Configuration Reference

This page provides a reference for the environment variables that are used to configure the TRE Agent and its dependencies.

This section contains the environment variables that are used to configure the general app.

Environment Variable	Description
`DEPLOYMENT_VERSION`	The version of the TRE Agent app you are deploying. Find the version here , between `v` and `-5S-TES-containers`. For example, `1.5.1` is the version for the release `v1.5.1-5S-TES-containers`.
`AppName`	Name of the application shown on the Navigation bar of TRE Agent UI. Default is `Five Safes TES`.
`PGLOGIN` and `PGPASSWORD`	The admin credentials for the PostgreSQL database used by the TRE Agent. These are recommended to be changed from the default values.
`CONFIG_PATH`	The path from the compose manifest `.yml` files to the shared configuration files (e.g., realm config, ldap, vault, init scripts) for the Submission Layer. Default is `../../../DeploymentStack/Submission/config`. Change this if you are using a different files structure in your own deployment.
`KeycloakAdmin__Username` and `KeycloakAdmin__Password`	Submission Layer KeyCloak realm admin credentials for service accounts creation. Follow this guide to generate.
`CONFIG_PATH`	The path from the compose manifest `.yml` files to the shared configuration files (e.g., realm config, ldap, vault, init scripts) for the Submission Layer. Default is `../../../DeploymentStack/Submission/config`. Change this if you are using a different files structure in your own deployment.

This section contains the environment variables that are used to configure the LDAP, Vault, Camunda, RabbitMQ, and Serilog services.

Environment Variable	Description
`VaultStartupCommand`	The command to start the Vault server. Default is `vault server -config=/vault/config/config.json` to start the Vault server in the production mode.
`VaultRootToken`	The root token for the Vault server. This is used to authenticate with the Vault server. Follow the steps in `3.2` here to generate a new root token.
`RabbitMQDefaultPassword`	The default password for the RabbitMQ server used by the Submission Layer. Change this from the default value in production. Default RabbitMQ username is set to `rabbitmq` and default RabbitMQ host is set to `rabbitmq`.
`SerilogLevel`	The Serilog logging level for the Submission Layer. Default is `Information`. Change this depending on the logging level you want to set for the Submission Layer. More details here .

This section contains the environment variables that are used to configure the S3 service.

Environment Variable	Description
`SubmissionS3ConsoleUrl`	Where the S3 Submission Layer UI is hosted. For example, `https://s3-submission-ui.example.com`.
`SubmissionS3RootUser`	The admin user for the Submission Layer S3 server.
`SubmissionS3RootPass`	The admin password for the Submission Layer S3 server.

This section contains the environment variables that are used to configure the OpenID configuration.

Environment Variable	Description
`SubmissionS3OpenidSecret`	The OpenID secret for the S3 client of Dare-Control realm. There is a default value in the realm configuration, but you should regenerate it for production deployments. Do this by navigating to `Dare-Control` realm -> `Clients` -> `Dare-Control-S3` -> `Credentials`. Then click `Regenerate` and copy the new value into this environment variable.
`SubmissionUIClientSecret`	The OpenID secret for the Submission Layer UI Keycloak client `Dare-Control-UI`. Find and regenerate this secret by navigating to `Dare-Control` realm -> `Clients` -> `Dare-Control-UI` -> `Credentials`. Then click `Regenerate` and copy the new value into this environment variable.
`SubmissionAPIKeyCloakSecret`	The OpenID secret for the Submission API Keycloak client `Dare-Control-API`. Find and regenerate this secret by navigating to `Dare-Control` realm -> `Clients` -> `Dare-Control-API` -> `Credentials`. Then click `Regenerate` and copy the new value into this environment variable.
`SubmissionKeyCloakClientUIRedirectURL`	The URL for the Submission Layer UI’s Keycloak redirect URL. For example, `https://submission-layer.example.com/`.

This section contains the environment variables that are used to configure the built-in Keycloak server.

Environment Variable	Description
`KeycloakBootstrapAdminPassword`	The bootstrap admin password for the Keycloak server used by the Submission layer. This is used to bootstrap the Keycloak server with the admin user.
`KeycloakStartupCommand`	The command to start the Keycloak server. If your Keycloak doesn’t have `HTTPS` enabled yet, this is `start-dev`. Otherwise, this should be set to `start`.
`KeycloakFullURL`	The full hostname URL of the Keycloak server, for example,`http://localhost:8085` or `https://my-keycloak.example.com`. This is only used if you are using a local/internal Keycloak service defined in the `ServiceStack/compose-manifests/shared/auth.yml` file.