Configuration model Unkey services read configuration from a TOML file passed at startup. Environment variables can be referenced with ${VAR} and are expanded before parsing. Defaults and validation run after parsing.
The config schema maps to svc/krane/config.go
Krane enables the secrets RPC only when vault.url is set. Other features run without Vault.
Minimal config example:
region = "${UNKEY_REGION}.aws" instance_id = "${POD_NAME}" rpc_port = 8080 [ control ] url = "${UNKEY_CTRL_URL}" token = "${UNKEY_CTRL_TOKEN}" [ vault ] url = "${UNKEY_VAULT_URL}" token = "${UNKEY_VAULT_TOKEN}" [ registry ] url = "${UNKEY_REGISTRY_URL}" username = "${UNKEY_REGISTRY_USERNAME}" password = "${UNKEY_REGISTRY_PASSWORD}"
Instance identifier for logs and tracing.
Region label for routing and control plane.
Registry credentials. The krane runtime does not read this config today. Vault connection for the secrets service. Control plane connection. Tracing, logging, and metrics configuration. observability.tracing.sample_rate
Trace sampling rate.
observability.logging.sample_rate
Log sampling rate.
observability.logging.slow_threshold
Slow log threshold.
observability.metrics.prometheus_port
Prometheus port. Set to 0 to disable.
Example configuration region = "${UNKEY_REGION}.aws" instance_id = "${POD_NAME}" rpc_port = 8080 [ control ] url = "${UNKEY_CTRL_URL}" token = "${UNKEY_CTRL_TOKEN}" [ vault ] url = "${UNKEY_VAULT_URL}" token = "${UNKEY_VAULT_TOKEN}" [ registry ] url = "${UNKEY_REGISTRY_URL}" username = "${UNKEY_REGISTRY_USERNAME}" password = "${UNKEY_REGISTRY_PASSWORD}" [ observability . tracing ] sample_rate = 0.1 [ observability . logging ] sample_rate = 0.01 slow_threshold = "2s" [ observability . metrics ] prometheus_port = 9090
