URL	string	""	Connection string for the reporting/read-replica database. Optional — when empty, all queries use the primary database.
REDIS_URL	string	""	Redis connection URL. Optional — rate limiting falls back to Postgres when empty. Use rediss:// (TLS) in production.
REDIS_SYNC_INTERVAL_SECONDS	int	60	Seconds between Redis-to-Postgres counter sync.
SESSION_STORE_URL	string	""	Redis URL for shared session state across multiple Platform instances. Falls back to in-memory when empty.

Authentication

Caution

JWT_SECRET_KEY is a signing secret. Never commit it to version control. Platform will refuse to start if the default value CHANGE-ME-IN-PRODUCTION is detected while ENVIRONMENT=production.

Variable	Type	Default	Description
JWT_SECRET_KEY	string	CHANGE-ME-IN-PRODUCTION	HMAC-SHA256 signing key for user JWTs. Required. Startup aborts if default is detected in production.
JWT_ALGORITHM	string	HS256	JWT signing algorithm.
JWT_ACCESS_TOKEN_EXPIRE_MINUTES	int	60	Access token TTL in minutes.
OAUTH_JWT_PRIVATE_KEY	string	""	PEM RSA private key (or path to a .pem file) for M2M token signing. An ephemeral RSA-2048 keypair is generated at startup if empty.
OAUTH_JWT_PRIVATE_KEY_ID	string	""	Key ID placed in the kid JWT header and published in JWKS. SHA-256 thumbprint of the key if empty.
OAUTH_JWT_PREVIOUS_PRIVATE_KEY	string	""	Previous keypair retained during rotation window so in-flight tokens remain valid.
OAUTH_JWT_PREVIOUS_PRIVATE_KEY_ID	string	""	Key ID for the previous keypair.
OAUTH_JWT_ALGORITHM	string	RS256	Signing algorithm for M2M OAuth tokens.

CORS and Application

Variable	Type	Default	Description
CORS_ORIGINS	string	http://localhost:5173,http://localhost:3000	Comma-separated list of allowed CORS origins.
APP_NAME	string	Arbitex	Application display name used in UI and emails.
APP_VERSION	string	0.1.0	Semantic version string.
DEBUG	bool	false	Enable debug mode. Never set true in production.
ENVIRONMENT	string	development	Deployment environment: development, staging, or production. Affects startup safety checks.
LOG_FORMAT	string	text	Log output format: text or json. Use json for log aggregation pipelines.
DEFAULT_SUMMARIZER_MODEL	string	claude-sonnet-4-20250514	Default model used for Summarize mode when no policy overrides the selection.
MCP_ENABLED	bool	true	Toggle the MCP server endpoint.
COMPLIANCE_ENFORCEMENT_MODE	string	additive	Policy enforcement mode: additive (union of rules) or strict (intersection).
WEBAUTHN_RP_ID	string	localhost	WebAuthn relying party ID. Must match the domain served to users.
WEBAUTHN_RP_ORIGIN	string	http://localhost:5173	WebAuthn relying party origin. Must match the browser origin.

Secrets Backend

Variable	Type	Default	Description
SECRETS_BACKEND	string	env	Active secrets backend: env, vault, azure_keyvault, or file. env is rejected in production for sensitive keys.
AZURE_KEYVAULT_URL	string	""	Azure Key Vault URL. Required when SECRETS_BACKEND=azure_keyvault.
AZURE_VAULT_URL	string	""	Alias for AZURE_KEYVAULT_URL.
SECRETS_FILE	string	""	Path to a JSON secrets file. Required when SECRETS_BACKEND=file.
VAULT_ADDR	string	http://127.0.0.1:8200	HashiCorp Vault server address.
VAULT_TOKEN	string	""	Vault token auth. Mutually exclusive with AppRole.
VAULT_ROLE_ID	string	""	Vault AppRole role ID.
VAULT_SECRET_ID	string	""	Vault AppRole secret ID.
VAULT_MOUNT	string	secret	Vault KV mount point.
VAULT_PATH	string	arbitex	Path within the Vault mount where secrets are stored.

Provider API Keys

Caution

Provider API keys grant direct billing access to third-party AI services. Never commit these values to version control, Dockerfiles, or build artifacts. Inject them at runtime via your secrets backend (SECRETS_BACKEND=vault or azure_keyvault in production).

Variable	Type	Default	Description
ANTHROPIC_API_KEY	string	""	API key for Anthropic Claude models.
OPENAI_API_KEY	string	""	API key for OpenAI models.
GOOGLE_API_KEY	string	""	API key for Google Gemini models.
MISTRAL_API_KEY	string	""	API key for Mistral models.
COHERE_API_KEY	string	""	API key for Cohere models.
GROQ_API_KEY	string	""	API key for Groq models.
AWS_ACCESS_KEY_ID	string	""	AWS access key for Bedrock.
AWS_SECRET_ACCESS_KEY	string	""	AWS secret key for Bedrock.
AWS_REGION	string	""	AWS region for Bedrock endpoints.

Provider Base URLs

Variable	Type	Default	Description
OPENAI_BASE_URL	string	https://api.openai.com/v1	OpenAI-compatible API base URL. Override to route through a proxy or compatible endpoint.
GOOGLE_API_BASE_URL	string	https://generativelanguage.googleapis.com/v1beta	Google Gemini API base URL.
MISTRAL_BASE_URL	string	https://api.mistral.ai	Mistral API base URL.
OLLAMA_BASE_URL	string	http://localhost:11434	Ollama local server base URL.
LLAMACPP_BASE_URL	string	http://localhost:8080	llama.cpp server base URL.
COHERE_BASE_URL	string	provider default	Cohere base URL override.
GROQ_BASE_URL	string	provider default	Groq base URL override.

Azure OpenAI

Variable	Type	Default	Description
AZURE_OPENAI_API_KEY	string	""	Azure OpenAI API key.
AZURE_OPENAI_ENDPOINT	string	""	Azure OpenAI resource endpoint (e.g. https://my-resource.openai.azure.com).
AZURE_OPENAI_API_VERSION	string	""	Azure OpenAI API version string.
AZURE_OPENAI_TENANT_ID	string	""	Azure tenant ID for managed identity or service principal auth.
AZURE_OPENAI_CLIENT_ID	string	""	Azure client ID for service principal auth.
AZURE_OPENAI_CLIENT_SECRET	string	""	Azure client secret for service principal auth.

Audit

Variable	Type	Default	Description
AUDIT_SINKS	string	db	Comma-separated list of active audit sinks: db, jsonl, webhook, splunk_hec.
AUDIT_JSONL_PATH	string	/var/log/arbitex/audit.jsonl	File path for the JSONL audit sink.
AUDIT_WEBHOOK_URL	string	""	HTTP endpoint for the webhook audit sink.
AUDIT_WEBHOOK_TOKEN	string	""	Bearer token sent with webhook audit payloads.
AUDIT_HMAC_KEY	string	""	HMAC-SHA256 key for audit chain integrity. Recommended in production.
AUDIT_HMAC_KEY_ID	string	default	Identifier for the current HMAC key, included in audit records for rotation tracking.
AUDIT_BUFFER_FLUSH_INTERVAL	float	0.1	Seconds between audit buffer flush cycles.
AUDIT_BUFFER_BATCH_SIZE	int	50	Maximum events per audit buffer flush batch.

