Authentication
-
auth.enabled - Default false. Auth-off callers have operator authority; enable an authenticated mode before exposing the listener.
-
auth.jwks_url - Required nonempty JWKS URL for JWT mode without Lys. On main, a binary without the auth feature refuses this mode at boot; crates/aion-server/src/run.rs:536–544 enforces that requirement.
-
auth.jwks_refresh_seconds - Positive JWKS refresh interval. Default 300 seconds.
-
auth.lys - Optional Lys pass configuration. With authentication enabled, selects Lys pass validation instead of ordinary JWT validation.
-
auth.namespace_claim - Required in authenticated non-Lys mode. Names the one claim granting namespaces. Forbidden with Lys or auth disabled; sub, exp, deploy and assistant.sessions are reserved.
-
auth.liminal_token_file - Optional shared connection-token file for the liminal worker listener. Requires authentication and liminal_namespace; it does not identify individual workers.
-
auth.liminal_namespace - The one namespace admitted by the authenticated liminal listener. Required with liminal_token_file.
Lys
-
auth.lys.issuer - Required trusted Lys origin. Published keys are read from its OAuth JWKS route at boot.
-
auth.lys.connector_credential_file - Required path to the app connector credential provisioned by the installer. The draft runner uses it to pull and close approved drafts.
-
auth.lys.drafts_pull_seconds - Required positive seconds between draft pulls. No code default; choose it for the deployment.
TLS
-
tls.certificate_chain_path - Required certificate-chain file path when TLS is configured.
-
tls.private_key_path - Required private-key file path when TLS is configured.
Console
-
ops_console.source - Embedded by default. A FileSystem source supplies an operator-built asset_path directory instead.
Metrics
-
metrics.enabled - Expose Prometheus metrics. Default true.
Deployment
-
deploy.enabled - Default false in typed config. Enables runtime deployment APIs. The shipped first-run file sets true explicitly.
-
deploy.max_archive_bytes - Positive upload ceiling when deployment is enabled. Merged default 67108864 bytes. The starter file chooses 16777216.
-
deploy.max_inflated_bytes - Positive archive inflation ceiling, at least the upload ceiling. Merged default 268435456 bytes. The starter file chooses 67108864.
Authoring
-
authoring.gleam_path - Optional external Gleam executable. Enables server-side Gleam compilation and requires project_root.
-
authoring.project_root - Required when gleam_path is set. A provisioned, built Gleam workflow project with its descriptor and schemas.
-
authoring.workspace_dir - AWL source workspace. Merged default is the authoring directory under Aion home.
Development
-
dev.enabled - Default false. Enables development run, mock and replay endpoints.
Assistant harness accounts
-
assistant.harness.name - Required catalogue harness id for these account declarations. Unknown and duplicate ids are refused.
-
assistant.harness.account - Optional named accounts for this harness. Absence leaves the harness offered with no declared accounts.
Assistant account environment
-
assistant.harness.account.name - Required nonempty account name, unique within the harness.
-
assistant.harness.account.env - Child variable name to server variable name. Values are read at spawn. Invalid or credential-shaped child names and missing source values are refused.
Read configuration discovery and the starter file. With Lys, omit the namespace-claim setting: the pass grants namespaces. Supply all required Lys connector and draft-runner fields. Without Lys, enabled JWT auth requires the namespace claim and JWKS settings.