Loading…
Loading…
The settings an operator provides at install time and the platform settings that can be tuned afterward. Since v1.0.
The settings an operator provides at install time and the platform settings that can be tuned afterward. Since v1.0.
There are two layers of configuration:
.env). These
cover database connectivity, the credential key, identity, and cloud-adapter
provider selection.Environment-variable names are case-sensitive and exact. The names below are the actual variables read by the services. Where a Spring property name is shown (dotted form, e.g.
s2r.cloud.provider), the equivalent environment variable is the upper-snake-case form Spring relaxed binding resolves.
These must be set on every deploy. On Cloud Run, secret bindings are not
inherited from the prior revision — the deploy tooling re-applies them every
time; if one is dropped you will see a startup/credential error
(S2R-ADM-0419). On GCP-native they are bound from Secret Manager by
scripts/deploy-gcloud.ps1; on Helm/Compose you supply them directly.
| Variable | Purpose | Notes |
| --- | --- | --- |
| S2R_DB_PASSWORD | PostgreSQL password (password-auth deployments) | Required when S2R_DB_IAM_AUTH_ENABLED=false. Generate with openssl rand -base64 24. |
| S2R_CREDENTIAL_KEY | AES key encrypting backend-profile credentials in the DB | Must be a base64-encoded 32-byte (256-bit) value. Generate with openssl rand -base64 32. Rotating it invalidates every previously-encrypted credential row — pick once, store in your secret manager, never change. Read by admin-api and runtime. |
| S2R_F5_VM_DB_PASSWORD | DB password used during F5 relay-VM provisioning | Read by admin-api and worker; only relevant when you run a traffic relay VM. |
Never commit secrets to source control. On Compose, keep them in
.env(which is git-ignored); on GCP, in Secret Manager; on Helm, in Kubernetes Secrets.
| Variable | Default | Purpose |
| --- | --- | --- |
| S2R_DB_IAM_AUTH_ENABLED | — | true to use GCP IAM DB auth (Cloud SQL); false for password auth. Set false for any non-GCP deployment. |
| S2R_DB_AUTH_MODE | — | password for password auth (set alongside S2R_DB_IAM_AUTH_ENABLED=false). |
| S2R_DB_HOST | postgres (Compose) | Database host. |
| S2R_DB_PORT | 5432 | Database port. |
| S2R_DB_NAME | soap_to_rest | Database name. |
| S2R_DB_USER | s2r_app | Application role. |
| S2R_DB_SSL_MODE | — | require for external/managed Postgres; disable only for the bundled in-network database. |
The same database connectivity variables are set consistently on admin-api, runtime, and worker. admin-api owns the Flyway migrations and applies them on startup.
The product expects authentication to terminate at your edge (Cloud IAP, or OIDC/SAML at your gateway). See Authentication.
| Variable | Purpose |
| --- | --- |
| S2R_ADMIN_UI_AUTH_MODE | UI auth mode. none when an upstream proxy/IdP terminates auth (the off-GCP norm). |
| S2R_ADMIN_AUTH_DISABLED | Bypass admin-api auth — local demo only; never set in a reachable environment. |
| S2R_ADMIN_BOOTSTRAP_EMAILS | Comma-separated emails seeded into the admin role on first boot. |
| S2R_ADMIN_BOOTSTRAP_OPERATOR_EMAILS | Emails seeded into the operator role on first boot. |
| S2R_ADMIN_BOOTSTRAP_READER_EMAILS | Emails seeded into the reader role on first boot. |
On first boot, if no admin is seeded, the first authenticated user to reach the admin UI becomes the bootstrap admin; normal RBAC applies thereafter. See RBAC & roles.
| Variable | Default |
| --- | --- |
| S2R_ADMIN_API_INTERNAL_URL | http://admin-api:8080 |
| S2R_RUNTIME_INTERNAL_URL | http://runtime:8080 |
| S2R_ADMIN_UI_HOST_PORT | 8080 (host port the external LB targets in standalone mode) |
All cloud-specific plumbing — object store, secret store, compute provisioner, relay-VM gateway — is selected at boot. Google Cloud, Azure, and VMware adapters ship in v1.0 (AWS in progress).
| Property | Env-var form | Default | Accepts |
| --- | --- | --- | --- |
| s2r.cloud.provider | S2R_CLOUD_PROVIDER | gcp | gcp, azure, vmware, aws |
| s2r.relay-vm.provider | S2R_RELAY_VM_PROVIDER | gcp | gcp, aws, vmware |
The relay-VM provider can be set independently of the main cloud provider — a
deployment may run platform services on one cloud and a traffic relay VM on
another. At startup the affected services log which adapter was resolved (e.g.
Relay-VM provider: <value> (gateway impl: <ClassName>)), so you can confirm the
selection.
| Variable | Default | Purpose |
| --- | --- | --- |
| S2R_IMAGE_PREFIX | s2r | Registry/repo prefix for the service images. |
| S2R_IMAGE_TAG | latest | Image tag to run. Pin a version tag (e.g. v1.0.0) for reproducible deploys. |
The conversion runtime ships with conservative defaults that you can tune per service/operation in the UI (see Conversion options).
100 ms default.2 default.413 and error code S2R-RUN-0413.Set under Settings in the admin UI after first boot. Highlights:
| Setting | Default | Notes |
| --- | --- | --- |
| Data retention (default_retention_days) | 60 days | Configurable under Settings → Retention. Governs the raw traffic archive. Aggregation tables and the audit log have their own (longer) retention defaults. |
| Install profile | both | f5_modernization, generic, or both — controls which feature surfaces are shown. |
| Topology labels | — | Free-text labels (e.g. prod, staging) surfaced in audit and structured logs. |
| Excluded consumer IP ranges | — | CIDR list excluded from traffic aggregation (e.g. synthetic monitors). |
| License | Trial / Community | View status and upload a renewal token. See Licensing. |
Retention specifics are in Data retention and Backup & restore.
Every revision deployed by the tooling carries provenance variables you can
inspect to confirm exactly what is running — S2R_DEPLOY_COMMIT_SHA,
S2R_DEPLOY_COMMIT_SHORT, S2R_DEPLOY_BRANCH, S2R_DEPLOY_TIMESTAMP, and
S2R_DEPLOY_IMAGE_TAG. Each service also logs a single S2R-DEPLOY … line on
startup. See the
deployment runbook.