Environment variables
Every environment variable the CID stack declares, its default, the containers that receive it, and where it is read.
- Type: reference
Every environment variable the compose stack declares or interpolates, plus every variable the
NestJS gateway reads. Regenerate with make docs-generate.
- Default is the value in
docker-compose.yml(falling back to.env.example).${NAME:-x}means the operator may override it from.env, andxis what an unconfigured box gets. - Services are the containers whose
environment:block receives it. - Read by is where the gateway consumes it. An empty cell means no gateway reader was found — the variable is either consumed by a non-TypeScript service (Python ML, Go proxy, entrypoint script) or by nothing at all.
All variables
| Variable | Default | Services | In .env.example | Read by (gateway) |
|---|---|---|---|---|
ACME_EMAIL | ${ACME_EMAIL} | caddy | yes | — |
AGENT_AUTH_TOKEN | ${USERID_AGENT_TOKEN:-} | cid-userid-agent | no | — |
AGENT_PROTECT_READS | ${USERID_AGENT_PROTECT_READS:-} | cid-userid-agent | no | — |
ALL_DETECTIONS_MAX_MERGE_KEYS | — | — | no | cid-nestjs-gateway/inline-proxy-inspect/all-detections.service.ts |
ALL_DETECTIONS_PAGE_SIZE | — | — | no | cid-nestjs-gateway/inline-proxy-inspect/all-detections.service.ts |
ALL_DETECTIONS_WINDOW_MINUTES | — | — | no | cid-nestjs-gateway/inline-proxy-inspect/all-detections-query.service.ts |
ANALYST_ANALYSIS_BATCH_PAUSE_MS | ${ANALYST_ANALYSIS_BATCH_PAUSE_MS:-0} | risk-analyst | yes | — |
ANALYST_ANALYSIS_BATCH_SIZE | ${ANALYST_ANALYSIS_BATCH_SIZE:-20} | risk-analyst | yes | — |
ANALYST_ANALYSIS_CONCURRENCY | ${ANALYST_ANALYSIS_CONCURRENCY:-1} | risk-analyst | yes | — |
ANALYST_ANALYSIS_MAX_WAIT | ${ANALYST_ANALYSIS_MAX_WAIT:-300} | risk-analyst | yes | — |
ANALYST_ANALYSIS_ROUND_TIMEOUT | ${ANALYST_ANALYSIS_ROUND_TIMEOUT:-300} | risk-analyst | yes | — |
ANALYST_CHAT_HIDDEN_TOOLS | ${ANALYST_CHAT_HIDDEN_TOOLS:-["count_all_detections","list_all_detections","get_owasp_index"]} | risk-analyst | yes | — |
ANALYST_CHAT_STREAM_TIMEOUT | — | — | no | cid-nestjs-gateway/llm-review/services/risk-analyst-client.service.ts |
ANALYST_CHAT_UNGROUNDED_ANSWER_CHARS | ${ANALYST_CHAT_UNGROUNDED_ANSWER_CHARS:-240} | risk-analyst | yes | — |
ANALYST_CLEAR_MAX | ${ANALYST_CLEAR_MAX:-30} | risk-analyst | host knob only | — |
ANALYST_CONTEXT_WINDOW | ${ANALYST_CONTEXT_WINDOW:-32768} | risk-analyst | yes | — |
ANALYST_KNOWLEDGE_REFRESH_SECONDS | ${ANALYST_KNOWLEDGE_REFRESH_SECONDS:-900} | risk-analyst | host knob only | — |
ANALYST_LLM_ROUND_TIMEOUT | ${ANALYST_LLM_ROUND_TIMEOUT:-120} | risk-analyst | host knob only | — |
ANALYST_LOCK_MIN | ${ANALYST_LOCK_MIN:-70} | risk-analyst | host knob only | — |
ANALYST_MAX_QUEUE_DEPTH | ${ANALYST_MAX_QUEUE_DEPTH:-16} | risk-analyst | yes | — |
ANALYST_REVIEW_CONCURRENCY | ${ANALYST_REVIEW_CONCURRENCY:-2} | risk-analyst | yes | — |
ANALYST_REVIEW_TIMEOUT | ${ANALYST_REVIEW_TIMEOUT:-300} | risk-analyst | host knob only | — |
ANALYST_TRACE_DIR | /traces | risk-analyst | no | — |
ANTHROPIC_API_KEY | ${ANTHROPIC_API_KEY:-} | deepteam | host knob only | — |
API_DOMAIN | ${API_DOMAIN} | caddy | yes | cid-nestjs-gateway/browser-extension/services/extension-deployment.service.tscid-nestjs-gateway/setup/setup.service.ts |
APP_DOMAIN | ${APP_DOMAIN} | caddy | yes | — |
APP_NAME | cid-ocr | attack-guard, document-parser, hallucination-guard, ml-detector, ocr-service, redactor, report-renderer | no | — |
APP_VERSION | 1.0.0 | attack-guard, document-parser, hallucination-guard, ml-detector, ocr-service, redactor, report-renderer | no | cid-nestjs-gateway/integrations/services/itsm-export.service.tscid-nestjs-gateway/integrations/services/siem-export.service.ts |
ATTACK_GUARD_SERVICE_ENABLED | true | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/jailbreak-detector-client.service.ts |
ATTACK_GUARD_SERVICE_TIMEOUT | 10000 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/jailbreak-detector-client.service.ts |
ATTACK_GUARD_SERVICE_URL | http://attack-guard:8003 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/injection-scan-client.service.tscid-nestjs-gateway/guardrails/clients/jailbreak-detector-client.service.ts |
ATTACK_INTRA_OP | 2 | — | host knob only | — |
ATTACK_MAX_CONCURRENT | 4 | — | host knob only | — |
ATTACK_WORKERS | 1 | — | host knob only | — |
BROWSER_EXTENSION_ID | — | — | no | cid-nestjs-gateway/browser-extension/browser-extension.constants.ts |
CACHEBUST | — | — | host knob only | — |
CACHE_ENABLED | true | ml-detector | no | — |
CACHE_KEY_PREFIX | detection | ml-detector | no | — |
CACHE_TTL | 3600 | attack-guard, ml-detector | no | — |
CASE_UPPERCASE_THRESHOLD | — | — | no | cid-nestjs-gateway/guardrails/normalization/normalizers/case.normalizer.ts |
CA_APP_NAME | CID Cost Analyzer | cost-analyzer | no | — |
CA_ENVIRONMENT | production | cost-analyzer | no | — |
CA_LOG_LEVEL | INFO | cost-analyzer | no | — |
CA_VERSION | 1.0.0 | cost-analyzer | no | — |
CID_ATTEST_ENFORCE | ${CID_ATTEST_ENFORCE:-false} | cid-proxy | host knob only | — |
CID_ATTEST_TTL_SEC | — | — | no | cid-nestjs-gateway/inline-proxy-inspect/attestation.service.ts |
CID_BACKEND_TIMEOUT | 180 | cid-proxy | no | — |
CID_BACKEND_URL | http://nestjs-core:3000 | cid-proxy | no | — |
CID_CONTAINER_PREFIX | ai-gateway- | reconfigure-agent | no | — |
CID_CORE_INSPECT_URL | http://localhost:3000/inspect/v1 | cid-inline-proxy | no | — |
CID_DEBUG_DUMP_REDACTS | ${CID_DEBUG_DUMP_REDACTS:-0} | cid-inline-proxy, nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/icap.server.ts |
CID_DEBUG_DUMP_REQUESTS | ${CID_DEBUG_DUMP_REQUESTS:-0} | cid-inline-proxy | host knob only | — |
CID_DEBUG_DUMP_RESPONSES | ${CID_DEBUG_DUMP_RESPONSES:-0} | cid-inline-proxy | host knob only | — |
CID_DIAGNOSTICS_EGRESS | — | — | no | cid-nestjs-gateway/diagnostics/collectors/appliance.collector.ts |
CID_ENABLE_LAB | — | — | no | cid-nestjs-gateway/license/license.service.ts |
CID_ETC_DIR | — | — | host knob only | — |
CID_ETC_DIR_IN_CONTAINER | — | — | no | cid-nestjs-gateway/diagnostics/collectors/appliance.collector.tscid-nestjs-gateway/license/license.service.tscid-nestjs-gateway/setup/setup.service.ts |
