Configuration Reference

Complete configuration options reference

All configuration is done via environment variables. Variables can be set directly or loaded from a .env file in the working directory.

Use --dev-mode flag on rackd server to automatically disable COOKIE_SECURE and RATE_LIMIT_ENABLED for local development.

Server

VariableTypeDefaultDescription
DATA_DIRstring./dataDirectory for SQLite database and data files
LISTEN_ADDRstring:8080Address and port to listen on
REQUEST_TIMEOUTduration30sHTTP request timeout
LOG_FORMATstringtextLog format: text or json
LOG_LEVELstringinfoLog level: trace, debug, info, warn, error

Security

VariableTypeDefaultDescription
ENCRYPTION_KEYstring(empty)64 hex chars (32 bytes). Encrypts stored SNMP/SSH credentials, DNS provider tokens and webhook signing secrets at rest. Generate with openssl rand -hex 32. Without it (outside --dev-mode) the credentials/DNS features are disabled; with --dev-mode a random non-persistent key is used. Rotate with rackd credentials rotate-key
COOKIE_SECUREbooltrueSet Secure flag on session cookies (requires HTTPS). Disable for local dev without TLS
RATE_LIMIT_ENABLEDbooltrueEnable API rate limiting
RATE_LIMIT_REQUESTSint100Max requests per window per IP
RATE_LIMIT_WINDOWduration1mRate limit sliding window
LOGIN_RATE_LIMIT_REQUESTSint5Max login attempts per window per IP
LOGIN_RATE_LIMIT_WINDOWduration1mLogin rate limit sliding window
TRUST_PROXYboolfalseHonor X-Forwarded-For / X-Real-IP headers when determining the client IP (rate limiting, audit logging)
TRUSTED_PROXIESstring(empty)Comma-separated IPs/CIDRs of trusted reverse proxies (e.g. 127.0.0.1,10.0.0.0/8). Required when TRUST_PROXY=true: forwarded headers are honored only when the direct peer matches one of these networks, otherwise ignored (fail-closed)
SSRF_ALLOW_PRIVATE_TARGETSboolfalsePermit webhook and DNS provider endpoints on private ranges (RFC1918/CGNAT/ULA) for intentional internal integrations. Loopback, link-local (cloud metadata) and multicast targets are always blocked

Sessions

VariableTypeDefaultDescription
SESSION_TTLduration24hSession expiry after last activity
SESSION_STORE_TYPEstringsqliteSession store backend: sqlite or valkey
VALKEY_URLstringredis://localhost:6379/0Valkey/Redis URL (when SESSION_STORE_TYPE=valkey)

Initial Admin

These are only used on first startup when no users exist.

VariableTypeDefaultDescription
INITIAL_ADMIN_USERNAMEstring(empty)Bootstrap admin username
INITIAL_ADMIN_PASSWORDstring(empty)Bootstrap admin password (min 8 characters)
INITIAL_ADMIN_EMAILstringadmin@localhostBootstrap admin email
INITIAL_ADMIN_FULL_NAMEstringSystem AdministratorBootstrap admin display name

Discovery

VariableTypeDefaultDescription
DISCOVERY_INTERVALduration24hInterval between scheduled discovery scans
DISCOVERY_MAX_CONCURRENTint10Max concurrent host probes during a scan
DISCOVERY_TIMEOUTduration5sPer-host probe timeout
DISCOVERY_CLEANUP_DAYSint30Auto-delete discovered devices older than this
DISCOVERY_SCAN_ON_STARTUPboolfalseRun discovery scans immediately on server start
DISCOVERY_SNMPV2C_ENABLEDboolfalseEnable SNMPv2c probing during discovery

Audit

VariableTypeDefaultDescription
AUDIT_ENABLEDboolfalseEnable audit logging of API operations
AUDIT_RETENTION_DAYSint90Days to retain audit log entries

OAuth 2.1 (MCP)

VariableTypeDefaultDescription
MCP_OAUTH_ENABLEDboolfalseEnable OAuth 2.1 authentication for MCP endpoint
MCP_OAUTH_ISSUER_URLstring(empty)OAuth issuer URL (required when enabled)
MCP_OAUTH_ACCESS_TOKEN_TTLduration1hAccess token lifetime
MCP_OAUTH_REFRESH_TOKEN_TTLduration720hRefresh token lifetime (30 days)

Utilization Snapshots

VariableTypeDefaultDescription
SNAPSHOT_INTERVALduration1hInterval between network utilization snapshots
SNAPSHOT_RETENTION_DAYSint90Days to retain utilization snapshots

DNS

VariableTypeDefaultDescription
DNS_SYNC_INTERVALduration1hInterval between DNS zone sync operations

Duration Format

Duration values use Go duration syntax: 30s, 5m, 1h, 24h, 720h. Combine units: 1h30m.