References
Outpost Configuration
Global configurations are provided through env variables or a YAML file. ConfigMap can be used if deploying with Kubernetes.
Environment Variables
Variable | Description | Default | Required |
---|---|---|---|
AES_ENCRYPTION_SECRET | A 16, 24, or 32 byte secret key used for AES encryption of sensitive data at rest. | nil | Yes |
ALERT_AUTO_DISABLE_DESTINATION | If true, automatically disables a destination after 'consecutive_failure_count' is reached. | true | No |
ALERT_CALLBACK_URL | URL to which Outpost will send a POST request when an alert is triggered (e.g., for destination failures). | nil | No |
ALERT_CONSECUTIVE_FAILURE_COUNT | Number of consecutive delivery failures for a destination before triggering an alert and potentially disabling it. | 20 | No |
API_JWT_SECRET | Secret key for signing and verifying JWTs if JWT authentication is used for the API. | nil | Yes |
API_KEY | API key for authenticating requests to the Outpost API. | nil | Yes |
API_PORT | Port number for the API server to listen on. | 3333 | No |
AUDIT_LOG | Enables or disables audit logging for significant events. | true | No |
AWS_SQS_ACCESS_KEY_ID | AWS Access Key ID for SQS. Required if AWS SQS is the chosen MQ provider. | nil | Conditional (see description) |
AWS_SQS_DELIVERY_QUEUE | Name of the SQS queue for delivery events. | outpost-delivery | No |
AWS_SQS_ENDPOINT | Custom AWS SQS endpoint URL. Optional, typically used for local testing (e.g., LocalStack). | nil | No |
AWS_SQS_LOG_QUEUE | Name of the SQS queue for log events. | outpost-log | No |
AWS_SQS_REGION | AWS Region for SQS. Required if AWS SQS is the chosen MQ provider. | nil | Conditional (see description) |
AWS_SQS_SECRET_ACCESS_KEY | AWS Secret Access Key for SQS. Required if AWS SQS is the chosen MQ provider. | nil | Conditional (see description) |
CLICKHOUSE_ADDR | Address (host | nil | Conditional (see description) |
CLICKHOUSE_DATABASE | Database name in ClickHouse to use. | outpost | No |
CLICKHOUSE_PASSWORD | Password for ClickHouse authentication. | nil | No |
CLICKHOUSE_USERNAME | Username for ClickHouse authentication. | nil | No |
DELIVERY_MAX_CONCURRENCY | Maximum number of delivery attempts to process concurrently. | 1 | No |
DELIVERY_TIMEOUT_SECONDS | Timeout in seconds for HTTP requests made during event delivery to webhook destinations. | 5 | No |
DESTINATIONS_AWS_KINESIS_METADATA_IN_PAYLOAD | If true, includes Outpost metadata (event ID, topic, etc.) within the Kinesis record payload. | true | No |
DESTINATIONS_METADATA_PATH | Path to the directory containing custom destination type definitions. This can be overridden by the root-level 'destination_metadata_path' if also set. | config/outpost/destinations | No |
DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_EVENT_ID_HEADER | If true, disables adding the default 'X-Outpost-Event-Id' header to webhook requests. | false | No |
DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_SIGNATURE_HEADER | If true, disables adding the default 'X-Outpost-Signature' header to webhook requests. | false | No |
DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_TIMESTAMP_HEADER | If true, disables adding the default 'X-Outpost-Timestamp' header to webhook requests. | false | No |
DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_TOPIC_HEADER | If true, disables adding the default 'X-Outpost-Topic' header to webhook requests. | false | No |
DESTINATIONS_WEBHOOK_HEADER_PREFIX | Prefix for custom headers added to webhook requests (e.g., 'X-MyOrg-'). | x-outpost- | No |
DESTINATIONS_WEBHOOK_SIGNATURE_ALGORITHM | Algorithm used for signing webhook requests (e.g., 'hmac-sha256'). | hmac-sha256 | No |
DESTINATIONS_WEBHOOK_SIGNATURE_CONTENT_TEMPLATE | Go template for constructing the content to be signed for webhook requests. | {{.Timestamp.Unix}}.{{.Body}} | No |
DESTINATIONS_WEBHOOK_SIGNATURE_ENCODING | Encoding for the signature (e.g., 'hex', 'base64'). | hex | No |