CID_HOST_EXEC | docker | reconfigure-agent | no | — |
CID_INSPECT_BINARY_TIMEOUT_MS | ${CID_INSPECT_BINARY_TIMEOUT_MS:-30000} | cid-inline-proxy | host knob only | — |
CID_INSPECT_FAIL_OPEN | ${INLINE_PROXY_FAIL_OPEN:-false} | cid-inline-proxy | no | — |
CID_INSPECT_KEY | ${CID_INSPECT_KEY:-} | cid-proxy | host knob only | — |
CID_INSPECT_TIMEOUT_MS | ${CID_INSPECT_TIMEOUT_MS:-8000} | cid-inline-proxy | host knob only | — |
CID_INSPECT_URL | ${CID_INSPECT_URL:-} | cid-proxy | host knob only | — |
CID_LICENSE_ISSUER | ${CID_LICENSE_ISSUER:-} | nestjs-core | host knob only | cid-nestjs-gateway/license-admin/license-admin.service.tscid-nestjs-gateway/license/license.service.tscid-nestjs-gateway/system-update/system-update.service.ts |
CID_LICENSE_ISSUER_TOKEN | ${CID_LICENSE_ISSUER_TOKEN:-} | nestjs-core | host knob only | cid-nestjs-gateway/license-admin/license-admin.service.ts |
CID_LICENSE_ISSUER_URL | ${CID_LICENSE_ISSUER_URL:-} | nestjs-core | host knob only | cid-nestjs-gateway/license-admin/license-admin.service.ts |
CID_PASSTHROUGH_FAIL_OPEN | ${CID_PASSTHROUGH_FAIL_OPEN:-true} | cid-proxy | host knob only | — |
CID_PASSTHROUGH_MASK | ${CID_PASSTHROUGH_MASK:-false} | cid-proxy | host knob only | — |
CID_REQUIRE_LICENSE | — | — | no | cid-nestjs-gateway/diagnostics/collectors/appliance.collector.tscid-nestjs-gateway/license/license.service.ts |
CID_RESPONSE_INSPECTION_ENABLED | ${CID_RESPONSE_INSPECTION_ENABLED:-true} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/icap.server.ts |
CID_RESUMABLE_UPLOAD_POLICY | ${CID_RESUMABLE_UPLOAD_POLICY:-block} | cid-inline-proxy, nestjs-core | host knob only | cid-nestjs-gateway/diagnostics/collectors/posture.collector.tscid-nestjs-gateway/inline-proxy-inspect/icap.server.ts |
CID_TRIAL_DAYS | — | — | no | cid-nestjs-gateway/license/license.service.ts |
CID_TRIAL_TIER | — | — | no | cid-nestjs-gateway/license/license.service.ts |
CID_UPDATE_ROOT | /var/lib/cid | reconfigure-agent | no | cid-nestjs-gateway/certificates/certificates.service.tscid-nestjs-gateway/diagnostics/collectors/appliance.collector.tscid-nestjs-gateway/diagnostics/collectors/host.collector.tscid-nestjs-gateway/diagnostics/findings.rules.tscid-nestjs-gateway/license/license.service.tscid-nestjs-gateway/ml-tuning/ml-tuning.service.tscid-nestjs-gateway/setup/setup.service.tscid-nestjs-gateway/system-update/system-update.service.ts |
CID_UPDATE_STATE_DIR | — | — | host knob only | — |
CID_UPSTREAM_URL | ${CID_UPSTREAM_URL:-https://api.anthropic.com} | cid-proxy | host knob only | — |
CID_VERSION | — | — | no | cid-nestjs-gateway/system-update/system-update.service.ts |
CODE_SAFETY_CERT_DIR | — | — | host knob only | — |
CODE_SAFETY_SERVICE_CA_CERT | ${CODE_SAFETY_SERVICE_CA_CERT:-} | nestjs-core | host knob only | cid-nestjs-gateway/code-safety/code-safety-client.service.ts |
CODE_SAFETY_SERVICE_CLIENT_CERT | ${CODE_SAFETY_SERVICE_CLIENT_CERT:-} | nestjs-core | host knob only | cid-nestjs-gateway/code-safety/code-safety-client.service.ts |
CODE_SAFETY_SERVICE_CLIENT_KEY | ${CODE_SAFETY_SERVICE_CLIENT_KEY:-} | nestjs-core | host knob only | cid-nestjs-gateway/code-safety/code-safety-client.service.ts |
CODE_SAFETY_SERVICE_ENABLED | ${CODE_SAFETY_SERVICE_ENABLED:-false} | nestjs-core | host knob only | cid-nestjs-gateway/code-safety/code-safety-client.service.tscid-nestjs-gateway/license/license.service.ts |
CODE_SAFETY_SERVICE_TIMEOUT | ${CODE_SAFETY_SERVICE_TIMEOUT:-10000} | nestjs-core | host knob only | cid-nestjs-gateway/code-safety/code-safety-client.service.ts |
CODE_SAFETY_SERVICE_TOKEN | ${CODE_SAFETY_SERVICE_TOKEN:-} | nestjs-core | host knob only | cid-nestjs-gateway/code-safety/code-safety-client.service.ts |
CODE_SAFETY_SERVICE_URL | ${CODE_SAFETY_SERVICE_URL:-http://code-safety:8018} | nestjs-core | host knob only | cid-nestjs-gateway/code-safety/code-safety-client.service.tscid-nestjs-gateway/license/license.service.ts |
CODE_SAFETY_TRUST_NETWORK | — | — | no | cid-nestjs-gateway/code-safety/code-safety-client.service.ts |
COMPOSE_PROFILES | llm-analyst | — | no | — |
CONFIDENCE_THRESHOLD | 0.6 | ml-detector | no | — |
CORS_ALLOWED_ORIGINS | ${CORS_ALLOWED_ORIGINS:-} | nestjs-core | yes | cid-nestjs-gateway/diagnostics/collectors/posture.collector.tscid-nestjs-gateway/main.ts |
CORS_ORIGINS | ["*"] | attack-guard, document-parser, hallucination-guard, ml-detector, ocr-service, redactor | no | — |
COST_ANALYZER_ENABLED | true | nestjs-core | no | cid-nestjs-gateway/model-routing/services/cost-analyzer-client.service.ts |
COST_ANALYZER_TIMEOUT | 30000 | nestjs-core | no | cid-nestjs-gateway/model-routing/services/cost-analyzer-client.service.ts |
COST_ANALYZER_URL | http://cost-analyzer:8016 | nestjs-core | no | cid-nestjs-gateway/model-routing/services/cost-analyzer-client.service.ts |
DASHBOARD_URL | — | — | no | cid-nestjs-gateway/repo-connector/github-manifest.controller.ts |
DB_DATABASE | ${DB_DATABASE:-ai_gateway} | nestjs-core | yes | cid-nestjs-gateway/database/data-source.tscid-nestjs-gateway/database/database.module.ts |
DB_HOST | postgres | nestjs-core | no | cid-nestjs-gateway/database/data-source.tscid-nestjs-gateway/database/database.module.ts |
DB_LOGGING | ${DB_LOGGING:-false} | nestjs-core | yes | cid-nestjs-gateway/database/data-source.tscid-nestjs-gateway/database/database.module.ts |
DB_PASSWORD | ${DB_PASSWORD:-postgres} | nestjs-core | yes | cid-nestjs-gateway/database/data-source.tscid-nestjs-gateway/database/database.module.ts |
DB_PORT | 5432 | nestjs-core | no | cid-nestjs-gateway/database/data-source.tscid-nestjs-gateway/database/database.module.ts |
DB_SSL | — | — | no | cid-nestjs-gateway/database/data-source.tscid-nestjs-gateway/database/database.module.ts |
DB_SYNCHRONIZE | ${DB_SYNCHRONIZE:-false} | nestjs-core | yes | cid-nestjs-gateway/database/database.module.tscid-nestjs-gateway/diagnostics/collectors/posture.collector.ts |
DB_USERNAME | ${DB_USERNAME:-postgres} | nestjs-core | yes | cid-nestjs-gateway/database/data-source.tscid-nestjs-gateway/database/database.module.ts |
DEBUG | false | attack-guard, document-parser, hallucination-guard, ml-detector, ocr-service, redactor | no | — |
DEEPTEAM_DEFAULT_ATTACKS_PER_VULNERABILITY | 5 | deepteam | no | — |
