Configuration
Generated from the flag definitions in
server/cmd/lasboltd/config.go and the lasboltd --help output. Do not edit.lasboltd reads its settings from flags and from environment variables. Each flag has one variable. A flag on the command line wins over the variable.
Flags that the text marks “For tests” tune timing for the test suites. Leave them at their defaults on a real server.
| Flag | Environment variable | Default | Meaning |
|---|---|---|---|
--addr | LASBOLT_ADDR | :8080, dev: 127.0.0.1:8080 | listen address |
--allow-registration | LASBOLT_ALLOW_REGISTRATION=1 | off | let more than the first user register |
--approval-wait | LASBOLT_APPROVAL_WAIT | 20s | longest wait of one read call for a per-use approval; below –http-write-timeout. For tests |
--backup-dir | LASBOLT_BACKUP_DIR | <data-dir>/backups | backup directory |
--backup-identity | LASBOLT_BACKUP_IDENTITY | (none) | private key file to open sealed backups |
--backup-interval | LASBOLT_BACKUP_INTERVAL | 24h | time between backups, 0 turns backups off |
--backup-keep | LASBOLT_BACKUP_KEEP | 14 | number of backups to keep, 0 keeps all |
--backup-recipient | LASBOLT_BACKUP_RECIPIENT | (none) | public key file: seal backups to it |
--ctl-socket | LASBOLT_CTL_SOCKET | (none) | path of the control socket for lasboltctl, mode 0600, for example /run/lasbolt/ctl.sock; empty turns it off |
--data-dir | LASBOLT_DATA_DIR | ./data, dev: ./.dev | data directory |
--dev | LASBOLT_DEV=1 | off | dev mode |
--device-poll-interval | LASBOLT_DEVICE_POLL_INTERVAL | 5s | poll interval of a device-code login, also the slow_down step. For tests |
--e2e-idle | LASBOLT_E2E_IDLE | 15m | idle time after which a browser tab loses its E2E unlock. For tests |
--http-read-timeout | LASBOLT_HTTP_READ_TIMEOUT | 30s | HTTP read timeout of one request. For tests |
--http-write-timeout | LASBOLT_HTTP_WRITE_TIMEOUT | 60s | HTTP write timeout of one response. For tests |
--key-file | LASBOLT_KEY_FILE | (none) | file with 32 raw key bytes |
--key-provider | LASBOLT_KEY_PROVIDER | passphrase | passphrase, file or insecure-static |
--peer-list-max-age | LASBOLT_PEER_LIST_MAX_AGE | 168h | longest age of a peer list on a device |
--peer-stun | LASBOLT_PEER_STUN | none | public STUN server host:port that devices may ask; repeatable |
--peer-sync | LASBOLT_PEER_SYNC | on | on or off: devices of one user sync directly with each other; off turns the peer registry and the relay push off |
--peer-udp | LASBOLT_PEER_UDP | 7849, dev: loopback only | UDP port that tells a device its public address, a port, host:port or off |
--peer-udp-public | LASBOLT_PEER_UDP_PUBLIC | the bound port | UDP port that devices are told, when a NAT or port map changes it |
--public-url | LASBOLT_PUBLIC_URL | (none) | public origin of this server, such as https://vault.example.org; lasboltctl uses it in invitation links |
--sse-heartbeat | LASBOLT_SSE_HEARTBEAT | 25s | time between SSE heartbeats. For tests |
--sse-write-window | LASBOLT_SSE_WRITE_WINDOW | 30s | time that one SSE write may take; each write moves the deadline. For tests |
--tmp-dir | LASBOLT_TMP_DIR | the directory of the file | directory for temporary copies in backup verify |
--trusted-proxy | LASBOLT_TRUSTED_PROXY | (none) | CIDR range of a trusted reverse proxy; repeatable |
--unseal-passphrase-file | LASBOLT_UNSEAL_PASSPHRASE_FILE | (none) | file with the unseal passphrase |
--user-purge-interval | LASBOLT_USER_PURGE_INTERVAL | 1h | time between two runs of the job that removes deleted accounts after their grace period. For tests |
For a guide to the settings that matter on a real server, see Configuration in the server section.