DESTINATIONS_WEBHOOK_SIGNATURE_HEADER_TEMPLATE | Go template for the value of the signature header. | t={{.Timestamp.Unix}},v0={{.Signatures | join ","}} | No |
DESTINATION_METADATA_PATH | Path to the directory containing custom destination type definitions. Overrides 'destinations.metadata_path' if set. | nil | No |
DISABLE_TELEMETRY | Global flag to disable all telemetry (anonymous usage statistics to Hookdeck and error reporting to Sentry). If true, overrides 'telemetry.disabled'. | false | No |
GCP_PUBSUB_DELIVERY_SUBSCRIPTION | Name of the GCP Pub/Sub subscription for delivery events. | outpost-delivery-sub | No |
GCP_PUBSUB_DELIVERY_TOPIC | Name of the GCP Pub/Sub topic for delivery events. | outpost-delivery | No |
GCP_PUBSUB_LOG_SUBSCRIPTION | Name of the GCP Pub/Sub subscription for log events. | outpost-log-sub | No |
GCP_PUBSUB_LOG_TOPIC | Name of the GCP Pub/Sub topic for log events. | outpost-log | No |
GCP_PUBSUB_PROJECT | GCP Project ID for Pub/Sub. Required if GCP Pub/Sub is the chosen MQ provider. | nil | Conditional (see description) |
GCP_PUBSUB_SERVICE_ACCOUNT_CREDENTIALS | JSON string or path to a file containing GCP service account credentials for Pub/Sub. Required if GCP Pub/Sub is the chosen MQ provider and not running in an environment with implicit credentials (e.g., GCE, GKE). | nil | Conditional (see description) |
GIN_MODE | Sets the Gin framework mode (e.g., 'debug', 'release', 'test'). See Gin documentation for details. | release | No |
HTTP_USER_AGENT | Custom HTTP User-Agent string for outgoing webhook deliveries. If unset, a default (OrganizationName/Version) is used. | nil | No |
LOG_BATCH_SIZE | Maximum number of log entries to batch together before writing to storage. | 1000 | No |
LOG_BATCH_THRESHOLD_SECONDS | Maximum time in seconds to buffer logs before flushing them to storage, if batch size is not reached. | 10 | No |
LOG_LEVEL | Defines the verbosity of application logs. Common values: 'trace', 'debug', 'info', 'warn', 'error'. | info | No |
LOG_MAX_CONCURRENCY | Maximum number of log writing operations to process concurrently. | 1 | No |
MAX_DESTINATIONS_PER_TENANT | Maximum number of destinations allowed per tenant/organization. | 20 | No |
MAX_RETRY_LIMIT | Maximum number of retry attempts for a single event delivery before giving up. | 10 | No |
ORGANIZATION_NAME | Name of the organization, used for display purposes and potentially in user agent strings. | nil | No |
OTEL_EXPORTER | Specifies the OTLP exporter to use for this telemetry type (e.g., 'otlp'). Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. | nil | Conditional (see description) |
OTEL_PROTOCOL | Specifies the OTLP protocol ('grpc' or 'http') for this telemetry type. Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_PROTOCOL. | nil | Conditional (see description) |
OTEL_SERVICE_NAME | The service name reported to OpenTelemetry. If set, OpenTelemetry will be enabled. | nil | No |
PORTAL_BRAND_COLOR | Primary brand color (hex code) for theming the Outpost Portal (e.g., '#6122E7'). Also referred to as Accent Color in some contexts. | nil | No |
PORTAL_DISABLE_OUTPOST_BRANDING | If true, disables Outpost branding in the portal. | false | No |
PORTAL_FAVICON_URL | URL for the favicon to be used in the Outpost Portal. | nil | No |
PORTAL_FORCE_THEME | Force a specific theme for the Outpost Portal (e.g., 'light', 'dark'). | nil | No |
PORTAL_LOGO | URL for the light-mode logo to be displayed in the Outpost Portal. | nil | No |
PORTAL_LOGO_DARK | URL for the dark-mode logo to be displayed in the Outpost Portal. | nil | No |
PORTAL_ORGANIZATION_NAME | Organization name displayed in the Outpost Portal. | nil | No |
PORTAL_PROXY_URL | URL to proxy the Outpost Portal through. If set, Outpost serves the portal assets, and this URL is used as the base. Must be a valid URL. | nil | No |
PORTAL_REFERER_URL | The expected Referer URL for accessing the portal. This is a security measure. Required if the Outpost Portal is enabled/used. Example: 'https://admin.example.com'. | nil | Conditional (see description) |