DEEPTEAM_ENABLED | true | nestjs-core | no | — |
DEEPTEAM_GUARDRAILS_BASE_URL | http://nestjs-core:3000 | deepteam | no | — |
DEEPTEAM_GUARDRAILS_TIMEOUT | 30 | deepteam | no | — |
DEEPTEAM_LOG_LEVEL | INFO | deepteam | no | — |
DEEPTEAM_SERVICE_URL | http://deepteam:8010 | nestjs-core | no | cid-nestjs-gateway/filter-testing/filter-testing.controller.tscid-nestjs-gateway/filter-testing/services/deepteam-integration.service.ts |
DEEPTEAM_TIMEOUT | 300000 | nestjs-core | no | cid-nestjs-gateway/filter-testing/services/deepteam-integration.service.ts |
DEFAULT_INSPECTION_TENANT_ID | ${DEFAULT_INSPECTION_TENANT_ID:-} | nestjs-core | host knob only | cid-nestjs-gateway/compliance/compliance.service.tscid-nestjs-gateway/inline-proxy-inspect/services/default-inspection-tenant.service.ts |
DEFAULT_LANGUAGE | en | ml-detector | no | cid-nestjs-gateway/language-detection/services/language-detection.service.ts |
DEFAULT_MASKING_STYLE | blackout | redactor | no | — |
DEFAULT_PADDING | 2 | redactor | no | — |
DEFAULT_TENANT_GROUP | — | — | no | cid-nestjs-gateway/setup/setup.service.tscid-nestjs-gateway/tenants/tenants.service.ts |
DEVICE | cpu | hallucination-guard | no | — |
DOCS_BUNDLE_DIR | — | — | host knob only | — |
DOCS_CORPUS_DIR | — | — | no | cid-nestjs-gateway/help/corpus/corpus-loader.service.ts |
DOCUMENT_PARSER_SERVICE_ENABLED | true | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/document-parser-client.service.ts |
DOCUMENT_PARSER_SERVICE_TIMEOUT | 120000 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/document-parser-client.service.ts |
DOCUMENT_PARSER_SERVICE_URL | http://document-parser:8012 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/document-parser-client.service.ts |
DOC_CLASSIFIER_TIMEOUT | 8000 | nestjs-core | no | cid-nestjs-gateway/guardrails/detection/orchestrators/image-detection.service.ts |
DOC_CLASSIFIER_URL | http://doc-classifier:8017 | nestjs-core | no | cid-nestjs-gateway/guardrails/detection/orchestrators/image-detection.service.ts |
DOC_DETECT_CONCURRENCY | — | — | no | cid-nestjs-gateway/document-analysis/services/document-analysis-orchestrator.service.ts |
EMAILJS_PRIVATE_KEY | ${EMAILJS_PRIVATE_KEY:-} | nestjs-core | host knob only | cid-nestjs-gateway/auth/services/emailjs.service.ts |
EMAILJS_PUBLIC_KEY | ${EMAILJS_PUBLIC_KEY:-1SNtar4SBHq44RADr} | nestjs-core | host knob only | cid-nestjs-gateway/auth/services/emailjs.service.ts |
EMAILJS_RESET_TEMPLATE_ID | ${EMAILJS_RESET_TEMPLATE_ID:-} | nestjs-core | host knob only | cid-nestjs-gateway/auth/services/emailjs.service.ts |
EMAILJS_SERVICE_ID | ${EMAILJS_SERVICE_ID:-cid_emailjs} | nestjs-core | host knob only | cid-nestjs-gateway/auth/services/emailjs.service.ts |
ENVIRONMENT | production | attack-guard, document-parser, hallucination-guard, ml-detector, ocr-service, redactor | no | — |
EXTENSION_CRX_DOMAIN | — | — | no | cid-nestjs-gateway/browser-extension/services/extension-deployment.service.ts |
FILTER_DRAFT_MODEL | — | — | no | cid-nestjs-gateway/filters/services/filter-draft.service.ts |
FILTER_TEST_CONCURRENCY | ${FILTER_TEST_CONCURRENCY:-8} | nestjs-core | host knob only | cid-nestjs-gateway/filter-testing/filter-testing.constants.ts |
FILTER_TEST_VERBOSE | ${FILTER_TEST_VERBOSE:-false} | nestjs-core | host knob only | cid-nestjs-gateway/filter-testing/filter-testing.service.ts |
FRONTEND_BIND | — | — | host knob only | — |
FRONTEND_PORT | — | — | host knob only | — |
GOOGLE_API_KEY | ${GOOGLE_API_KEY:-} | deepteam | host knob only | — |
GUARDRAILS_DEGRADED_COOLDOWN_MS | — | — | no | cid-nestjs-gateway/guardrails/guardrails-degradation.service.ts |
GUARDRAILS_MAX_SOCKETS | ${GUARDRAILS_MAX_SOCKETS:-50} | nestjs-core | host knob only | cid-nestjs-gateway/guardrails/guardrails.module.ts |
HALLUCINATION_GUARD_HOST_PORT | 8022 | — | yes | — |
HALLUCINATION_GUARD_THREADS | — | — | host knob only | — |
HALLUCINATION_SERVICE_ENABLED | ${HALLUCINATION_SERVICE_ENABLED:-true} | nestjs-core | yes | cid-nestjs-gateway/guardrails/clients/hallucination-client.service.ts |
HALLUCINATION_SERVICE_TIMEOUT | ${HALLUCINATION_SERVICE_TIMEOUT:-15000} | nestjs-core | yes | cid-nestjs-gateway/guardrails/clients/hallucination-client.service.ts |
HALLUCINATION_SERVICE_URL | ${HALLUCINATION_SERVICE_URL:-http://hallucination-guard:8022} | nestjs-core | yes | cid-nestjs-gateway/guardrails/clients/hallucination-client.service.ts |
HALLUCINATION_THRESHOLD | ${HALLUCINATION_THRESHOLD:-0.5} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/response-inspection.service.ts |
HALLUCINATION_UNAVAILABLE_COOLDOWN_MS | — | — | no | cid-nestjs-gateway/guardrails/clients/hallucination-client.service.ts |
HAP_INTRA_OP | 2 | — | host knob only | — |
HAP_MAX_CONCURRENT | 4 | — | host knob only | — |
HAP_ONNX_MODEL_PATH | /models/cid-toxicity-v1 | hap-guard-v2 | no | — |
HAP_SERVICE_ENABLED | true | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/hap-detector-v2-client.service.ts |
HAP_SERVICE_TIMEOUT | 10000 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/hap-detector-v2-client.service.ts |
HAP_SERVICE_URL | http://hap-guard-v2:8000 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/hap-detector-v2-client.service.ts |
HAP_WORKERS | 1 | — | host knob only | — |
HELP_FORCE_MODE | ${HELP_FORCE_MODE:-} | nestjs-core | host knob only | cid-nestjs-gateway/help/help.constants.ts |
HELP_SELF_BASE_URL | — | — | no | cid-nestjs-gateway/help/corpus/runbook-engine.service.ts |
HELP_TOOLS_MODEL | ${HELP_TOOLS_MODEL:-} | nestjs-core | host knob only | cid-nestjs-gateway/help/help-policy-analysis.service.tscid-nestjs-gateway/help/help.service.ts |
HF_HOME | /tmp/hf | weights-fetch | no | — |
HF_HUB_DISABLE_TELEMETRY | 1 | weights-fetch | no | — |
HF_TOKEN | hf_REPLACE_ME | — | yes | — |
HOST | 0.0.0.0 | document-parser, ml-detector, ocr-service, redactor, report-renderer | no | — |
HTTPS_PROXY | ${HTTPS_PROXY:-} | nestjs-core | host knob only | — |
HTTP_PROXY | ${HTTP_PROXY:-} | nestjs-core | host knob only | — |
ICAP_BIND | ${ICAP_BIND:-0.0.0.0} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/icap.server.ts |
ICAP_ENABLED | ${ICAP_ENABLED:-true} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/icap.server.ts |
