Configuration
InfraWard is configured through environment variables. In the container deployment, the common ones go in the .env next to compose.yml; the rest are passed as environment to api and worker. This page summarises the most important ones.
Deployment (Compose .env)
Section titled “Deployment (Compose .env)”| Variable | Default | Purpose |
|---|---|---|
INFRAWARD_REGISTRY |
Registry the web, api and worker images are pulled from |
|
INFRAWARD_VERSION |
latest |
Released version (vX.Y.Z) or latest |
INFRAWARD_PUBLIC_URL |
http://localhost:8080 |
URL browsers and servers use to reach the web UI. Outside localhost, https |
INFRAWARD_HTTP_PORT |
8080 |
Published web port |
ADMIN_EMAIL, ADMIN_PASSWORD |
Initial administrator; only created if there are no users | |
POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORD |
infraward |
Database |
COMPOSE_FILE |
with OpenBao | Enables OpenBao; remove it to use only the local provider |
WORKER_REPLICAS |
1 |
Worker replicas |
| Variable | Default | Purpose |
|---|---|---|
PUBLIC_URL |
Public URL servers download the enrolment script from | |
SESSION_TTL, SESSION_IDLE_TTL |
43200, 7200 |
Absolute and idle session lifetime (s) |
TRUST_PROXY |
loopback |
Trusted proxies for the real client IP |
LOGIN_THROTTLE_LIMIT, LOGIN_THROTTLE_TTL |
5, 60 |
Login attempt limit |
REAUTH_MAX_AGE |
600 |
Seconds after which sensitive actions require re-authentication |
ENROLLMENT_TOKEN_TTL |
1200 |
Enrolment token validity (900–1800 s) |
SECRETS_PROVIDERS |
local |
Active secrets providers (e.g. openbao,local) |
SECRETS_LOCAL_MASTER_KEY_FILE |
Local provider master key (32 bytes, base64) | |
VAULT_PROVIDER |
none |
Credential vault: none, local or openbao. API only |
TERMINAL_CERT_TTL |
120 |
Terminal certificate lifetime (30–300 s) |
OIDC login
Section titled “OIDC login”Enabled by OIDC_ISSUER. Also: OIDC_CLIENT_ID, OIDC_CLIENT_SECRET_REF (always a reference to the secrets provider, never plain text), OIDC_REDIRECT_URI, OIDC_ROLE_MAPPING (group=role), OIDC_GROUPS_CLAIM and OIDC_UNMAPPED (deny or viewer). With LOCAL_LOGIN=false, only the local emergency administrator can sign in with a password.
Worker
Section titled “Worker”| Variable | Default | Purpose |
|---|---|---|
HOST_MAX_JOBS, HOST_MAX_SCAN_JOBS |
2, 1 |
Concurrent jobs and scans against one server, across all replicas |
WORKER_SHUTDOWN_GRACE |
90 |
Seconds to wait for running jobs on shutdown |
COLLECT_TIMEOUT |
600 |
Maximum Ansible collection time (s) |
TRIVY_CACHE_DIR |
Trivy database cache (about 3 GB), shared by all replicas | |
TRIVY_DB_MAX_AGE |
12 |
Hours before the databases are downloaded again |
SBOM_REEVALUATE_INTERVAL |
24 |
Hours between re-evaluations of stored SBOMs (0 disables) |
VULN_INTEL_INTERVAL |
12 |
Hours between KEV and EPSS downloads |
KEV_URL, EPSS_URL |
public feeds | Empty disables that source (air-gapped environments) |
RECONCILE_TICK |
300 |
Seconds between reconciliation checks (0 turns it off) |
RECONCILE_RETIRE_AFTER |
3 |
Discoveries without seeing an asset before retiring it |
DOMAINS_DNS_SERVERS |
Custom DNS servers for domains; empty uses the system’s |
OpenBao
Section titled “OpenBao”Shared by the API and the worker when SECRETS_PROVIDERS includes openbao: OPENBAO_ADDR, OPENBAO_ROLE_ID, OPENBAO_SECRET_ID_FILE, OPENBAO_KV_MOUNT, OPENBAO_KV_PREFIX, OPENBAO_SSH_MOUNT and OPENBAO_SSH_ROLE. Authentication is always via AppRole, never a root token. The API, the worker, the vault and the terminal use separate AppRoles.
The full list will be in the repository’s .env.example files once it is published.