Configuration and environment variables
Generated from the settings table in internal/config/keys.go. Environment variables win over deedglass.yaml. In prod, an unknown DEEDGLASS_* name is an error, and secrets are never written to logs or printed by deedglass config print.
Server settings
Section titled “Server settings”| Variable | deedglass.yaml |
Type | Default | What it does |
|---|---|---|---|---|
DEEDGLASS_ENV |
env |
enum | dev |
dev or prod. Prod ignores .env and dev secrets and refuses unsafe settings. Values: dev, prod. Used by: all. |
DEEDGLASS_DATABASE_URL |
database_url |
Postgres URL, secret | none; never logged or printed | The control-plane Postgres URL for the runtime role. Printed with only the password hidden. Prod needs sslmode=require or verify-full unless the host is loopback or a Unix socket. Used by: serve, migrate, org, dev. |
DEEDGLASS_MIGRATE_DATABASE_URL |
migrate_database_url |
Postgres URL, secret | none; never logged or printed | The control-plane Postgres URL for the migrator role (deedglass_migrator), used only by deedglass migrate. Dev falls back to DEEDGLASS_DATABASE_URL; prod requires it or –database-url. Used by: migrate. |
DEEDGLASS_LISTEN |
listen |
host:port | 127.0.0.1:8080 |
Address the API, the Gate and the Console listen on (host:port). Used by: serve. |
DEEDGLASS_BASE_URL |
base_url |
URL | http://127.0.0.1:8080 |
The URL people and agents use to reach this server. Prod needs https. Used by: serve, org login-link. |
DEEDGLASS_SEAL_KEY_FILE |
seal_key_file |
path | Path to the seal key file used to seal deeds. Used by: serve, keys. | |
DEEDGLASS_VAULT_KEY |
vault_key |
secret, secret | none; never logged or printed | A key ring of 1 to 4 comma-separated base64 keys of exactly 32 bytes; the first encrypts connector credentials, the rest only decrypt during a rotation (S16). config print shows only the key ids (kek:…). Dev generates one in .deedglass/. Used by: serve, vault, connector credentials. |
DEEDGLASS_API_KEY_PEPPER |
api_key_pepper |
secret, secret | none; never logged or printed | Base64 of at least 32 bytes, mixed into API key hashes. Keep it stable: changing it invalidates every API key. Dev generates one in .deedglass/. Used by: serve, org keys, agent keys. |
DEEDGLASS_LOG_LEVEL |
log_level |
enum | info |
Log level. Values: debug, info, warn, error. Used by: all. |
DEEDGLASS_SIGNUP |
signup |
enum | invite |
Who can join: invite (people an admin invites) or closed. Values: invite, closed. Used by: serve. |
DEEDGLASS_RESEND_API_KEY |
resend_api_key |
secret, secret | none; never logged or printed | Resend API key for sign-in and approval emails (starts with re_). Without it, dev prints emails to the log. Used by: serve. |
DEEDGLASS_MAIL_FROM |
mail_from |
string | The From address of sign-in and invite emails, e.g. Deedglass signin@deedglass.com. Required when DEEDGLASS_RESEND_API_KEY is set. Used by: serve, org create. | |
DEEDGLASS_ANTHROPIC_API_KEY |
anthropic_api_key |
secret, secret | none; never logged or printed | Optional Anthropic API key for Insights phrasing (starts with sk-ant-). Used by: serve, insights. |
DEEDGLASS_ANTHROPIC_MODEL |
anthropic_model |
string | claude-sonnet-5-5 |
The Claude model that rewords Insights suggestions when an org turns phrasing on (a model id like claude-sonnet-5-5, no date suffix). Used by: serve. |
DEEDGLASS_TRUSTED_PROXIES |
trusted_proxies |
CIDR list | Comma-separated CIDRs whose X-Forwarded-For is believed. Used by: serve. | |
DEEDGLASS_EGRESS_ALLOW_CIDRS |
egress_allow_cidrs |
CIDR list | Comma-separated CIDRs of private networks connectors may reach, in prod too, for example 10.20.0.0/16. Never cloud metadata, reserved, IPv4-embedding or loopback ranges. Deedglass’s own database is reachable only when its exact address is listed (a /32 or /128). Used by: serve. | |
DEEDGLASS_METRICS_LISTEN |
metrics_listen |
host:port | Address for a separate listener serving Prometheus metrics at /metrics (host:port). Off when unset; bind it to localhost or a private network. Used by: serve. | |
DEEDGLASS_SLOT_LAG_ALERT_MB |
slot_lag_alert_mb |
integer | 512 |
Alert when a Postgres replication slot holds more WAL than this (1-1048576 MB). Used by: serve. |
Client settings
Section titled “Client settings”Read by the CLI, the MCP commands and the SDKs; deedglass serve ignores them.
