Configuration
lasboltd takes settings from flags and from environment variables. This page groups the settings that matter by task. For every flag and its default, see the configuration reference and the lasboltd reference.
How settings work
- Each flag has a variable. The name is
LASBOLT_and the flag name in upper case, with_for-. Example:--data-dirisLASBOLT_DATA_DIR. - A flag wins over a variable.
- A bad value stops the start with an error. The error text names the flag.
- Time values use Go durations:
30s,15m,24h. - The server has no config file of its own and does not reload settings. Restart the service after a change.
The settings file
With systemd, keep the variables in an EnvironmentFile. The file has paths and addresses, no secrets:
LASBOLT_ADDR=127.0.0.1:8080
LASBOLT_DATA_DIR=/var/lib/lasbolt
LASBOLT_UNSEAL_PASSPHRASE_FILE=/etc/lasbolt/passphrase
LASBOLT_TRUSTED_PROXY=127.0.0.1/32
LASBOLT_PUBLIC_URL=https://vault.example.org
LASBOLT_CTL_SOCKET=/run/lasbolt/ctl.sock
LASBOLT_BACKUP_RECIPIENT=/etc/lasbolt/backup.key.pubThe commands lasboltd backup, lasboltd restore and lasboltd user read the same variables. To run them by hand, load the file first:
sudo -u lasbolt sh -c 'set -a; . /etc/lasbolt/lasboltd.env; set +a; exec lasboltd backup list'Listen and data
| Flag | Variable | Default | Use |
|---|---|---|---|
--addr | LASBOLT_ADDR | :8080 | Listen address. Use 127.0.0.1:8080 behind a proxy. |
--data-dir | LASBOLT_DATA_DIR | ./data | Folder of the database and the backups. Set an absolute path. |
--public-url | LASBOLT_PUBLIC_URL | none | Public origin. It must start with https:// or http://. |
--trusted-proxy | LASBOLT_TRUSTED_PROXY | none | Proxy ranges. See TLS and proxy. |
Unseal and keys
| Flag | Variable | Default | Use |
|---|---|---|---|
--key-provider | LASBOLT_KEY_PROVIDER | passphrase | passphrase or file. |
--unseal-passphrase-file | LASBOLT_UNSEAL_PASSPHRASE_FILE | ask on the terminal | A file with the passphrase. Mode 0600. |
--key-file | LASBOLT_KEY_FILE | none | A file with 32 raw bytes. For provider file. |
See Sealing and keys.
Users and the control socket
| Flag | Variable | Default | Use |
|---|---|---|---|
--ctl-socket | LASBOLT_CTL_SOCKET | off | Path of the socket for lasboltctl, for example /run/lasbolt/ctl.sock. |
--allow-registration | LASBOLT_ALLOW_REGISTRATION | off | Old flag. It sets the registration to open once. See First owner and users. |
--user-purge-interval | LASBOLT_USER_PURGE_INTERVAL | 1h | How often the job removes deleted accounts. |
Backups
| Flag | Variable | Default | Use |
|---|---|---|---|
--backup-interval | LASBOLT_BACKUP_INTERVAL | 24h | Time between backups. 0 turns backups off. |
--backup-keep | LASBOLT_BACKUP_KEEP | 14 | Number of backups to keep. 0 keeps all. |
--backup-dir | LASBOLT_BACKUP_DIR | <data-dir>/backups | Folder of the backups. |
--backup-recipient | LASBOLT_BACKUP_RECIPIENT | none | Public key file. Seals the backups. |
--backup-identity | LASBOLT_BACKUP_IDENTITY | none | Private key file. For verify and restore only. |
See Backups and restore.
Peer sync
| Flag | Variable | Default | Use |
|---|---|---|---|
--peer-sync | LASBOLT_PEER_SYNC | on | off turns the peer registry off. |
--peer-udp | LASBOLT_PEER_UDP | 7849 | UDP port that tells a device its public address. off closes it. |
--peer-udp-public | LASBOLT_PEER_UDP_PUBLIC | the bound port | The port that devices are told, if a NAT changes it. |
--peer-stun | LASBOLT_PEER_STUN | none | A public STUN server host:port. Repeat or separate by commas. |
--peer-list-max-age | LASBOLT_PEER_LIST_MAX_AGE | 168h | Longest age of a peer list on a device. |
Settings for tests
These flags exist for tests: --http-read-timeout, --http-write-timeout, --sse-heartbeat, --sse-write-window, --device-poll-interval, --e2e-idle, --approval-wait. Do not change them on a real server. One exception is --e2e-idle (default 15m): it sets how long a browser tab keeps its end-to-end unlock without use.
Settings that you change in the app
Some settings live in the database and not in a flag. An owner or admin changes them in Settings › Organisation or with lasboltctl: the registration mode (closed, invite, open) and the invitations.