Rate Limiting

Variable	Type	Default	Description
RATE_LIMIT_REQUESTS_PER_MINUTE	int	60	Maximum requests per user per minute.
RATE_LIMIT_ADMIN_EXEMPT	bool	false	When true, admin-role users bypass rate limits.
RATE_LIMIT_ADMIN_RPM	int	600	Rate limit bucket size for admin users (when not fully exempt).
RATE_LIMIT_TIERS	string	""	JSON object mapping API path prefixes to RPM limits.

Security

Variable	Type	Default	Description
SECURITY_CSP_POLICY	string	strict default	Content-Security-Policy header value. Defaults to a strict policy; override only if required by your UI.
SECURITY_HSTS_ENABLED	bool	true	Emit Strict-Transport-Security header.
PROMPT_GUARD_ENABLED	bool	true	Enable prompt injection detection and defenses.
PROMPT_GUARD_LOG_LEVEL	string	warning	Log level for prompt guard events.
MAX_REQUEST_BODY_BYTES	int	1048576	Maximum request body size in bytes (default 1 MB).
MAX_PROMPT_LENGTH	int	100000	Maximum prompt length in characters (default 100 K).
MAX_MESSAGES_PER_REQUEST	int	200	Maximum number of messages allowed per chat request.
CORS_AUDIT_ENABLED	bool	true	Toggle CORS violation audit logging.
CLOUD_CA_CERT_PATH	string	""	Path to Cloud CA certificate for mTLS verification. Legacy — prefer MTLS_CA_BUNDLE.
CLOUD_CA_INTERMEDIATE_PATH	string	""	Path to intermediate CA certificate. Legacy — prefer MTLS_CA_BUNDLE.
MTLS_CA_BUNDLE	string	""	PEM bundle containing root and intermediate CA certificates for mTLS. Supersedes CLOUD_CA_CERT_PATH + CLOUD_CA_INTERMEDIATE_PATH when set.
ARBITEX_CA_PATH	string	""	Path to the Arbitex internal CA certificate for service-to-service TLS verification. Used by startup validators to confirm encryption posture.
MTLS_CERT_HEADER	string	X-SSL-Client-Cert	HTTP header name carrying the forwarded client certificate from the TLS terminator.
MTLS_TRUSTED_PROXIES	string	""	Comma-separated CIDRs of trusted TLS-terminating proxies.
MTLS_EXPECTED_ISSUER_CN	string	""	Expected issuer Common Name for mTLS client certificates. When set, the middleware rejects certs whose issuer CN does not match. Empty disables CN pinning.
POLICY_SIGNING_KEY	string	""	HMAC key used to verify policy bundle signatures.
CLOUD_ALLOWED_REDIRECT_URIS	string	platform defaults	Allowed redirect URIs for SSO flows.

Bloom Filter (JWT Blacklist)

Variable	Type	Default	Description
BLOOM_FILTER_EXPECTED_ITEMS	int	10000	Expected maximum number of blacklisted tokens.
BLOOM_FILTER_FP_RATE	float	0.001	Target false-positive rate for the bloom filter.
BLOOM_FILTER_SYNC_INTERVAL	int	300	Seconds between bloom filter rebuilds from the database.
BLOOM_FILTER_KEY	string	""	HMAC key for keyed hashing of token identifiers in the filter.

DLP Microservices

Variable	Type	Default	Description
DLP_NER_MICROSERVICE_URL	string	http://ner-gpu:8200	URL of the NER GPU microservice (Tier 2 NER).
DLP_NER_MICROSERVICE_TIMEOUT	float	5.0	Timeout in seconds for NER microservice calls.
DLP_DEBERTA_VALIDATOR_URL	string	http://deberta-validator:8201	URL of the DeBERTa contextual validator (Tier 3).
DLP_DEBERTA_VALIDATOR_TIMEOUT	float	5.0	Timeout in seconds for DeBERTa calls.
DLP_INFERENCE_FAIL_MODE	string	closed	Behaviour when a DLP microservice is unreachable: closed (block the request) or open (pass through).
DLP_OUTPUT_SCANNING_ENABLED	bool	true	Enable DLP scanning of model output in addition to input.
DLP_NER_BACKEND	string	default	NER backend selection: default (in-process GLiNER) or microservice.
DLP_GLINER_MODEL	string	urchade/gliner_medium-v2.1	GLiNER model name loaded by the in-process backend.
DLP_GLINER_ENTITIES	string	PII entity list	Comma-separated GLiNER entity types to detect.
DLP_DEBERTA_ENABLED	bool	false	Enable DeBERTa contextual validation as a third DLP tier.
GLINER_MODEL_NAME	string	urchade/gliner_multi_pii-v1	GLiNER model used for multi-PII (MNPI) detection.
DLP_SCANNING_DISABLED	bool	false	DEV ONLY. Fully disables the DLP pipeline when true AND ENVIRONMENT=development. Never set in production.
DLP_SERVICE_SECRET	string	""	Shared secret for authenticating the DLP microservice callback to Platform.
AI_DETECTOR_NLI_THRESHOLD	float	0.7	Confidence threshold for NLI-based AI content detection.
CONTENT_CLASSIFIER_NLI_ENABLED	bool	false	Enable DeBERTa NLI for nuanced content classification (hate speech, toxicity).
TIER0_MODEL_PATH	string	bundled	Path to a custom Tier 0 joblib model file. Uses the bundled TF-IDF/LR model when empty.

Credential Intelligence

Variable	Type	Default	Description
CREDINT_SERVICE_URL	string	http://credint:8202	URL of the Credential Intelligence microservice.
CREDINT_SERVICE_TIMEOUT	float	5.0	Timeout in seconds for CredInt service calls.
CREDINT_LIVE_CHECK_ENABLED	bool	false	Enable live HTTP calls to the CredInt microservice for breach corpus checks. Adds per-request latency. Only enable when the CredInt service is deployed. The in-process bloom filter runs regardless.

GeoIP Databases

Variable	Type	Default	Description
GEOIP_MAXMIND_PATH	string	""	Path to the MaxMind GeoIP2 City MMDB file.
GEOIP_ANON_DB_PATH	string	""	Path to the MaxMind Anonymous IP MMDB file.
GEOIP_MAXMIND_ANON_PATH	string	""	Legacy alias for GEOIP_ANON_DB_PATH.
GEOIP_IP2LOCATION_PATH	string	""	Path to IP2Location DB25 BIN file (fallback provider).
GEOIP_IPTOASN_PATH	string	""	Path to an iptoasn TSV file for ASN lookups.
GEOIP_ARIN_PATH	string	""	Path to an ARIN Bulk Whois dump for ARIN lookups.

Google OAuth2 / SSO

Variable	Type	Default	Description
GOOGLE_OAUTH_CLIENT_ID	string	""	Google OAuth2 client ID for SSO.
GOOGLE_OAUTH_CLIENT_SECRET	string	""	Google OAuth2 client secret for SSO.
GOOGLE_OAUTH_REDIRECT_URI	string	""	Redirect URI registered in the Google Cloud Console.

SMTP / Email

Variable	Type	Default	Description
SMTP_HOST	string	""	SMTP server hostname. When empty, email output is written to the structured logger instead.
SMTP_PORT	int	587	SMTP server port.
SMTP_USERNAME	string	""	SMTP authentication username.
SMTP_PASSWORD	string	""	SMTP authentication password.
SMTP_FROM_ADDRESS	string	[email protected]	Sender address used for all outbound emails.
SMTP_USE_TLS	bool	true	Use STARTTLS when connecting to the SMTP server.