| Variable | deedglass.yaml |
Type | Default | What it does |
|---|---|---|---|---|
DEEDGLASS_API_KEY |
secret, secret | none; never logged or printed | An agent or admin API key (dg_live_… or dg_test_…) for client commands. Used by: CLI, mcp, SDKs. | |
DEEDGLASS_SERVER |
URL | The Deedglass server client commands talk to. Used by: CLI, mcp, SDKs. | ||
DEEDGLASS_INIT_DSN |
secret, secret | none; never logged or printed | The admin DSN deedglass connector postgres init connects with to prepare a customer database (a superuser, or a role with CREATEROLE such as the RDS master user). Read once, never stored or printed. Rename it with –admin-dsn-env. Used by: connector postgres init. | |
DEEDGLASS_NO_BANNER |
boolean | false |
Never show the terminal banner or the inline mark (bare deedglass, version, help). Scripts, pipes and CI never see them anyway. Used by: CLI. | |
DEEDGLASS_THEME |
enum | auto |
Draw the terminal mark for a light or dark terminal. auto: COLORFGBG decides, else dark. Values: auto, light, dark. Used by: CLI. |
|
DEEDGLASS_NO_ANIM |
boolean | false |
Turn off the Sealed animation at the end of deedglass init; only its final frame shows. Used by: CLI. | |
DEEDGLASS_LICENCE_FILE |
path | Where the Pro licence token lives (default .deedglass/licence.json); the key sits next to it as licence.key. Both are 0600. Free commands never read it. Used by: licence, scan –full. | ||
DEEDGLASS_NO_NETWORK |
boolean | false |
Never call Dodo Payments or deedglass.com. Pro keeps working on the cached licence inside its 14-day offline window. Used by: licence, scan –full. | |
DEEDGLASS_LICENCE_MODE |
enum | live |
Which Dodo Payments mode licence keys come from: live, or test for test-mode keys while setting up checkout. Values: live, test. Used by: licence, scan –full. |
|
DEEDGLASS_LICENCE_SERVER |
URL | Where licence tokens are signed (default https://deedglass.com); a local site in development. Used by: licence. |
Dev only
Section titled “Dev only”Refused when DEEDGLASS_ENV=prod.
| Variable | deedglass.yaml |
Type | Default | What it does |
|---|---|---|---|---|
DEEDGLASS_ALLOW_PRIVATE_NETWORKS |
allow_private_networks |
boolean | false |
Dev only: lets connectors reach private networks. Refused in prod. Used by: serve. |
DEEDGLASS_DECODER_PAUSE |
decoder_pause |
boolean | false |
Dev only: decoder runners stop reading after their current poll, so tests can see late evidence. Refused in prod. Used by: serve. |
Everything else
Section titled “Everything else”Tunable behaviour (gate.*, witness.*, decoder.*, approvals.*, webhooks.*, undo.*, mcp.*) lives in deedglass.yaml, not in new environment variables. The configuration engineering note lists every key.