POSTGRES_URL | Connection URL for PostgreSQL, used as an alternative log storage. Example: 'postgres://user | nil | Conditional (see description) |
PUBLISH_AWS_SQS_ACCESS_KEY_ID | AWS Access Key ID for the SQS publish queue. Required if AWS SQS is the chosen publish MQ provider. | nil | Conditional (see description) |
PUBLISH_AWS_SQS_ENDPOINT | Custom AWS SQS endpoint URL for the publish queue. Optional. | nil | No |
PUBLISH_AWS_SQS_QUEUE | Name of the SQS queue for publishing events. Required if AWS SQS is the chosen publish MQ provider. | nil | Conditional (see description) |
PUBLISH_AWS_SQS_REGION | AWS Region for the SQS publish queue. Required if AWS SQS is the chosen publish MQ provider. | nil | Conditional (see description) |
PUBLISH_AWS_SQS_SECRET_ACCESS_KEY | AWS Secret Access Key for the SQS publish queue. Required if AWS SQS is the chosen publish MQ provider. | nil | Conditional (see description) |
PUBLISH_GCP_PUBSUB_PROJECT | GCP Project ID for the Pub/Sub publish topic. Required if GCP Pub/Sub is the chosen publish MQ provider. | nil | Conditional (see description) |
PUBLISH_GCP_PUBSUB_SERVICE_ACCOUNT_CREDENTIALS | JSON string or path to a file containing GCP service account credentials for the Pub/Sub publish topic. Required if GCP Pub/Sub is chosen and not using implicit credentials. | nil | Conditional (see description) |
PUBLISH_GCP_PUBSUB_SUBSCRIPTION | Name of the GCP Pub/Sub subscription to read published events from. Required if GCP Pub/Sub is the chosen publish MQ provider. | nil | Conditional (see description) |
PUBLISH_GCP_PUBSUB_TOPIC | Name of the GCP Pub/Sub topic for publishing events. Required if GCP Pub/Sub is the chosen publish MQ provider. | nil | Conditional (see description) |
PUBLISH_MAX_CONCURRENCY | Maximum number of messages to process concurrently from the publish queue. | 1 | No |
PUBLISH_RABBITMQ_EXCHANGE | Name of the RabbitMQ exchange for the publish queue. | nil | No |
PUBLISH_RABBITMQ_QUEUE | Name of the RabbitMQ queue for publishing events. Required if RabbitMQ is the chosen publish MQ provider. | nil | Conditional (see description) |
PUBLISH_RABBITMQ_SERVER_URL | RabbitMQ server connection URL for the publish queue. Required if RabbitMQ is the chosen publish MQ provider. | nil | Conditional (see description) |
RABBITMQ_DELIVERY_QUEUE | Name of the RabbitMQ queue for delivery events. | outpost-delivery | No |
RABBITMQ_EXCHANGE | Name of the RabbitMQ exchange to use. | outpost | No |
RABBITMQ_LOG_QUEUE | Name of the RabbitMQ queue for log events. | outpost-log | No |
RABBITMQ_SERVER_URL | RabbitMQ server connection URL (e.g., 'amqp://user | nil | Conditional (see description) |
REDIS_DATABASE | Redis database number to select after connecting. | 0 | Yes |
REDIS_HOST | Hostname or IP address of the Redis server. | 127.0.0.1 | Yes |
REDIS_PASSWORD | Password for Redis authentication, if required by the server. | nil | Yes |
REDIS_PORT | Port number for the Redis server. | 6379 | Yes |
RETRY_INTERVAL_SECONDS | Interval in seconds between delivery retry attempts for failed webhooks. | 30 | No |
SERVICE | Specifies the service type to run. Valid values: 'api', 'log', 'delivery', or empty/all for singular mode (runs all services). | nil | No |
TELEMETRY_BATCH_INTERVAL | Maximum time in seconds to wait before sending a batch of telemetry events if batch size is not reached. | 5 | No |
TELEMETRY_BATCH_SIZE | Maximum number of telemetry events to batch before sending. | 100 | No |
TELEMETRY_HOOKDECK_SOURCE_URL | The Hookdeck Source URL to send anonymous usage telemetry data to. Set to empty to disable sending to Hookdeck. | https://hkdk.events/yhk665ljz3rn6l | No |
TELEMETRY_SENTRY_DSN | Sentry DSN for error reporting. If provided and telemetry is not disabled, Sentry integration will be enabled. | https://examplePublicKey@o0.ingest.sentry.io/0 | No |
TOPICS | Comma-separated list of topics that this Outpost instance should subscribe to for event processing. | [] | No |
YAML
yaml