Streaming and Routing

Variable	Type	Default	Description
POLICY_OUTPUT_BUFFER_MS	int	5000	Maximum milliseconds to buffer streaming chunks before flushing to the DLP scanner. Set 0 to disable buffering.
POLICY_OUTPUT_STREAMING_SCAN	bool	true	Enable DLP scanning of streaming output chunks.
ROUTE_TO_TIER_MAP	string	""	JSON object defining provider-to-tier-to-model overrides for intelligent routing.
INTENT_SIMPLE_TOKEN_MAX	int	200	Token count threshold below which a prompt is classified as simple.
INTENT_COMPLEX_TOKEN_MIN	int	1000	Token count threshold above which a prompt is classified as complex.

SIEM Integrations

Variable	Type	Default	Description
ELASTIC_API_KEY	string	""	Elasticsearch API key for the Elastic SIEM sink.
ELASTIC_INDEX	string	arbitex-ocsf	Target Elasticsearch index name.
ELASTIC_CLOUD_ID	string	""	Elastic Cloud deployment ID (alternative to URL-based config).
ELASTIC_USERNAME	string	""	Elasticsearch username (basic auth alternative to API key).
ELASTIC_PASSWORD	string	""	Elasticsearch password.
ELASTIC_BATCH_SIZE	int	100	Number of events per bulk indexing request.
ELASTIC_FLUSH_INTERVAL	float	5.0	Seconds between batch flush operations.
ELASTIC_MAX_RETRIES	int	3	Maximum retry attempts for failed bulk requests.
ELASTIC_DEAD_LETTER_PATH	string	""	Path to a dead-letter JSONL file for undeliverable Elasticsearch events.
QRADAR_SYSLOG_HOST	string	""	QRadar syslog receiver hostname.
QRADAR_SYSLOG_PORT	int	514	QRadar syslog receiver port.
QRADAR_TLS_CERT_PATH	string	""	Path to TLS client certificate for QRadar.
QRADAR_TLS_KEY_PATH	string	""	Path to TLS client private key for QRadar.
QRADAR_TLS_CA_PATH	string	""	Path to CA certificate for verifying the QRadar server.
QRADAR_SYSLOG_FACILITY	int	16	Syslog facility number (16 = local0).
FERNET_KEY	string	""	Fernet symmetric key used to encrypt SIEM credentials at rest in the database.
XSIAM_PRODUCT	string	Gateway	Product label sent to Cortex XSIAM in audit events.

Custom Provider Endpoints

Variable	Type	Default	Description
CUSTOM_ENDPOINT_ENCRYPTION_KEY	string	""	Fernet key used to encrypt custom endpoint credentials stored in the database.
CUSTOM_ENDPOINTS_FILE	string	""	Path to a JSON file defining custom endpoint configurations loaded at startup.

Mock Provider

Variable	Type	Default	Description
MOCK_PROVIDER_ENABLED	bool	false	Enable the mock LLM provider for testing and development.
MOCK_RESPONSE_MODE	string	echo	Mock response behaviour: echo (return input), static (fixed response), or error (return error).

Observability

Variable	Type	Default	Description
LOG_LEVEL	string	INFO	Application log level: DEBUG, INFO, WARNING, ERROR.
SERVICE_NAME	string	arbitex-api	Service name field emitted in structured log records.
OTEL_EXPORTER_OTLP_ENDPOINT	string	""	OTel OTLP gRPC endpoint for traces and metrics. Empty disables export.
OTEL_SERVICE_NAME	string	arbitex-platform	OTel resource service name.
OTEL_SERVICE_VERSION	string	""	OTel resource service version.
OTEL_EXPORTER_OTLP_INSECURE	bool	false	Allow insecure (non-TLS) OTLP connections. Development only.
OTEL_TRACES_SAMPLER_ARG	float	0.01	Trace sampling ratio (0.0–1.0). Default 1% of requests sampled.
OTEL_WALLCLOCK_INTERVAL	int	30	Seconds between wallclock metric push operations.
SLOW_QUERY_THRESHOLD_MS	int	500	SQL queries exceeding this threshold emit a warning log.
METRICS_ENABLED	bool	true	Toggle Prometheus metrics collection and the /metrics endpoint.

Circuit Breakers

Variable	Type	Default	Description
MAX_RETRIES	int	3	Maximum retry attempts for provider calls before the circuit trips.
RETRY_BASE_DELAY	float	1.0	Base delay in seconds for exponential backoff.
CIRCUIT_BREAKER_THRESHOLD	int	5	Number of consecutive failures that open the circuit.
CIRCUIT_BREAKER_TIMEOUT	int	300	Seconds the circuit stays open before transitioning to half-open.
CIRCUIT_BREAKER_WINDOW_SECONDS	int	300	Rolling window in seconds over which failures are counted.
CIRCUIT_BREAKER_HEALTH_THRESHOLD	float	0.2	Minimum success ratio in the half-open state before the circuit closes.

Scheduling

Variable	Type	Default	Description
RETENTION_CLEANUP_INTERVAL_HOURS	int	24	Hours between scheduled audit log retention cleanup runs.
MODEL_CATALOG_AUTO_SEED	bool	true	Automatically seed the model catalog from bundled definitions at startup.
CONTENT_CATEGORY_AUTO_SEED	bool	true	Automatically seed content categories at startup.

Usage Throttling

Variable	Type	Default	Description
USAGE_THROTTLE_WARN	int	80	Usage percentage at which a warning is emitted.
USAGE_THROTTLE_SLOW	int	95	Usage percentage at which requests are slowed.
USAGE_THROTTLE_BLOCK	int	100	Usage percentage at which requests are blocked.
USAGE_THROTTLE_CACHE_TTL	int	300	Seconds to cache usage counters before re-querying.
USAGE_ALERT_THRESHOLDS	string	""	JSON configuration for per-org usage alert thresholds.
ARBITEX_COST_RATES	string	""	JSON mapping of model identifiers to per-token cost rates.

IP Allowlist

Variable	Type	Default	Description
IP_ALLOWLIST_BYPASS_CIDRS	string	""	Comma-separated CIDRs that bypass the IP allowlist check entirely.

File Uploads

Variable	Type	Default	Description
UPLOAD_DIR	string	./uploads	Directory for user file uploads.
MAX_FILE_SIZE	int	unset	Maximum upload file size in bytes. No limit when unset.
AVATAR_UPLOAD_DIR	string	/app/uploads/avatars	Directory for user avatar uploads.

GPU Container Settings

These variables are consumed by the NER and DeBERTa GPU sidecar containers, not by the main Platform process.

Variable	Type	Default	Description
NER_MODEL_NAME	string	urchade/gliner_medium-v2.1	Model loaded by the NER GPU container.
NER_DEFAULT_THRESHOLD	float	0.5	Confidence threshold for NER entity detection.
DEBERTA_MODEL_NAME	string	microsoft/deberta-v3-base	DeBERTa model loaded by the validator container.
DEBERTA_THRESHOLD	float	0.7	Confidence threshold for DeBERTa classification.
DEBERTA_MAX_LENGTH	int	512	Maximum token sequence length for DeBERTa inference.