ICAP_PORT | ${ICAP_PORT:-1344} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/icap.server.ts |
ICAP_PUBLISH | 127.0.0.1 | — | yes | — |
INJECTION_SCAN_ENABLED | — | — | no | cid-nestjs-gateway/guardrails/clients/injection-scan-client.service.ts |
INJECTION_SCAN_TIMEOUT | — | — | no | cid-nestjs-gateway/guardrails/clients/injection-scan-client.service.ts |
INLINE_PROXY_FAIL_OPEN | — | — | host knob only | — |
INLINE_PROXY_HTTPS_PORT | ${INLINE_PROXY_HTTPS_PORT:-8443} | cid-inline-proxy | host knob only | — |
INLINE_PROXY_PUBLIC_PORT | ${INLINE_PROXY_HTTPS_PORT:-8443} | nestjs-core | no | cid-nestjs-gateway/inline-proxy-inspect/inline-proxy-management.controller.ts |
INLINE_PROXY_TPROXY_PORT | ${INLINE_PROXY_TPROXY_PORT:-8084} | cid-inline-proxy | host knob only | — |
INLINE_PROXY_UPSTREAM | ${INLINE_PROXY_UPSTREAM:-} | cid-inline-proxy | host knob only | — |
INLINE_PROXY_UPSTREAM_INSECURE | ${INLINE_PROXY_UPSTREAM_INSECURE:-0} | cid-inline-proxy | host knob only | — |
INSPECTION_ON_TIMEOUT | ${INSPECTION_ON_TIMEOUT:-fail-closed} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/inspection.service.ts |
INSPECTION_TIMEOUT_MS | ${INSPECTION_TIMEOUT_MS:-10000} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/file-inspection.service.tscid-nestjs-gateway/inline-proxy-inspect/inspection.service.tscid-nestjs-gateway/inline-proxy-inspect/response-inspection.service.ts |
INSPECTION_USAGE_LOGGING | ${INSPECTION_USAGE_LOGGING:-false} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/inspection.service.ts |
INSTALL_PADDLE | — | — | host knob only | — |
JAILBREAK_LOG_LEVEL | INFO | attack-guard | no | — |
JAILBREAK_MAX_TOKEN_LENGTH | 512 | attack-guard | no | — |
JAILBREAK_ONNX_MODEL_PATH | /models/cid-jailbreak-prompt-injection-v3 | attack-guard | no | — |
JWT_EXPIRES_IN | ${JWT_EXPIRES_IN:-8h} | nestjs-core | yes | cid-nestjs-gateway/auth/auth.module.ts |
JWT_SECRET | ${JWT_SECRET:-} | nestjs-core | yes | cid-nestjs-gateway/auth/auth.module.tscid-nestjs-gateway/auth/strategies/jwt.strategy.tscid-nestjs-gateway/common/crypto/secret-box.tscid-nestjs-gateway/config/security-config.tscid-nestjs-gateway/diagnostics/collectors/posture.collector.tscid-nestjs-gateway/endpoint-agent/signing-crypto.service.tscid-nestjs-gateway/inline-proxy-inspect/redaction-marker.service.tscid-nestjs-gateway/integrations/services/integrations-crypto.service.tscid-nestjs-gateway/ldap/services/ldap-crypto.service.tscid-nestjs-gateway/password-delivery/services/password-delivery-crypto.service.ts |
KMP_BLOCKTIME | 0 | attack-guard, doc-classifier, hallucination-guard, hap-guard-v2, ml-detector, ocr-service | no | — |
LANGUAGE_DETECTION_CONFIDENCE | 0.85 | ml-detector | no | — |
LANGUAGE_DETECTOR_ENABLED | true | nestjs-core | no | cid-nestjs-gateway/language-detection/services/language-detector-client.service.ts |
LANGUAGE_DETECTOR_TIMEOUT | 5000 | nestjs-core | no | cid-nestjs-gateway/language-detection/services/language-detector-client.service.ts |
LANGUAGE_DETECTOR_URL | http://language-detector:8008 | nestjs-core | no | cid-nestjs-gateway/language-detection/services/language-detector-client.service.ts |
LANG_APP_NAME | CID Language Detector | language-detector | no | — |
LANG_DEBUG | false | language-detector | no | — |
LANG_DEFAULT_LANGUAGE | en | language-detector | no | — |
LANG_ENVIRONMENT | production | language-detector | no | — |
LANG_LOG_LEVEL | INFO | language-detector | no | — |
LANG_MIN_TEXT_LENGTH | 3 | language-detector | no | — |
LANG_VERSION | 1.0.0 | language-detector | no | — |
LDAP_ADMIN_PASSWORD | admin | openldap-test | no | — |
LDAP_BASE_DN | ${USERID_AGENT_LDAP_BASE_DN:-} | cid-userid-agent | no | — |
LDAP_BIND_DN | ${USERID_AGENT_LDAP_BIND_DN:-} | cid-userid-agent | no | — |
LDAP_BIND_PASSWORD | ${LDAP_BIND_PASSWORD:-} | cid-userid-agent, nestjs-core | yes | cid-nestjs-gateway/ldap/services/ldap-directory.service.ts |
LDAP_BIND_PASSWORD_FILE | ${LDAP_BIND_PASSWORD_FILE:-} | nestjs-core | host knob only | cid-nestjs-gateway/ldap/services/ldap-directory.service.ts |
LDAP_DOMAIN | corp.local | openldap-test | no | — |
LDAP_HEALTH_DEGRADED_REEMIT_MS | — | — | no | cid-nestjs-gateway/ldap/services/ldap-health.service.ts |
LDAP_HEALTH_PROBE_INTERVAL_MS | — | — | no | cid-nestjs-gateway/ldap/services/ldap-health.service.ts |
LDAP_LOGIN_UNAVAILABLE_COOLDOWN_MS | — | — | no | cid-nestjs-gateway/auth/auth.service.ts |
LDAP_ORGANISATION | CID Test | openldap-test | no | — |
LDAP_TLS_REJECT_UNAUTHORIZED | ${LDAP_TLS_REJECT_UNAUTHORIZED:-true} | nestjs-core | yes | cid-nestjs-gateway/ldap/services/ldap-directory.service.ts |
LDAP_URL | ${USERID_AGENT_LDAP_URL:-} | cid-userid-agent | no | — |
LETTUCE_DETECT_MODEL_PATH | /models/lettuce-detect | hallucination-guard | no | — |
LICENSE_EVENT_COOLDOWN_MS | — | — | no | cid-nestjs-gateway/license/license.service.ts |
LISTEN_ADDR | :8090 | cid-userid-agent | no | — |
LLM_API_KEY | ${LLM_API_KEY:-not-needed} | risk-analyst | yes | — |
LLM_BASE_URL | ${LLM_BASE_URL:-http://host.docker.internal:11434/v1} | risk-analyst | yes | — |
LLM_BUILD_GID | — | — | host knob only | — |
LLM_BUILD_UID | — | — | host knob only | — |
LLM_ENGINE | ${LLM_ENGINE:-ollama} | risk-analyst | yes | — |
LLM_GPU_DEVICES | all | — | yes | — |
LLM_GPU_MEMORY_UTILIZATION | 0.90 | — | yes | — |
LLM_HF_REPO | ${LLM_HF_REPO:-Qwen/Qwen3-14B-AWQ} | weights-fetch | host knob only | — |
LLM_HF_REVISION | ${LLM_HF_REVISION:-main} | weights-fetch | host knob only | — |
LLM_INFERENCE_IMAGE | — | — | yes | — |
LLM_KEEP_ALIVE | ${LLM_KEEP_ALIVE:-24h} | risk-analyst | yes | — |
LLM_KV_CACHE_DTYPE | auto | — | yes | — |
LLM_MANIFEST_PATH | /models/manifest.json | — | yes | — |
LLM_MAX_BATCHED_TOKENS | 4096 | — | yes | — |
LLM_MAX_CONCURRENCY | ${LLM_MAX_CONCURRENCY:-1} | risk-analyst | yes | — |
LLM_MAX_MODEL_LEN | 32768 | — | yes | — |
LLM_MAX_NUM_SEQS | 2 | — | yes | — |
LLM_MODEL | ${LLM_MODEL:-qwen3:14b} | risk-analyst | yes | — |
LLM_MODEL_DIGEST | — | — | yes | — |
LLM_MODEL_ID | ${LLM_MODEL_ID:-qwen3-14b-awq} | weights-fetch | yes | — |
LLM_MODEL_PATH | /models/qwen3-14b-awq | — | yes | — |
LLM_MODEL_VERSION | ${LLM_MODEL_VERSION:-2026.9.0} | weights-fetch | host knob only | — |
