Server
| Variable | Type | Default | Required | Description |
|---|---|---|---|---|
DATABASE_URL | string | — | Yes | PostgreSQL connection string. Example: postgresql://user:pass@host:5432/vane. |
PORT | number | 3000 | No | Port the HTTP server listens on. |
VANE_BASE_URL | string | Inferred from Host + X-Forwarded-Proto | No | Public base URL of this Vane instance. Set this when running behind a reverse proxy so the jwks_uri in GET /v1/ca/well-known is correct. Example: https://vane.build. |
Security
| Variable | Type | Default | Required | Description |
|---|---|---|---|---|
VANE_MASTER_KEY | string | — | No (strongly recommended) | Passphrase used to encrypt Ed25519 private keys at rest with AES-256-GCM. Derive the actual key as SHA-256 of this string. Use a 64-character random hex string for adequate entropy. If not set, keys are stored in plaintext and a warning is logged. |
SPIFFE_TRUST_DOMAIN | string | vane.local | No | Trust domain used in all SPIFFE IDs. Example: vane.build. All companies in one deployment share this domain. |
mTLS
| Variable | Type | Default | Required for mTLS | Description |
|---|---|---|---|---|
VANE_MTLS_CA_CERT | string | — | Enables mTLS | PEM-encoded CA certificate used to verify client certificates. Accepts raw PEM or a file path. Setting this variable switches the server to HTTPS mode. |
VANE_TLS_CERT | string | — | Yes (when mTLS enabled) | PEM-encoded server certificate. Accepts raw PEM or a file path. |
VANE_TLS_KEY | string | — | Yes (when mTLS enabled) | PEM-encoded server private key. Accepts raw PEM or a file path. |
Observability
| Variable | Type | Default | Required | Description |
|---|---|---|---|---|
LOG_LEVEL | string | info | No | Pino log level. Valid values: trace, debug, info, warn, error, fatal, silent. |
SENTRY_DSN | string | — | No | Sentry DSN for error reporting. If not set, Sentry is not initialized and exceptions are only logged. |
Sidecar
| Variable | Type | Default | Required | Description |
|---|---|---|---|---|
VANE_API_URL | string | — | Yes | Base URL of the Vane server. Example: https://vane.build. |
VANE_API_KEY | string | — | Yes | Company-scoped API key. |
VANE_AGENT_ID | string | — | Yes | Agent ID pre-registered on the server. |
VANE_COMPANY_ID | string | — | Yes | Company ID. |
SIDECAR_PORT | number | 8080 | No | Port for the sidecar proxy. Always binds to 127.0.0.1. |
SIDECAR_AGENT_TARGET | string | — | No | Where to forward verified inbound calls. Required for inbound (reverse proxy) mode. Example: http://localhost:3001. |
SIDECAR_CA_CERT_FILE | string | ./vane-ca.pem | No | File path to write the MITM CA certificate. |
Example .env
# Required
DATABASE_URL=postgresql://vane:secret@db.example.com:5432/vane
# Security
VANE_MASTER_KEY=a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890a1b2c3d4e5f67890
SPIFFE_TRUST_DOMAIN=vane.build
# Server
PORT=3000
VANE_BASE_URL=https://vane.build
# Observability
LOG_LEVEL=info
SENTRY_DSN=https://key@o1234.ingest.sentry.io/5678
Validation
The server does not validateDATABASE_URL format at startup — PostgreSQL connection errors will surface on the first query. Check the server logs for pool error entries if the database is unreachable.
VANE_MASTER_KEY is validated lazily — the server starts successfully without it, but logs a warning at startup:
WARN Vane: VANE_MASTER_KEY is not set — private keys are stored in plaintext in the database