Agent Execution

Variable	Type	Default	Description
AGENT_ENABLED	bool	false	Enable the autonomous agent execution framework.
AGENT_MAX_CONCURRENT_SESSIONS	int	3	Maximum concurrent agent sessions per tenant.
AGENT_MAX_STEPS	int	20	Maximum steps per agent session.
AGENT_STEP_TIMEOUT_SECONDS	int	30	Timeout in seconds for each agent step.

GeoIP API Mode

Variable	Type	Default	Description
GEOIP_PROVIDER_MODE	string	offline	IP enrichment provider mode: offline (MMDB files) or api (MaxMind Insights API).
GEOIP_MAXMIND_ACCOUNT_ID	string	""	MaxMind account ID for Insights API lookups. Required when GEOIP_PROVIDER_MODE=api.
GEOIP_MAXMIND_API_KEY	string	""	MaxMind API key for Insights API lookups. Required when GEOIP_PROVIDER_MODE=api.

Enrichment Watchdog

Variable	Type	Default	Description
ENRICHMENT_WATCHDOG_BATCH	int	500	Batch size for the enrichment watchdog back-fill of audit events missing GeoIP data.
ENRICHMENT_WATCHDOG_INTERVAL	float	300.0	Seconds between enrichment watchdog runs.

Kubernetes Security Context

These variables control application behavior for compatibility with Kubernetes restricted pod security standards.

Variable	Type	Default	Description
SECURITY_CONTEXT_READ_ONLY_FS	bool	false	When true, the app avoids writing to the root filesystem — all writes go to /tmp or configured mounts.
SECURITY_CONTEXT_RUN_AS_NON_ROOT	bool	true	Informational — the container enforces this via USER directive. The app uses this flag for self-checks.
SECURITY_CONTEXT_RUN_AS_USER	int	1001	The UID the container process runs as.

Model Storage

Variable	Type	Default	Description
ARBITEX_AI_MODELS_PATH	string	""	Root filesystem path for training data and fine-tuned model artifacts.

Admission Control

Variable	Type	Default	Description
ADMISSION_CONTROL_ENABLED	bool	true	Toggle admission control middleware that sheds load under pressure.
ADMISSION_POOL_THRESHOLD	float	0.85	Database connection pool fill ratio (0.0–1.0) that triggers request rejection.
ADMISSION_STREAM_LIMIT	int	500	Maximum concurrent streaming responses before admission control activates.
ADMISSION_LOOP_LAG_MS	int	50	Event loop lag threshold in milliseconds for admission control.

Encryption Keys

Caution

These Fernet keys encrypt data at rest. Generate with python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())". Rotate by re-encrypting stored data with the new key.

Variable	Type	Default	Description
ATTACHMENT_ENCRYPTION_KEY	string	""	Fernet key for encrypting stored file attachments. Required in production when file uploads are enabled.
MCP_TOKEN_ENCRYPTION_KEY	string	""	Fernet key for encrypting MCP server OAuth tokens. Required when MCP_ENABLED=true.

Email Relay

Variables consumed by the email relay module when deployed as a scanning MTA.

Variable	Type	Default	Description
QUARANTINE_DIR	string	/var/quarantine	Directory for quarantined email attachments that trigger DLP violations.
DOWNSTREAM_MTA_HOST	string	localhost	Hostname of the downstream MTA for relaying scanned email.

Model Management

Variable	Type	Default	Description
MODEL_RATE_LIMIT_ENABLED	bool	true	Toggle per-model rate limit enforcement.
PROVIDER_MODEL_CACHE_TTL	int	300	TTL in seconds for cached provider model lists.
MODEL_DISCOVERY_TTL_SECONDS	int	3600	TTL in seconds for cached provider model discovery responses (1 hour).
USAGE_AGGREGATION_INTERVAL_MINUTES	int	15	Minutes between scheduled usage aggregation runs.

SIEM — Sentinel

Variable	Type	Default	Description
SENTINEL_TENANT_ID	string	""	Azure AD tenant ID for Microsoft Sentinel integration.
SENTINEL_CLIENT_ID	string	""	Azure AD application client ID.
SENTINEL_CLIENT_SECRET	string	""	Azure AD application client secret.
SENTINEL_DCE_ENDPOINT	string	""	Data Collection Endpoint URL for Azure Monitor Ingestion API.
SENTINEL_DCR_IMMUTABLE_ID	string	""	Data Collection Rule immutable ID.
SENTINEL_STREAM_NAME	string	""	Custom log stream name in the DCR.
SENTINEL_BATCH_SIZE	int	100	Events per batch request.
SENTINEL_FLUSH_INTERVAL	float	5.0	Seconds between batch flush operations.
SENTINEL_MAX_RETRIES	int	3	Maximum retry attempts for failed batch requests.
SENTINEL_DEAD_LETTER_PATH	string	""	Path to a dead-letter JSONL file for undeliverable events.

SIEM — Datadog

Variable	Type	Default	Description
DATADOG_API_KEY	string	""	Datadog API key for log ingestion.
DATADOG_SITE	string	datadoghq.com	Datadog site domain (e.g. datadoghq.eu for EU).
DATADOG_SOURCE	string	arbitex	Source tag applied to ingested logs.
DATADOG_SERVICE	string	arbitex-platform	Service tag applied to ingested logs.
DATADOG_TAGS	string	env:production	Comma-separated tags applied to all ingested logs.
DATADOG_BATCH_SIZE	int	100	Events per batch request.
DATADOG_FLUSH_INTERVAL	float	5.0	Seconds between batch flush operations.
DATADOG_MAX_RETRIES	int	3	Maximum retry attempts for failed batch requests.
DATADOG_DEAD_LETTER_PATH	string	""	Path to a dead-letter JSONL file for undeliverable events.

SIEM — Sumo Logic

Variable	Type	Default	Description
SUMO_HTTP_SOURCE_URL	string	""	Sumo Logic HTTP Source URL for log ingestion.
SUMO_SOURCE_CATEGORY	string	arbitex/audit	Source category applied to ingested data.
SUMO_SOURCE_NAME	string	arbitex-platform	Source name applied to ingested data.
SUMO_SOURCE_HOST	string	hostname	Source host identifier (defaults to system hostname).
SUMO_BATCH_SIZE	int	100	Events per batch request.
SUMO_FLUSH_INTERVAL	float	5.0	Seconds between batch flush operations.
SUMO_MAX_RETRIES	int	3	Maximum retry attempts for failed batch requests.
SUMO_DEAD_LETTER_PATH	string	""	Path to a dead-letter JSONL file for undeliverable events.

SIEM — Cortex XSIAM

Variable	Type	Default	Description
XSIAM_URL	string	""	Cortex XSIAM ingestion API URL.
XSIAM_API_KEY	string	""	Cortex XSIAM API key.
XSIAM_VENDOR	string	Arbitex	Vendor label sent with ingested events.

Development and Testing

Caution

These variables exist for local development and CI pipelines. Never set them in staging or production.

Variable	Type	Default	Description
DB_BOOTSTRAP	bool	false	When set, Alembic migration failure falls back to create_all + stamp. Development only.
ARBITEX_SKIP_ALEMBIC	bool	false	Skip Alembic migrations at startup. Use only in test harnesses.
ARBITEX_ENV	string	""	Alternative to ENVIRONMENT for production mode detection in the health endpoint.

---

Cloud

Service decommissioned

The arbitex-cloud service was decommissioned on 2026-07-28 and its host cloud.arbitex.ai no longer resolves. The variables in this section are retained for historical reference and for operators maintaining older deployments; they have no effect on current installations. Administrative configuration is now performed in the Arbitex admin console.