LLM_REVIEW_CALLBACK_URL | http://nestjs-core:3000/internal/llm-review/result | nestjs-core | no | cid-nestjs-gateway/llm-review/services/risk-analyst-client.service.ts |
LLM_WARM_ON_START | ${LLM_WARM_ON_START:-true} | risk-analyst | yes | — |
LOG_LEVEL | INFO | cid-proxy, cid-userid-agent, document-parser, hallucination-guard, hap-guard-v2, ml-detector, ocr-service, redactor, report-renderer | no | — |
MAX_DOCUMENT_SIZE_MB | 50 | document-parser, redactor | no | — |
MAX_IMAGE_PIXELS | ${OCR_MAX_IMAGE_PIXELS:-30000000} | ocr-service | no | — |
MAX_IMAGE_SIZE_MB | 5 | ocr-service, redactor | no | — |
MAX_INLINE_REDACT_VALUES | — | — | no | cid-nestjs-gateway/inline-proxy-inspect/file-inspection.service.ts |
MAX_PAGES | 500 | document-parser | no | — |
MAX_TEXT_LENGTH | 200000 | ml-detector | no | — |
MCP_DATABASE_URL | postgresql+psycopg://cid_mcp_ro:${MCP_DB_PASSWORD}@postgres:5432/${DB_DATABASE:-ai_gateway} | mcp-server | no | — |
MCP_DB_PASSWORD | ${MCP_DB_PASSWORD} | nestjs-core | yes | cid-nestjs-gateway/database/set-mcp-password.ts |
MCP_EMBED_MODEL_DIR | /models/multilingual-e5-small | mcp-server | no | — |
MCP_HOST | 0.0.0.0 | mcp-server | no | — |
MCP_LOG_FORMAT | json | mcp-server | no | — |
MCP_LOG_LEVEL | INFO | mcp-server | no | — |
MCP_PORT | 8020 | mcp-server | no | — |
MCP_SEARCH_DENSE | ${MCP_SEARCH_DENSE:-true} | mcp-server | host knob only | — |
MCP_SERVER_HOST_PORT | 8020 | — | yes | — |
MCP_SERVER_URL | http://mcp-server:8020/mcp | risk-analyst | no | — |
MCP_SHARED_TOKEN | ${MCP_SHARED_TOKEN} | mcp-server, risk-analyst | yes | — |
MCP_TRANSCRIPT_MAX_CHARS | 1500 | mcp-server | no | — |
MCP_TRANSCRIPT_MAX_MESSAGES | 10 | mcp-server | no | — |
MIN_TEXT_LENGTH_FOR_DETECTION | 3 | ml-detector | no | — |
MKL_NUM_THREADS | 2 | attack-guard, doc-classifier, hallucination-guard, hap-guard-v2, ml-detector, ocr-service, risk-analyst | no | — |
ML_DETECTOR_INTRA_OP | 2 | — | host knob only | — |
ML_DETECTOR_MAX_CONCURRENT | 8 | — | host knob only | — |
ML_DETECTOR_WORKERS | 1 | — | host knob only | — |
ML_SERVICE_ENABLED | true | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/ml-client.service.tscid-nestjs-gateway/guardrails/detection/pii/detectors/seeded-pii-engine.test-fixture.ts |
ML_SERVICE_TIMEOUT | 180000 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/ml-client.service.tscid-nestjs-gateway/ml-engine/ml-engine.service.ts |
ML_SERVICE_URL | http://ml-detector:8000 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/ml-client.service.tscid-nestjs-gateway/ml-engine/ml-engine.service.ts |
MODEL_DIGEST | ${LLM_MODEL_DIGEST:-} | llm-inference | no | — |
MODEL_ID | ${LLM_MODEL:-qwen3:14b} | llm-inference | no | — |
NODE_ENV | production | nestjs-core | no | — |
NORMALIZATION_ENABLED | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZATION_MAX_INPUT_BYTES | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZATION_MAX_PASSES | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZE_BASE64 | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZE_CASE | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZE_ENCODING | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZE_INVISIBLE_CHARS | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZE_LEETSPEAK | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZE_PADDING | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZE_ROT13 | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NORMALIZE_UNICODE | — | — | no | cid-nestjs-gateway/guardrails/normalization/text-normalization.service.ts |
NO_PROXY | ${NO_PROXY:-} | nestjs-core | host knob only | — |
OCR_API_TOKEN | ${OCR_API_TOKEN:-} | ocr-service | host knob only | — |
OCR_AUTH_REQUIRED | false | ocr-service | no | — |
OCR_CPUS | — | — | host knob only | — |
OCR_CPU_THREADS | — | — | host knob only | — |
OCR_DET_LIMIT_SIDE_LEN | — | — | host knob only | — |
OCR_DET_LIMIT_TYPE | — | — | host knob only | — |
OCR_GPU_SERVICE_TIMEOUT | ${OCR_GPU_SERVICE_TIMEOUT:-30000} | document-parser, nestjs-core | host knob only | — |
OCR_GPU_SERVICE_TOKEN | ${OCR_GPU_SERVICE_TOKEN:-} | document-parser, nestjs-core | yes | cid-nestjs-gateway/guardrails/clients/ocr-client.service.ts |
OCR_GPU_SERVICE_URL | ${OCR_GPU_SERVICE_URL:-} | document-parser, nestjs-core | host knob only | cid-nestjs-gateway/guardrails/clients/ocr-client.service.ts |
OCR_GPU_TRUST_NETWORK | ${OCR_GPU_TRUST_NETWORK:-false} | document-parser, nestjs-core | host knob only | cid-nestjs-gateway/guardrails/clients/ocr-client.service.ts |
OCR_INSTALL_TESSERACT | — | — | host knob only | — |
OCR_MAX_IMAGE_PIXELS | — | — | host knob only | — |
OCR_SERVICE_ENABLED | true | document-parser, nestjs-core | no | cid-nestjs-gateway/guardrails/clients/ocr-client.service.ts |
OCR_SERVICE_TIMEOUT | 60000 | document-parser, nestjs-core | no | — |
OCR_SERVICE_URL | ${OCR_SERVICE_URL:-http://ocr-service:8009} | document-parser, nestjs-core | host knob only | cid-nestjs-gateway/guardrails/clients/ocr-client.service.ts |
OCR_THREAD_POOL_SIZE | 4 | ocr-service | no | — |
OCR_VERTICAL_RESCAN | ${OCR_VERTICAL_RESCAN:-false} | ocr-service | host knob only | — |
OMP_NUM_THREADS | 2 | attack-guard, doc-classifier, hallucination-guard, hap-guard-v2, ml-detector, ocr-service, risk-analyst | no | — |
OMP_WAIT_POLICY | PASSIVE | attack-guard, doc-classifier, hallucination-guard, hap-guard-v2, ml-detector, ocr-service | no | — |
ONNX_INTRA_OP_THREADS | ${ML_DETECTOR_INTRA_OP:-2} | attack-guard, hap-guard-v2, ml-detector | no | — |
ONNX_MAX_CONCURRENT | ${ML_DETECTOR_MAX_CONCURRENT:-8} | attack-guard, hap-guard-v2, ml-detector | no | — |
ONNX_MODEL_PATH | /models/cid-pii-ner-v1 | ml-detector | no | — |
OPENAI_API_KEY | ${OPENAI_API_KEY:-} | deepteam | host knob only | — |
OPENAPI_UI | ${OPENAPI_UI:-false} | nestjs-core | yes | cid-nestjs-gateway/main.tscid-nestjs-gateway/openapi.ts |
PADDLEOCR_CPU_THREADS | ${OCR_CPU_THREADS:-4} | ocr-service | no | — |
PADDLEOCR_DET_LIMIT_SIDE_LEN | ${OCR_DET_LIMIT_SIDE_LEN:-2000} | ocr-service | no | — |
PADDLEOCR_DET_LIMIT_TYPE | ${OCR_DET_LIMIT_TYPE:-max} | ocr-service | no | — |
PADDLEOCR_ENABLE_HPI | false | ocr-service | no | — |
