Access, proxy, and notification environment
Session, proxy, authentication, WebAuthn, email, and webhook environment settings.
Access environment variables configure installation-wide session protection, proxy trust, bootstrap authentication defaults, and outbound mail.
Read environment loading before setting
values. Edit deployment values in the release bundle's infra.env or the corresponding
Kubernetes ConfigMap and Secret, then restart the affected service.
Sessions and proxy trust
INFRA_SESSION_SECRET
Type: string secret. Default: unset.
Required through this value or its file alternative. Must provide at least 32 bytes of secret material. Changing it invalidates existing web sessions without revoking API keys.
INFRA_SESSION_SECRET_FILE
Type: absolute secret path. Default: unset.
Alternative to INFRA_SESSION_SECRET; supplying both is rejected. Must be readable at startup and preserved for intended session continuity.
INFRA_SESSION_TTL_SECONDS
Type: integer seconds. Default: 43200.
Inclusive range 300–604800. Maximum ordinary session age; organization policy can shorten it.
INFRA_REAUTH_MAX_AGE_SECONDS
Type: integer seconds. Default: 900.
Inclusive range 60–3600. Maximum authentication age for actions requiring reauthentication. It cannot extend the enclosing session lifetime.
INFRA_TRUST_PROXY
Type: boolean. Default: false.
Enables trusted forwarded headers only from configured proxy ranges. When true, INFRA_TRUSTED_PROXY_CIDRS must be nonempty.
INFRA_TRUSTED_PROXY_CIDRS
Type: comma-separated CIDRs. Default: empty.
Trusted proxy source ranges. Invalid or all-address ranges are rejected. The edge must replace client-supplied forwarded values.
INFRA_ALLOWED_ORIGINS
Type: comma-separated HTTPS origins. Default: the public origin.
Additional approved browser origins. Wildcards, paths, and malformed origins reject startup. This is not a network firewall allowlist.
INFRA_COOKIE_DOMAIN
Type: DNS suffix. Default: host-only.
Optional shared domain for non-authentication preference cookies, permitted only for the public origin. A foreign domain is rejected. Authentication cookies with the __Host- prefix remain host-only and never receive a Domain attribute.
Authentication defaults
INFRA_AUTH_PASSWORD_ENABLED
Type: boolean. Default: true.
Allows local-password authentication where organization policy permits it. Disabling does not delete local members; retain a tested recovery path.
INFRA_AUTH_INVITE_ONLY
Type: boolean. Default: true.
Default member-enrollment policy for a new organization. Existing organization policy is not rewritten on restart.
INFRA_SAML_METADATA_URL
Type: HTTPS URL. Default: unset.
Optional bootstrap SAML provider metadata. Applied when creating the initial provider, not used to replace every organization's later SAML configuration.
INFRA_SAML_METADATA_FILE
Type: absolute input path. Default: unset.
Offline bootstrap alternative to the metadata URL. Supplying both is rejected; invalid SAML metadata blocks that bootstrap operation.
INFRA_WEBAUTHN_RP_ID
Type: DNS name. Default: public-origin hostname.
WebAuthn relying-party identity. Must be valid for the configured origins. Changing it can make existing security-key registrations unusable.
INFRA_WEBAUTHN_RP_NAME
Type: string. Default: Infra.
Display name presented during credential enrollment. An empty value is rejected; it does not determine credential scope.
INFRA_WEBAUTHN_REQUIRE_USER_VERIFICATION
Type: boolean. Default: true.
Requires the authenticator's supported user-verification step. Organization hardware-key policy can impose additional requirements.
Outbound email
INFRA_SMTP_ENABLED
Type: boolean. Default: false.
Enables SMTP notifications. Host and from-address become required. Disabling does not remove notification events or mark failed delivery successful.
INFRA_SMTP_HOST
Type: hostname. Default: unset.
Required when SMTP is enabled. DNS and transport must be reachable from the notification worker.
INFRA_SMTP_PORT
Type: integer port. Default: 587.
Inclusive range 1–65535. Must match the selected TLS mode and server listener.
INFRA_SMTP_TLS_MODE
Type: enum. Default: starttls.
Accepts starttls, tls, or none. Plain mode requires explicit deployment policy; the default does not downgrade when STARTTLS fails.
INFRA_SMTP_USERNAME
Type: string. Default: unset.
Authentication identity when the relay requires one. Omission uses an unauthenticated relay only where that relay permits it.
INFRA_SMTP_PASSWORD
Type: string secret. Default: unset.
Optional relay password, or use its file alternative. It is never written to delivery diagnostics.
INFRA_SMTP_PASSWORD_FILE
Type: absolute secret path. Default: unset.
Alternative to INFRA_SMTP_PASSWORD. Both sources together reject startup.
INFRA_SMTP_FROM
Type: email address. Default: unset.
Required when SMTP is enabled. Used as the sender address, not as an organization sign-in identity.
INFRA_SMTP_TIMEOUT_SECONDS
Type: integer seconds. Default: 15.
Inclusive range 1–120. Limits one relay attempt. Retry and alert state remain separate.
INFRA_WEBHOOK_TIMEOUT_SECONDS
Type: integer seconds. Default: 10.
Inclusive range 1–30. Maximum outbound event request duration; receivers should durably queue work before acknowledging.
INFRA_WEBHOOK_RETRY_WINDOW_SECONDS
Type: integer seconds. Default: 86400.
Inclusive range 300–604800. Maximum automatic retry window for retryable deliveries, measured from initial attempt. Retained-event replay is separate.