The Cloud Portal service (arbitex-cloud) provided the multi-tenant management plane: organisation provisioning, SSO, billing, and the web dashboard.

Database

Variable	Type	Default	Description
DATABASE_URL	string	—	PostgreSQL connection string using asyncpg. Required.

Authentication

Variable	Type	Default	Description
JWT_SECRET	string	""	HMAC HS256 signing secret (fallback when RSA keys are not configured).
JWT_PRIVATE_KEY_PATH	string	""	Path to RSA private key PEM for RS256 signing (primary — takes precedence over JWT_SECRET).
JWT_PUBLIC_KEY_PATH	string	""	Path to RSA public key PEM for RS256 verification.
ADMIN_API_KEY_HASH	string	""	SHA-256 hash of the admin API key used for machine-to-machine calls to Cloud management endpoints.
ADMIN_API_KEY_PEPPER	string	""	HMAC pepper mixed with the raw admin API key before hashing, to prevent pre-computation attacks.

Redis

Variable	Type	Default	Description
REDIS_URL	string	""	Redis URL used for JWT caching and session state. Must use rediss:// (TLS) in production.

Deployment Environment

Variable	Type	Default	Description
ENVIRONMENT	string	development	Deployment environment: development or production.
SECRETS_BACKEND	string	env	Active secrets backend. Must be vault or azure_keyvault in production.

Platform Integration

Variable	Type	Default	Description
PLATFORM_PROVISIONER_URL	string	""	URL of the Platform provisioner endpoint used when creating new organisations.
PLATFORM_API_BASE_URL	string	""	Base URL of the Platform API for proxied management calls.
PLATFORM_LOGIN_URL	string	""	Platform SSO login URL surfaced to users.
PROVISIONER_TIMEOUT	int	30	Timeout in seconds for provisioner calls.
PLATFORM_CA_CERT_PATH	string	""	Path to Platform CA certificate for mTLS verification of outbound calls.

mTLS

Variable	Type	Default	Description
CLOUD_SERVICE_CERT_PATH	string	""	Path to Cloud mTLS client certificate presented to Platform.
CLOUD_SERVICE_KEY_PATH	string	""	Path to Cloud mTLS client private key.

Step CA

Variable	Type	Default	Description
STEP_CA_URL	string	""	Step CA server URL for automated certificate provisioning.
STEP_CA_ROOT	string	""	Step CA root certificate (PEM) used to verify the Step CA server.
STEP_CA_PROVISIONER	string	cloud-outpost	Step CA provisioner name.
STEP_CA_KID	string	""	Key ID of the Step CA JWK provisioner.
STEP_CA_KEY	string	""	JWK private key for the Step CA provisioner.

CORS

Variable	Type	Default	Description
CORS_ORIGINS	string	https://cloud.arbitex.ai	Comma-separated allowed CORS origins.

SSO and Sessions

Variable	Type	Default	Description
SSO_SESSION_TIMEOUT	int	28800	SSO session inactivity timeout in seconds (default 8 hours).
SSO_MAX_CONCURRENT_SESSIONS	int	5	Maximum concurrent SSO sessions per user.
SSO_SESSION_TTL	int	14400	Absolute SSO session TTL in seconds (default 4 hours).
ENABLE_PKCE	bool	true	Enable PKCE challenge store for OAuth2 authorization code flows.
SESSION_COOKIE_SECURE	bool	true	Set the Secure flag on SSO session cookies. Set false only for non-TLS local development.
SESSION_CHECK_FAIL_MODE	string	closed	Behaviour when Redis is unavailable during session inactivity check: closed (reject — production default) or open (allow — development fallback).

Rate Limiting

Variable	Type	Default	Description
RATE_LIMIT_ADMIN_EXEMPT	bool	false	When true, admin-role users bypass rate limiting.

Internal

Variable	Type	Default	Description
INTERNAL_API_KEY	string	""	Shared key for inter-service notification calls between Cloud and Platform.
CLOUD_BASE_URL	string	https://cloud.arbitex.ai	Public base URL of the Cloud portal, used in emails and redirects.

Email

Variable	Type	Default	Description
SMTP_FROM_NAME	string	Arbitex Cloud	Display name in the From header for Cloud transactional emails.
SMTP_FROM_EMAIL	string	[email protected]	From address for Cloud transactional emails.

Billing

Caution

Stripe keys grant billing access. Inject them via secrets backend in production — never commit to version control.

Variable	Type	Default	Description
STRIPE_SECRET_KEY	string	""	Stripe secret API key for billing operations.
STRIPE_WEBHOOK_SECRET	string	""	Stripe webhook signing secret for verifying inbound events.
STRIPE_PRICE_DEVPRO	string	""	Stripe price ID for the Dev Pro plan.
STRIPE_PRICE_TEAM	string	""	Stripe price ID for the Team plan.
STRIPE_PRICE_ENTERPRISE	string	""	Stripe price ID for the Enterprise plan.
SALES_EMAIL	string	[email protected]	Sales team email for enterprise inquiry notifications.

Security Context

Variable	Type	Default	Description
SECURITY_CONTEXT_READ_ONLY_FS	bool	false	When true, the app avoids writing to the root filesystem.
RUN_AS_NON_ROOT	bool	true	Informational — validates the process is not running as root at startup.
RUN_AS_USER	int	—	Expected UID the container process runs as (informational self-check).

Step CA (development)

Variable	Type	Default	Description
STEP_CA_INSECURE	bool	false	Allow insecure Step CA connections. Rejected in production. Development only.
OUTPOST_CA_CERT_PATH	string	""	CA certificate path for verifying Outpost mTLS client certificates during registration.

Observability

Variable	Type	Default	Description
OTEL_EXPORTER_OTLP_ENDPOINT	string	""	OTel OTLP gRPC endpoint. Empty disables export.
OTEL_SERVICE_NAME	string	arbitex-cloud	OTel resource service name.
PROMETHEUS_METRICS_ENABLED	string	""	Set to any non-empty value to expose the /metrics Prometheus endpoint.

---

Outpost

The Outpost (arbitex-outpost) is a self-hosted proxy deployed within a customer environment. It enforces policies locally, buffers audit events, and forwards AI traffic to the Platform.

Identity

Variable	Type	Default	Description
OUTPOST_ID	string	""	UUID assigned to this Outpost by the Cloud portal. Required.
ORG_ID	string	""	Organisation UUID this Outpost belongs to. Required.
OUTPOST_SITE	string	""	Logical site or datacenter name for fleet grouping in the Cloud portal.
OUTPOST_ZONE	string	""	Availability zone within the site for fleet grouping.

Platform Connection

Variable	Type	Default	Description
PLATFORM_MANAGEMENT_URL	string	""	Management plane URL for policy sync and audit upload. Required.
CLOUD_HEARTBEAT_URL	string	""	Cloud heartbeat endpoint. When set, the Outpost sends periodic liveness signals.
CLOUD_HEARTBEAT_INTERVAL	int	60	Heartbeat interval in seconds.
POLICY_SYNC_INTERVAL	int	60	Seconds between policy re-sync requests to the Platform.

mTLS Certificates

Variable	Type	Default	Description
OUTPOST_CERT_PATH	string	certs/outpost.pem	Path to the mTLS client certificate issued by Platform CA.
OUTPOST_KEY_PATH	string	certs/outpost.key	Path to the mTLS client private key.
OUTPOST_CA_PATH	string	certs/ca.pem	Path to the Platform CA certificate used to verify server identity.
ARBITEX_CA_PIN_PATH	string	""	Path to the Arbitex CA certificate used for CA pinning on outbound connections. When set, the Outpost trusts only this CA for Platform and Cloud connections (ignoring the system CA bundle).
CERT_BUNDLE_AUTO_DOWNLOAD	bool	false	Download the certificate bundle from Platform at startup.
CERT_BUNDLE_SIGNING_KEY	string	""	HMAC key used to verify the integrity of downloaded certificate bundles.