PADDLEOCR_ENGINE | ${PADDLEOCR_ENGINE:-onnxruntime} | ocr-service | host knob only | — |
PADDLEOCR_GPU_DEVICE | 0 | ocr-service | no | — |
PADDLEOCR_ORT_CONFIG | ${PADDLEOCR_ORT_CONFIG:-} | ocr-service | host knob only | — |
PADDLEOCR_USE_GPU | false | ocr-service | no | — |
PASSWORD_RESET_EXPIRES_MINUTES | ${PASSWORD_RESET_EXPIRES_MINUTES:-60} | nestjs-core | host knob only | cid-nestjs-gateway/auth/auth.service.tscid-nestjs-gateway/database/reset-local-password.tscid-nestjs-gateway/password-delivery/password-delivery.service.ts |
PASSWORD_RESET_LOG_LINK | ${PASSWORD_RESET_LOG_LINK:-} | nestjs-core | yes | cid-nestjs-gateway/auth/services/emailjs.service.ts |
PASSWORD_RESET_URL_BASE | ${PASSWORD_RESET_URL_BASE:-} | nestjs-core | host knob only | cid-nestjs-gateway/auth/auth.service.ts |
PC_APP_NAME | CID Prompt Compressor | prompt-compressor | no | — |
PC_ENVIRONMENT | production | prompt-compressor | no | — |
PC_LOG_LEVEL | INFO | prompt-compressor | no | — |
PC_ML_PRELOAD | true | prompt-compressor | no | — |
PC_VERSION | 1.0.0 | prompt-compressor | no | — |
PGADMIN_DEFAULT_EMAIL | ${PGADMIN_EMAIL:-admin@aigateway.com} | pgadmin | no | — |
PGADMIN_DEFAULT_PASSWORD | ${PGADMIN_PASSWORD:-admin} | pgadmin | no | — |
PGADMIN_EMAIL | admin@example.com | — | yes | — |
PGADMIN_PASSWORD | REPLACE_ME | — | yes | — |
PII_MAP_ENCRYPTION_KEY | ${PII_MAP_ENCRYPTION_KEY:-} | nestjs-core | yes | cid-nestjs-gateway/sessions/services/pii-map-crypto.service.ts |
PORT | 8009 | document-parser, ml-detector, ocr-service, redactor, report-renderer | no | cid-nestjs-gateway/help/corpus/runbook-engine.service.tscid-nestjs-gateway/main.ts |
POSTGRES_DB | ${DB_DATABASE:-ai_gateway} | postgres | no | — |
POSTGRES_PASSWORD | ${DB_PASSWORD:-postgres} | postgres | no | — |
POSTGRES_USER | ${DB_USERNAME:-postgres} | postgres | no | — |
PROMPT_COMPRESSOR_ENABLED | true | nestjs-core | no | cid-nestjs-gateway/prompt-compression/services/prompt-compressor-client.service.ts |
PROMPT_COMPRESSOR_TIMEOUT | 8000 | nestjs-core | no | cid-nestjs-gateway/prompt-compression/services/prompt-compressor-client.service.ts |
PROMPT_COMPRESSOR_URL | http://prompt-compressor:8015 | nestjs-core | no | cid-nestjs-gateway/prompt-compression/services/prompt-compressor-client.service.ts |
PROVISION_TOKEN | ${PROVISION_TOKEN:-} | nestjs-core | yes | cid-nestjs-gateway/provision/provision-token.guard.ts |
PROXY_ANTHROPIC_MODE | ${PROXY_ANTHROPIC_MODE:-translate} | cid-proxy | host knob only | — |
PROXY_AUTH_MODE | ${PROXY_AUTH_MODE:-passthrough} | cid-proxy | yes | — |
PROXY_DOMAIN | ${PROXY_DOMAIN} | caddy | yes | cid-nestjs-gateway/setup/setup.service.ts |
PROXY_LOG_LEVEL | info | — | yes | — |
PROXY_LOG_REQUESTS | ${PROXY_LOG_REQUESTS:-true} | cid-proxy | yes | — |
PROXY_OUTPUT_FILTERING | ${PROXY_OUTPUT_FILTERING:-streaming} | cid-proxy | yes | — |
PROXY_PASSTHROUGH_API_KEY | ${PROXY_PASSTHROUGH_API_KEY:-cid_key_dev_only_replace_in_production} | cid-proxy | yes | — |
PROXY_PORT | 8080 | cid-proxy | no | — |
PROXY_SYSTEM_PROMPT_INJECTION | ${PROXY_SYSTEM_PROMPT_INJECTION:-false} | cid-proxy | yes | — |
PUBLIC_BASE_URL | ${PUBLIC_BASE_URL:-} | nestjs-core | yes | cid-nestjs-gateway/repo-connector/repo-connector.service.tscid-nestjs-gateway/repo-connector/services/github-manifest.service.ts |
PWD | — | — | host knob only | — |
PYTHON_ML_SERVICE_URL | — | — | no | cid-nestjs-gateway/ml-engine/ml-engine.service.ts |
RAG_ENGINE_ENABLED | true | hallucination-guard | no | — |
RAG_HALLUCINATION_THRESHOLD | 0.5 | hallucination-guard | no | — |
RAG_MODEL_CACHE_DIR | /models | risk-analyst | no | — |
RAG_MODEL_DIR | ${RAG_MODEL_DIR:-/opt/models/multilingual-e5-small} | risk-analyst | host knob only | — |
RAG_SUPPORTED_RATIO_THRESHOLD | 0.7 | hallucination-guard | no | — |
RATE_LIMIT_DEFAULT_RPM | ${RATE_LIMIT_DEFAULT_RPM:-60} | cid-proxy | yes | — |
RATE_LIMIT_ENABLED | ${RATE_LIMIT_ENABLED:-true} | cid-proxy | yes | — |
RECONFIG_ALLOWED_SERVICES | hap-guard-v2,attack-guard,ml-detector | reconfigure-agent | no | — |
RECONFIG_POLL_SECONDS | 3 | reconfigure-agent | no | — |
REDACTOR_SERVICE_ENABLED | true | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/redactor-client.service.ts |
REDACTOR_SERVICE_TIMEOUT | 60000 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/redactor-client.service.ts |
REDACTOR_SERVICE_URL | http://redactor:8013 | nestjs-core | no | cid-nestjs-gateway/guardrails/clients/redactor-client.service.ts |
REDACT_EST_PER_ROW_MS | — | — | no | cid-nestjs-gateway/document-analysis/redaction-job.service.ts |
REDACT_MAX_ROWS | — | — | no | cid-nestjs-gateway/document-analysis/redaction-job.service.ts |
REDIS_CONNECTION_TIMEOUT | 5 | ml-detector | no | — |
REDIS_DB | 0 | attack-guard, ml-detector | no | cid-nestjs-gateway/app.module.tscid-nestjs-gateway/inline-proxy-inspect/attestation.service.ts |
REDIS_HOST | redis | attack-guard, cid-proxy, ml-detector, nestjs-core | no | cid-nestjs-gateway/app.module.tscid-nestjs-gateway/inline-proxy-inspect/attestation.service.ts |
REDIS_HOSTS | local:redis:6379:0:${REDIS_PASSWORD} | redis-commander | no | — |
REDIS_PASSWORD | ${REDIS_PASSWORD} | attack-guard, cid-proxy, ml-detector, nestjs-core, redis | yes | cid-nestjs-gateway/app.module.tscid-nestjs-gateway/inline-proxy-inspect/attestation.service.ts |
REDIS_PORT | 6379 | attack-guard, cid-proxy, ml-detector, nestjs-core | no | cid-nestjs-gateway/app.module.tscid-nestjs-gateway/inline-proxy-inspect/attestation.service.ts |
REDIS_SOCKET_TIMEOUT | 5 | ml-detector | no | — |
REDIS_TLS | — | — | no | cid-nestjs-gateway/app.module.ts |
REGISTRY_PULL_HOST | — | — | no | cid-nestjs-gateway/diagnostics/collectors/appliance.collector.ts |
RELEASE_DATA_SYNC | — | — | no | cid-nestjs-gateway/atlas/services/atlas-snapshot-loader.service.tscid-nestjs-gateway/database/seeds/release-data-sync.service.tscid-nestjs-gateway/owasp/services/owasp-snapshot-loader.service.ts |
REPORT_RENDERER_ENABLED | true | nestjs-core | no | cid-nestjs-gateway/report-rendering/report-renderer-client.service.ts |
REPORT_RENDERER_TIMEOUT | 30000 | nestjs-core | no | cid-nestjs-gateway/report-rendering/report-renderer-client.service.ts |