Inbound TLS

Variable	Type	Default	Description
TLS_MIN_VERSION	string	TLSv1.2	Minimum TLS version accepted from clients.
TLS_MAX_VERSION	string	TLSv1.3	Maximum TLS version accepted from clients.
TLS_VERIFY_CLIENT	bool	false	Require clients to present a valid certificate (mutual TLS).
TLS_CA_CERT_PATH	string	null	CA certificate path for verifying client certificates when TLS_VERIFY_CLIENT=true.
TLS_SERVER_CERT_PATH	string	null	Path to the server TLS certificate.
TLS_SERVER_KEY_PATH	string	null	Path to the server TLS private key.

Local Storage

Variable	Type	Default	Description
POLICY_CACHE_PATH	string	policy_cache/	Directory for cached policy bundles used when the Platform is unreachable.
AUDIT_BUFFER_PATH	string	audit_buffer/	Directory for on-disk audit event buffers.
AUDIT_QUEUE_DB_PATH	string	audit_queue/audit_queue.db	SQLite database for the audit queue used in degraded mode.
USAGE_DB_PATH	string	usage_data/usage.db	SQLite database for per-organisation usage tracking.
BACKUP_DIR	string	""	Directory for configuration backup snapshots.

DLP Pipeline

Variable	Type	Default	Description
DLP_ENABLED	bool	true	Enable the DLP scanning pipeline.
DLP_SCANNING_DISABLED	bool	false	DEV ONLY. Fully disables DLP when true AND OUTPOST_ENV=development.
DLP_NER_ENABLED	bool	true	Enable Tier 2 NER entity detection.
DLP_NER_MODEL	string	en_core_web_sm	spaCy model name loaded for NER.
DLP_NER_DEVICE	string	auto	Inference device: auto, cpu, or cuda.
DLP_THREAD_POOL_SIZE	int	4	Thread pool size for CPU-bound DLP operations. Should match available CPU cores.
DLP_DEBERTA_ENABLED	bool	false	Enable Tier 3 DeBERTa contextual classification.
DEBERTA_MODEL_PATH	string	""	Path to the DeBERTa ONNX model file.
DEBERTA_INTRA_OP_THREADS	int	0	ONNX Runtime intra-op thread count (0 = auto-detect from CPU cores).
DEBERTA_INTER_OP_THREADS	int	1	ONNX Runtime inter-op thread count.
TIER0_PROMPT_INJECTION_ENABLED	bool	true	Enable Tier 0 TF-IDF/LR prompt injection pre-filter.
TIER0_CONFIDENCE_THRESHOLD	float	0.95	Minimum confidence for Tier 0 to flag prompt injection.
TIER0_MODEL_PATH	string	""	Path to a custom Tier 0 joblib model file. Uses the bundled model when empty.
IMAGE_OCR_ENABLED	bool	false	Enable Tesseract OCR for base64 image content in chat messages.
IMAGE_OCR_MAX_FILE_SIZE_MB	int	20	Maximum image size in MB for OCR processing.
IMAGE_OCR_TIMEOUT_SECONDS	int	30	Timeout per image for OCR in seconds.

Audit and Integrity

Variable	Type	Default	Description
AUDIT_HMAC_KEY	string	""	HMAC-SHA256 key for audit record integrity. Required in production.
AUDIT_CHAIN_ENABLED	bool	false	Enable HMAC chaining between consecutive audit records.
AUDIT_SYNC_INTERVAL_SECONDS	int	30	Seconds between audit buffer sync to Platform.
AUDIT_SYNC_BATCH_MIN	int	10	Minimum adaptive audit sync batch size.
AUDIT_SYNC_BATCH_MAX	int	100	Maximum adaptive audit sync batch size.
AUDIT_SYNC_BANDWIDTH_ADAPTIVE	bool	true	Enable bandwidth-adaptive audit sync batch sizing.
MAX_AUDIT_BUFFER_ENTRIES	int	100000	Maximum entries in the in-memory audit ring buffer.

GeoIP

Variable	Type	Default	Description
GEOIP_MMDB_PATH	string	""	Path to a MaxMind GeoIP2 City MMDB file.
GEOIP_MMDB_FALLBACK_PATH	string	""	Path to a fallback MMDB used when the primary cannot be loaded.
GEOIP_MMDB_BUNDLED_PATH	string	/opt/outpost/geoip/GeoLite2-City.mmdb	Path to the MMDB bundled into the container image.
GEOIP_DOWNLOAD_ON_START	bool	false	Download an updated MMDB from GEOIP_DOWNLOAD_URL at startup.
GEOIP_DOWNLOAD_URL	string	""	URL from which to download the GeoIP MMDB.
GEOIP_ANON_DB_PATH	string	""	Path to a MaxMind Anonymous IP MMDB.
GEOIP_ANON_BUNDLED_PATH	string	/opt/outpost/geoip/GeoIP2-Anonymous-IP.mmdb	Container-baked Anonymous IP MMDB path.
IP2LOCATION_DB_PATH	string	""	Path to IP2Location BIN database (legacy fallback provider).

Policy Bundle Security

Caution

INSECURE_SKIP_HMAC=true disables policy bundle integrity verification entirely. This flag is for local development only and must never be set in staging or production deployments.

Variable	Type	Default	Description
POLICY_HMAC_KEY	string	""	HMAC key used to verify the integrity of policy bundles received from Platform. Required in production.
INSECURE_SKIP_HMAC	bool	false	DEV ONLY. Skip HMAC verification of policy bundles. Never enable in production.
POLICY_BUNDLE_VERIFY	bool	true	Enable policy bundle verification. Set false only in development environments.

Authentication and API Keys

Variable	Type	Default	Description
OUTPOST_API_KEY	string	""	Bearer token required for /v1/chat/completions calls. When empty, the endpoint accepts unauthenticated requests.
OUTPOST_EMERGENCY_ADMIN_KEY	string	""	Emergency admin key for break-glass access when the admin JWT service is unavailable.
PROVIDER_KEY_ENCRYPTION_KEY	string	""	Fernet key used to encrypt provider API keys stored on disk.

Admin Interface

Variable	Type	Default	Description
ADMIN_PORT	int	8301	Port the admin HTTP interface listens on.
ADMIN_JWT_SECRET	string	""	Signing key for admin JWT tokens. When empty, JWT authentication on the admin interface is disabled.
ADMIN_JWT_EXPIRY_SECONDS	int	3600	Admin JWT token expiry in seconds (default 1 hour).

Replay Protection

Variable	Type	Default	Description
REPLAY_PROTECTION_ENABLED	bool	false	Enable request replay protection using a nonce cache.
REPLAY_PROTECTION_TTL_SECONDS	int	60	Seconds to retain nonces in the replay protection cache.