REPORT_RENDERER_URL | http://report-renderer:8014 | nestjs-core | no | cid-nestjs-gateway/report-rendering/report-renderer-client.service.ts |
REPO_TRACKING_ENABLED | ${REPO_TRACKING_ENABLED:-false} | nestjs-core | host knob only | cid-nestjs-gateway/repo-connector/repo-connector.module.ts |
RESPONSE_HALLUCINATION_TIMEOUT_MS | ${RESPONSE_HALLUCINATION_TIMEOUT_MS:-5000} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/response-inspection.service.ts |
RISK_ANALYST_HOST_PORT | 8019 | — | yes | — |
RISK_ANALYST_SERVICE_ENABLED | ${RISK_ANALYST_SERVICE_ENABLED:-false} | nestjs-core | yes | cid-nestjs-gateway/llm-review/services/risk-analyst-client.service.ts |
RISK_ANALYST_SERVICE_TIMEOUT | 15000 | nestjs-core | no | cid-nestjs-gateway/llm-review/services/risk-analyst-client.service.ts |
RISK_ANALYST_SERVICE_URL | http://risk-analyst:8019 | nestjs-core | no | cid-nestjs-gateway/llm-review/services/risk-analyst-client.service.ts |
SEED_ON_BOOT | — | — | no | cid-nestjs-gateway/database/seeds/release-data-sync.service.tscid-nestjs-gateway/main.ts |
SEED_SAMPLE_ACCOUNTS | — | — | no | cid-nestjs-gateway/database/seeds/seeder.service.tscid-nestjs-gateway/diagnostics/collectors/posture.collector.ts |
SELF_HOSTED_LLM_API_KEY | ${SELF_HOSTED_LLM_API_KEY:-} | nestjs-core | host knob only | cid-nestjs-gateway/chat/chat.service.ts |
SELF_HOSTED_LLM_BASE_URL | ${SELF_HOSTED_LLM_BASE_URL:-} | nestjs-core | host knob only | cid-nestjs-gateway/chat/chat.service.ts |
SELF_HOSTED_LLM_HEADERS | ${SELF_HOSTED_LLM_HEADERS:-} | nestjs-core | host knob only | cid-nestjs-gateway/chat/chat.service.ts |
SELF_HOSTED_LLM_MODEL | ${SELF_HOSTED_LLM_MODEL:-} | nestjs-core | host knob only | cid-nestjs-gateway/chat/chat.service.ts |
SIEM_EXPORT_DEGRADED_AFTER | — | — | no | cid-nestjs-gateway/integrations/services/itsm-export.service.tscid-nestjs-gateway/integrations/services/siem-export.service.ts |
SIEM_EXPORT_INTERVAL_MS | — | — | no | cid-nestjs-gateway/integrations/integrations.module.ts |
SIEM_EXPORT_STALL_MS | — | — | no | cid-nestjs-gateway/integrations/integrations.service.tscid-nestjs-gateway/integrations/services/itsm-export.service.tscid-nestjs-gateway/integrations/services/siem-export.service.ts |
STATIC_FILE | ${USERID_AGENT_STATIC_FILE:-} | cid-userid-agent | no | — |
SYSTEM_UPDATE_ALLOWED_HOSTS | ${SYSTEM_UPDATE_ALLOWED_HOSTS:-} | nestjs-core | yes | cid-nestjs-gateway/system-update/system-update.service.ts |
SYSTEM_UPDATE_CHANNEL_URL | ${SYSTEM_UPDATE_CHANNEL_URL:-} | nestjs-core | host knob only | cid-nestjs-gateway/system-update/system-update.service.ts |
SYSTEM_UPDATE_MAX_BYTES | — | — | no | cid-nestjs-gateway/system-update/system-update.service.ts |
SYSTEM_UPDATE_PUBLISHER | — | — | no | cid-nestjs-gateway/system-update/system-update.service.ts |
TOKENIZERS_PARALLELISM | false | risk-analyst | no | — |
TRUSTED_PROXY_IPS | — | — | yes | cid-nestjs-gateway/common/http/trusted-proxy.ts |
TSR_TMP_DIR | /app/src/.tanstack-tmp | frontend | no | — |
TURK_LETTUCE_DETECT_MODEL_PATH | /models/turk-lettuce-detect | hallucination-guard | no | — |
USERID_AGENT_LDAP_BASE_DN | — | — | host knob only | — |
USERID_AGENT_LDAP_BIND_DN | — | — | host knob only | — |
USERID_AGENT_LDAP_BIND_PASSWORD | — | — | host knob only | — |
USERID_AGENT_LDAP_URL | — | — | host knob only | — |
USERID_AGENT_LOG_LEVEL | — | — | host knob only | — |
USERID_AGENT_PORT | — | — | host knob only | — |
USERID_AGENT_PROTECT_READS | — | — | host knob only | — |
USERID_AGENT_STATIC_FILE | — | — | host knob only | — |
USERID_AGENT_TIMEOUT_MS | ${USERID_AGENT_TIMEOUT_MS:-250} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/userid-agent.client.ts |
USERID_AGENT_TOKEN | ${USERID_AGENT_TOKEN:-} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/userid-agent.client.ts |
USERID_AGENT_URL | ${USERID_AGENT_URL:-} | nestjs-core | host knob only | cid-nestjs-gateway/inline-proxy-inspect/userid-agent.client.ts |
USE_HAP_V2 | — | — | no | cid-nestjs-gateway/guardrails/detection/safety-guard/safety-guard-detection.service.ts |
USE_NEW_REDACTOR | false | nestjs-core | no | cid-nestjs-gateway/guardrails/detection/orchestrators/image-detection.service.ts |
UVICORN_WORKERS | 1 | attack-guard, cost-analyzer, hap-guard-v2, language-detector, ml-detector, prompt-compressor | no | — |
VALIDATOR_DEBUG | ${VALIDATOR_DEBUG:-false} | nestjs-core | host knob only | cid-nestjs-gateway/guardrails/validation/validators/entity-validator.service.ts |
VITE_AI_GATEWAY_URL | http://localhost:3000 | frontend | yes | — |
VITE_ALLOWED_HOSTS | ${VITE_ALLOWED_HOSTS:-} | frontend | host knob only | — |
VITE_API_BASE_URL | https://api.example.com | frontend | yes | — |
Declared but no gateway reader found
Treat any security-looking variable in this list as unenforced until you have found the reader
(root CLAUDE.md, Known Limitations). Most entries here are legitimately consumed outside the
gateway — the Python ML services, cid-proxy, or docker-entrypoint.sh.
| Variable | Declared on |
|---|---|
ACME_EMAIL | caddy |
AGENT_AUTH_TOKEN | cid-userid-agent |
AGENT_PROTECT_READS | cid-userid-agent |
ANALYST_ANALYSIS_BATCH_PAUSE_MS | risk-analyst |
ANALYST_ANALYSIS_BATCH_SIZE | risk-analyst |
ANALYST_ANALYSIS_CONCURRENCY | risk-analyst |
ANALYST_ANALYSIS_MAX_WAIT | risk-analyst |
ANALYST_ANALYSIS_ROUND_TIMEOUT | risk-analyst |
ANALYST_CHAT_HIDDEN_TOOLS | risk-analyst |
ANALYST_CHAT_UNGROUNDED_ANSWER_CHARS | risk-analyst |
ANALYST_CLEAR_MAX | risk-analyst |
ANALYST_CONTEXT_WINDOW | risk-analyst |
ANALYST_KNOWLEDGE_REFRESH_SECONDS | risk-analyst |
ANALYST_LLM_ROUND_TIMEOUT | risk-analyst |
ANALYST_LOCK_MIN | risk-analyst |
ANALYST_MAX_QUEUE_DEPTH | risk-analyst |
ANALYST_REVIEW_CONCURRENCY | risk-analyst |
ANALYST_REVIEW_TIMEOUT | risk-analyst |
ANALYST_TRACE_DIR | risk-analyst |
ANTHROPIC_API_KEY | deepteam |
APP_DOMAIN | caddy |
APP_NAME | attack-guard, document-parser, hallucination-guard, ml-detector, ocr-service, redactor, report-renderer |
CACHE_ENABLED | ml-detector |
CACHE_KEY_PREFIX | ml-detector |
CACHE_TTL | attack-guard, ml-detector |
CA_APP_NAME | cost-analyzer |
CA_ENVIRONMENT | cost-analyzer |
CA_LOG_LEVEL | cost-analyzer |
CA_VERSION | cost-analyzer |
CID_ATTEST_ENFORCE | cid-proxy |
CID_BACKEND_TIMEOUT | cid-proxy |