Circuit Breakers

Variable	Type	Default	Description
CIRCUIT_BREAKER_FAILURE_THRESHOLD	int	5	Number of failures before the circuit opens.
CIRCUIT_BREAKER_RECOVERY_TIMEOUT	int	30	Seconds before a tripped circuit transitions to half-open.
CIRCUIT_BREAKER_HALF_OPEN_MAX_REQUESTS	int	3	Number of probe requests allowed in the half-open state.

Budget Enforcement

Variable	Type	Default	Description
BUDGET_ENFORCEMENT_ENABLED	bool	true	Enforce organisation and user token budget caps.

Prompt Hold Queue

Variable	Type	Default	Description
PROMPT_HOLD_TIMEOUT_SECONDS	int	300	Seconds a held prompt waits for approval before being blocked automatically.
PROMPT_HOLD_QUEUE_MAX	int	100	Maximum number of prompts that can be simultaneously pending in the hold queue.
PROMPT_HOLD_OVERFLOW	string	reject	Behaviour when the hold queue is full: reject (return error) or evict (remove oldest entry).
PROMPT_HOLD_TTL_SECONDS	int	86400	Maximum hold record TTL in seconds (default 24 hours).

Rate Limiting

Variable	Type	Default	Description
RATE_LIMIT_ENABLED	bool	true	Enable rate limiting on Outpost endpoints.
RATE_LIMIT_REQUESTS_PER_MINUTE	int	60	RPM limit applied to /v1/chat/completions.
RATE_LIMIT_BURST	int	10	Burst capacity above the sustained RPM limit.
RATE_LIMIT_SCAN_PER_MINUTE	int	120	RPM limit for /v1/scan requests.
RATE_LIMIT_ADMIN_PER_MINUTE	int	30	RPM limit for /admin/* endpoints.
RATE_LIMIT_DEFAULT_PER_MINUTE	int	60	Default RPM limit applied to all other endpoints.

Request Validation

Variable	Type	Default	Description
MAX_REQUEST_BODY_MB	int	10	Maximum request body size in megabytes.
REQUEST_MAX_BODY_BYTES	int	1048576	Maximum request body size in bytes (1 MB). Takes precedence over MAX_REQUEST_BODY_MB when set.

SIEM Direct Sink

Caution

INSECURE_ALLOW_HTTP=true permits unencrypted HTTP connections to the SIEM endpoint. This flag is for development and testing only and must never be used in production.

Variable	Type	Default	Description
SIEM_DIRECT_ENABLED	bool	false	Enable the SIEM direct sink for real-time event forwarding.
SIEM_DIRECT_TYPE	string	splunk_hec	SIEM sink type: splunk_hec or syslog.
SIEM_DIRECT_URL	string	""	SIEM endpoint URL.
SIEM_DIRECT_TOKEN	string	""	Authentication token for the SIEM endpoint.
SIEM_DIRECT_BUFFER_CAPACITY	int	10000	Ring buffer capacity for SIEM event batching.
SIEM_DIRECT_DEAD_LETTER_PATH	string	""	Path to the dead-letter JSONL file for events that could not be delivered.
SIEM_DIRECT_DLQ_RETRY_INTERVAL	int	300	Seconds between dead-letter queue retry attempts.
SIEM_DIRECT_DLQ_MAX_RETRIES	int	3	Maximum retries for dead-letter queue events before permanent discard.
SIEM_OUTPUT	string	syslog	Output format for the syslog sink: syslog (RFC 5424) or cef (CEF).
INSECURE_ALLOW_HTTP	bool	false	DEV ONLY. Allow unencrypted HTTP connections to the SIEM endpoint. Never enable in production.

OAuth JWT Validation

Variable	Type	Default	Description
OAUTH_JWT_PUBLIC_KEY	string	""	RSA public key (PEM) for validating M2M OAuth JWTs presented by callers.
OAUTH_JWKS_URL	string	""	JWKS endpoint URL for dynamic public key retrieval.
OAUTH_JWKS_CACHE_TTL	int	300	Seconds to cache JWKS responses.
OAUTH_SCOPE_ENFORCEMENT	bool	false	Enforce OAuth scope claims on incoming requests.

Credential Intelligence

Variable	Type	Default	Description
CREDINT_ENABLED	bool	true	Enable local Credential Intelligence bloom filter scanning.
CREDINT_BLOOM_PATH	string	""	Path to the local bloom filter .bf file.
CREDINT_CDN_URL	string	""	CDN URL for downloading bloom filter updates.
CREDINT_REFRESH_INTERVAL_SECONDS	int	86400	Seconds between CDN bloom filter refresh checks (default 24 hours).
CREDINT_KANON_ENABLED	bool	false	Enable k-anonymity API check as a second-stage credential validation.
CREDINT_KANON_URL	string	https://api.pwnedpasswords.com/range	k-anonymity API endpoint.

Software Updates

Variable	Type	Default	Description
SOFTWARE_UPDATE_RELEASE_URL	string	""	URL of the release manifest checked for available updates.
SOFTWARE_UPDATE_SIGNING_KEY	string	""	Ed25519 public key used to verify release manifest signatures.
SOFTWARE_UPDATE_ED25519_KEY	string	""	Alias for SOFTWARE_UPDATE_SIGNING_KEY. Takes precedence when both are set.
SOFTWARE_UPDATE_STAGE_DIR	string	/tmp/outpost-update-stage	Directory used to stage downloaded update packages before applying.

Air-Gap Mode

Variable	Type	Default	Description
OUTPOST_AIRGAP	bool	false	Enable air-gap mode. Disables all outbound network calls; policies and models must be provided on disk.
AIRGAP_POLICY_PATH	string	/opt/arbitex/policies	Directory containing policy bundles for air-gapped deployments.
AIRGAP_MODEL_PATH	string	/opt/arbitex/models	Directory containing DLP model artifacts for air-gapped deployments.

Observability

Variable	Type	Default	Description
LOG_LEVEL	string	info	Logging level: debug, info, warning, error.
LOG_FORMAT	string	text	Log output format: text or json.
DEBUG	bool	false	Enable debug mode.
LOG_ROTATION_ENABLED	bool	false	Enable file-based log rotation.
LOG_MAX_BYTES	int	104857600	Maximum log file size in bytes before rotation (default 100 MB).
LOG_BACKUP_COUNT	int	5	Number of rotated log backup files to retain.
OTEL_ENABLED	bool	false	Enable OpenTelemetry trace and metric export.
OTEL_EXPORTER_ENDPOINT	string	""	OTLP gRPC endpoint for OTel export.
OTEL_SERVICE_NAME	string	arbitex-outpost	OTel resource service name.
PUSHGATEWAY_ENABLED	bool	false	Enable Prometheus Pushgateway metrics export.
PUSHGATEWAY_URL	string	""	Pushgateway endpoint URL.
PUSHGATEWAY_JOB	string	outpost	Job label sent with Pushgateway metrics.
PUSHGATEWAY_INTERVAL_SECONDS	int	60	Seconds between Pushgateway push operations.
PUSHGATEWAY_INSTANCE	string	""	Instance label sent with Pushgateway metrics.

Log Export

Variable	Type	Default	Description
LOG_EXPORT_ENABLED	bool	false	Enable audit log export to local files.
LOG_EXPORT_PATH	string	/var/log/outpost/audit/	Directory to write exported audit log files.
LOG_EXPORT_FORMAT	string	jsonl	Export format: jsonl or csv.
LOG_EXPORT_ROTATION_MB	int	100	Rotate the export file after it reaches this size in megabytes.
LOG_EXPORT_MAX_FILES	int	10	Maximum number of rotated export files to retain.

Disk Monitoring

Variable	Type	Default	Description
DISK_MONITOR_ENABLED	bool	false	Enable disk usage monitoring.
DISK_MONITOR_PATH	string	/	Filesystem mount point to monitor.
DISK_MONITOR_INTERVAL_SECONDS	int	300	Seconds between disk usage checks (default 5 minutes).
DISK_WARN_THRESHOLD_PCT	float	75.0	Disk usage percentage at which a warning is emitted.
DISK_CRITICAL_THRESHOLD_PCT	float	90.0	Disk usage percentage at which a critical alert is emitted.

Certificate Rotation

Variable	Type	Default	Description
CERT_AUTO_ROTATE	bool	false	Enable automatic certificate rotation via Step CA.
CERT_ROTATION_THRESHOLD_DAYS	int	30	Days before certificate expiry at which rotation is triggered.

Connection Pool

Variable	Type	Default	Description
PLATFORM_MAX_CONNECTIONS	int	100	Maximum total HTTP connections in the Platform connection pool.
PLATFORM_MAX_KEEPALIVE	int	20	Maximum keep-alive connections retained in the pool.
PLATFORM_KEEPALIVE_EXPIRY	int	30	Keep-alive connection expiry in seconds.

Policy Cache

Variable	Type	Default	Description
POLICY_CACHE_ENABLED	bool	true	Enable in-memory policy caching.
POLICY_CACHE_TTL_SECONDS	int	30	Seconds before a cached policy bundle is considered stale.

Graceful Shutdown

Variable	Type	Default	Description
SHUTDOWN_TIMEOUT	int	30	Seconds to wait for in-flight requests to complete before forceful shutdown.
SHUTDOWN_DRAIN_TIMEOUT_SECONDS	int	30	Seconds to allow the DLP pipeline to drain during shutdown.
DRAIN_TIMEOUT_SECONDS	int	30	Seconds after SIGTERM before the process exits regardless of drain state.

Cluster Health

Variable	Type	Default	Description
CLUSTER_PEERS	string	""	Comma-separated URLs of peer Outpost instances for cluster health aggregation.
CLUSTER_HEALTH_TIMEOUT	float	3.0	Timeout in seconds when querying peer health endpoints.
CLUSTER_HEALTH_AUTH_KEY	string	""	Shared auth key required for peer health queries.

IP Allowlist

Variable	Type	Default	Description
IP_ALLOWLIST_ENABLED	bool	false	Enable IP allowlist enforcement on client requests.
IP_ALLOWLIST_CIDRS	string	""	Comma-separated CIDRs permitted to send requests.
IP_ALLOWLIST_ADMIN_EXEMPT	bool	true	Admin endpoints bypass the IP allowlist.

Body Hash Logging

Variable	Type	Default	Description
BODY_HASH_LOGGING_ENABLED	bool	false	Enable SHA hashing of request and response bodies for audit non-repudiation.
BODY_HASH_ALGORITHM	string	sha256	Hash algorithm: sha256 or sha512.
BODY_HASH_LOG_RESPONSE	bool	false	Also hash response bodies in addition to request bodies.

Plugin System

Variable	Type	Default	Description
PLUGINS_ENABLED	bool	false	Enable the plugin system.
PLUGIN_DIR	string	./plugins	Directory scanned for plugin packages at startup.

Webhook Emitter

Variable	Type	Default	Description
WEBHOOK_EMIT_ENABLED	bool	false	Enable outbound webhook emission for audit events.
WEBHOOK_EMIT_URL	string	""	Target URL for webhook event delivery.
WEBHOOK_EMIT_SECRET	string	""	HMAC secret used to sign webhook payloads.

Custom Redaction

Variable	Type	Default	Description
CUSTOM_REDACTION_PATTERNS	string	""	JSON array of custom regex redaction patterns applied in addition to built-in DLP rules.

Multi-Org Mode

Variable	Type	Default	Description
MULTI_ORG_MODE	bool	false	Enable multi-organisation mode, allowing a single Outpost to serve multiple organisations.
MAX_ORGS_PER_OUTPOST	int	10	Maximum number of organisations a single Outpost instance may serve in multi-org mode.

Connection Health

Periodic platform health probes that measure latency, jitter, and packet loss to determine connection quality.

Variable	Type	Default	Description
CONNECTION_HEALTH_ENABLED	bool	true	Enable periodic platform health probes.
CONNECTION_HEALTH_INTERVAL	int	30	Seconds between connection health probes.
CONNECTION_HEALTH_LATENCY_WARN_MS	int	500	Average latency (ms) threshold for DEGRADED status.
CONNECTION_HEALTH_LATENCY_CRIT_MS	int	2000	Average latency (ms) threshold for CRITICAL status.
CONNECTION_HEALTH_LOSS_WARN_PCT	float	5.0	Packet loss percentage threshold for DEGRADED status.
CONNECTION_HEALTH_LOSS_CRIT_PCT	float	20.0	Packet loss percentage threshold for CRITICAL status.
CONNECTION_HEALTH_WINDOW_SIZE	int	60	Sliding window (probe count) for health metric computation. At 30 s interval this covers ~30 minutes.

Provider Connection Pool

Controls the HTTP connection pool used for outbound calls to LLM provider APIs.

Variable	Type	Default	Description
PROVIDER_MAX_CONNECTIONS	int	100	Maximum total HTTP connections to LLM providers.
PROVIDER_MAX_KEEPALIVE_CONNECTIONS	int	20	Maximum keep-alive connections retained in the pool.
PROVIDER_CONNECT_TIMEOUT	float	5.0	Provider connection timeout in seconds.
PROVIDER_READ_TIMEOUT	float	30.0	Provider read timeout in seconds.
PROVIDER_WRITE_TIMEOUT	float	5.0	Provider write timeout in seconds.
PROVIDER_POOL_TIMEOUT	float	10.0	Pool acquisition timeout in seconds. Returns 503 if exceeded.

Enrichment Service

Variable	Type	Default	Description
ENRICHMENT_SERVICE_URL	string	""	Arbitex enrichment service URL — fallback when local MMDB returns no result.
ENRICHMENT_CACHE_MAXSIZE	int	32768	Maximum entries in the local enrichment response cache.
ENRICHMENT_CACHE_TTL	float	86400.0	TTL in seconds for cached enrichment responses (default 24 hours).

Credential Sync

Variable	Type	Default	Description
CREDENTIAL_SYNC_ENABLED	bool	false	Enable unified credential validation from policy bundles.
CREDENTIAL_GRACE_WINDOW_BUFFER	int	60	Seconds of buffer before platform grace period expiry to account for clock skew.

Startup Behaviour

Variable	Type	Default	Description
STARTUP_QUEUE_TIMEOUT	float	30.0	Maximum seconds to hold inbound requests while subsystems initialise before returning 503.
STARTUP_BINDING_DELAY	bool	true	Delay HTTP listener accept until all critical subsystems are ready.
OUTPOST_CORS_ORIGINS	string	""	Comma-separated allowed CORS origins for the proxy app. * permitted only in development.

---

See also

• CLI Reference — command-line interface for Outpost management and diagnostics
• Deployment Guide — Docker Compose and Kubernetes deployment setup
• Outpost Admin API — HTTP API for Outpost runtime management