CID_BACKEND_URL | cid-proxy |
CID_CONTAINER_PREFIX | reconfigure-agent |
CID_CORE_INSPECT_URL | cid-inline-proxy |
CID_DEBUG_DUMP_REQUESTS | cid-inline-proxy |
CID_DEBUG_DUMP_RESPONSES | cid-inline-proxy |
CID_HOST_EXEC | reconfigure-agent |
CID_INSPECT_BINARY_TIMEOUT_MS | cid-inline-proxy |
CID_INSPECT_FAIL_OPEN | cid-inline-proxy |
CID_INSPECT_KEY | cid-proxy |
CID_INSPECT_TIMEOUT_MS | cid-inline-proxy |
CID_INSPECT_URL | cid-proxy |
CID_PASSTHROUGH_FAIL_OPEN | cid-proxy |
CID_PASSTHROUGH_MASK | cid-proxy |
CID_UPSTREAM_URL | cid-proxy |
CONFIDENCE_THRESHOLD | ml-detector |
CORS_ORIGINS | attack-guard, document-parser, hallucination-guard, ml-detector, ocr-service, redactor |
DEBUG | attack-guard, document-parser, hallucination-guard, ml-detector, ocr-service, redactor |
DEEPTEAM_DEFAULT_ATTACKS_PER_VULNERABILITY | deepteam |
DEEPTEAM_ENABLED | nestjs-core |
DEEPTEAM_GUARDRAILS_BASE_URL | deepteam |
DEEPTEAM_GUARDRAILS_TIMEOUT | deepteam |
DEEPTEAM_LOG_LEVEL | deepteam |
DEFAULT_MASKING_STYLE | redactor |
DEFAULT_PADDING | redactor |
DEVICE | hallucination-guard |
ENVIRONMENT | attack-guard, document-parser, hallucination-guard, ml-detector, ocr-service, redactor |
GOOGLE_API_KEY | deepteam |
HAP_ONNX_MODEL_PATH | hap-guard-v2 |
HF_HOME | weights-fetch |
HF_HUB_DISABLE_TELEMETRY | weights-fetch |
HOST | document-parser, ml-detector, ocr-service, redactor, report-renderer |
HTTPS_PROXY | nestjs-core |
HTTP_PROXY | nestjs-core |
INLINE_PROXY_HTTPS_PORT | cid-inline-proxy |
INLINE_PROXY_TPROXY_PORT | cid-inline-proxy |
INLINE_PROXY_UPSTREAM | cid-inline-proxy |
INLINE_PROXY_UPSTREAM_INSECURE | cid-inline-proxy |
JAILBREAK_LOG_LEVEL | attack-guard |
JAILBREAK_MAX_TOKEN_LENGTH | attack-guard |
JAILBREAK_ONNX_MODEL_PATH | attack-guard |
KMP_BLOCKTIME | attack-guard, doc-classifier, hallucination-guard, hap-guard-v2, ml-detector, ocr-service |
LANGUAGE_DETECTION_CONFIDENCE | ml-detector |
LANG_APP_NAME | language-detector |
LANG_DEBUG | language-detector |
LANG_DEFAULT_LANGUAGE | language-detector |
LANG_ENVIRONMENT | language-detector |
LANG_LOG_LEVEL | language-detector |
LANG_MIN_TEXT_LENGTH | language-detector |
LANG_VERSION | language-detector |
LDAP_ADMIN_PASSWORD | openldap-test |
LDAP_BASE_DN | cid-userid-agent |
LDAP_BIND_DN | cid-userid-agent |
LDAP_DOMAIN | openldap-test |
LDAP_ORGANISATION | openldap-test |
LDAP_URL | cid-userid-agent |
LETTUCE_DETECT_MODEL_PATH | hallucination-guard |
LISTEN_ADDR | cid-userid-agent |
LLM_API_KEY | risk-analyst |
LLM_BASE_URL | risk-analyst |
LLM_ENGINE | risk-analyst |
LLM_HF_REPO | weights-fetch |
LLM_HF_REVISION | weights-fetch |
LLM_KEEP_ALIVE | risk-analyst |
LLM_MAX_CONCURRENCY | risk-analyst |
LLM_MODEL | risk-analyst |
LLM_MODEL_ID | weights-fetch |
LLM_MODEL_VERSION | weights-fetch |
LLM_WARM_ON_START | risk-analyst |
LOG_LEVEL | cid-proxy, cid-userid-agent, document-parser, hallucination-guard, hap-guard-v2, ml-detector, ocr-service, redactor, report-renderer |
MAX_DOCUMENT_SIZE_MB | document-parser, redactor |
MAX_IMAGE_PIXELS | ocr-service |
MAX_IMAGE_SIZE_MB | ocr-service, redactor |
MAX_PAGES | document-parser |
MAX_TEXT_LENGTH | ml-detector |
MCP_DATABASE_URL | mcp-server |
MCP_EMBED_MODEL_DIR | mcp-server |
MCP_HOST | mcp-server |
MCP_LOG_FORMAT | mcp-server |
MCP_LOG_LEVEL | mcp-server |
MCP_PORT | mcp-server |
MCP_SEARCH_DENSE | mcp-server |
MCP_SERVER_URL | risk-analyst |
MCP_SHARED_TOKEN | mcp-server, risk-analyst |
MCP_TRANSCRIPT_MAX_CHARS | mcp-server |
MCP_TRANSCRIPT_MAX_MESSAGES | mcp-server |
MIN_TEXT_LENGTH_FOR_DETECTION | ml-detector |
MKL_NUM_THREADS | attack-guard, doc-classifier, hallucination-guard, hap-guard-v2, ml-detector, ocr-service, risk-analyst |
MODEL_DIGEST | llm-inference |
MODEL_ID | llm-inference |
NODE_ENV | nestjs-core |
NO_PROXY | nestjs-core |
OCR_API_TOKEN | ocr-service |
OCR_AUTH_REQUIRED | ocr-service |
OCR_GPU_SERVICE_TIMEOUT | document-parser, nestjs-core |
OCR_SERVICE_TIMEOUT | document-parser, nestjs-core |
OCR_THREAD_POOL_SIZE | ocr-service |
OCR_VERTICAL_RESCAN | ocr-service |
OMP_NUM_THREADS | attack-guard, doc-classifier, hallucination-guard, hap-guard-v2, ml-detector, ocr-service, risk-analyst |
OMP_WAIT_POLICY | attack-guard, doc-classifier, hallucination-guard, hap-guard-v2, ml-detector, ocr-service |
ONNX_INTRA_OP_THREADS | attack-guard, hap-guard-v2, ml-detector |
ONNX_MAX_CONCURRENT | attack-guard, hap-guard-v2, ml-detector |
ONNX_MODEL_PATH | ml-detector |
OPENAI_API_KEY | deepteam |
PADDLEOCR_CPU_THREADS | ocr-service |
PADDLEOCR_DET_LIMIT_SIDE_LEN | ocr-service |
PADDLEOCR_DET_LIMIT_TYPE | ocr-service |
PADDLEOCR_ENABLE_HPI | ocr-service |
PADDLEOCR_ENGINE | ocr-service |
PADDLEOCR_GPU_DEVICE | ocr-service |
PADDLEOCR_ORT_CONFIG | ocr-service |
PADDLEOCR_USE_GPU | ocr-service |
PC_APP_NAME | prompt-compressor |
PC_ENVIRONMENT | prompt-compressor |
PC_LOG_LEVEL | prompt-compressor |
PC_ML_PRELOAD | prompt-compressor |
PC_VERSION | prompt-compressor |
PGADMIN_DEFAULT_EMAIL | pgadmin |
PGADMIN_DEFAULT_PASSWORD | pgadmin |
POSTGRES_DB | postgres |
POSTGRES_PASSWORD | postgres |
POSTGRES_USER | postgres |
PROXY_ANTHROPIC_MODE | cid-proxy |
PROXY_AUTH_MODE | cid-proxy |
PROXY_LOG_REQUESTS | cid-proxy |
PROXY_OUTPUT_FILTERING | cid-proxy |
PROXY_PASSTHROUGH_API_KEY | cid-proxy |
PROXY_PORT | cid-proxy |
PROXY_SYSTEM_PROMPT_INJECTION | cid-proxy |
RAG_ENGINE_ENABLED | hallucination-guard |
RAG_HALLUCINATION_THRESHOLD | hallucination-guard |
RAG_MODEL_CACHE_DIR | risk-analyst |
RAG_MODEL_DIR | risk-analyst |
RAG_SUPPORTED_RATIO_THRESHOLD | hallucination-guard |
RATE_LIMIT_DEFAULT_RPM | cid-proxy |
RATE_LIMIT_ENABLED | cid-proxy |
RECONFIG_ALLOWED_SERVICES | reconfigure-agent |
RECONFIG_POLL_SECONDS | reconfigure-agent |
REDIS_CONNECTION_TIMEOUT | ml-detector |
REDIS_HOSTS | redis-commander |
REDIS_SOCKET_TIMEOUT | ml-detector |
STATIC_FILE | cid-userid-agent |
TOKENIZERS_PARALLELISM | risk-analyst |
TSR_TMP_DIR | frontend |
TURK_LETTUCE_DETECT_MODEL_PATH | hallucination-guard |
UVICORN_WORKERS | attack-guard, cost-analyzer, hap-guard-v2, language-detector, ml-detector, prompt-compressor |
VITE_AI_GATEWAY_URL | frontend |
VITE_ALLOWED_HOSTS | frontend |
VITE_API_BASE_URL | frontend |