References

Outpost Configuration

Global configurations are provided through env variables or a YAML file. ConfigMap can be used if deploying with Kubernetes.

Environment Variables

VariableDescriptionDefaultRequired
AES_ENCRYPTION_SECRETA 16, 24, or 32 byte secret key used for AES encryption of sensitive data at rest.nilYes
ALERT_AUTO_DISABLE_DESTINATIONIf true, automatically disables a destination after 'consecutive_failure_count' is reached.trueNo
ALERT_CALLBACK_URLURL to which Outpost will send a POST request when an alert is triggered (e.g., for destination failures).nilNo
ALERT_CONSECUTIVE_FAILURE_COUNTNumber of consecutive delivery failures for a destination before triggering an alert and potentially disabling it.20No
API_JWT_SECRETSecret key for signing and verifying JWTs if JWT authentication is used for the API.nilYes
API_KEYAPI key for authenticating requests to the Outpost API.nilYes
API_PORTPort number for the API server to listen on.3333No
AUDIT_LOGEnables or disables audit logging for significant events.trueNo
AWS_SQS_ACCESS_KEY_IDAWS Access Key ID for SQS. Required if AWS SQS is the chosen MQ provider.nilConditional (see description)
AWS_SQS_DELIVERY_QUEUEName of the SQS queue for delivery events.outpost-deliveryNo
AWS_SQS_ENDPOINTCustom AWS SQS endpoint URL. Optional, typically used for local testing (e.g., LocalStack).nilNo
AWS_SQS_LOG_QUEUEName of the SQS queue for log events.outpost-logNo
AWS_SQS_REGIONAWS Region for SQS. Required if AWS SQS is the chosen MQ provider.nilConditional (see description)
AWS_SQS_SECRET_ACCESS_KEYAWS Secret Access Key for SQS. Required if AWS SQS is the chosen MQ provider.nilConditional (see description)
CLICKHOUSE_ADDRAddress (host) of the ClickHouse server. Example: 'localhost:9000'. Required if ClickHouse is used for log storage.nilConditional (see description)
CLICKHOUSE_DATABASEDatabase name in ClickHouse to use.outpostNo
CLICKHOUSE_PASSWORDPassword for ClickHouse authentication.nilNo
CLICKHOUSE_USERNAMEUsername for ClickHouse authentication.nilNo
DELIVERY_MAX_CONCURRENCYMaximum number of delivery attempts to process concurrently.1No
DELIVERY_TIMEOUT_SECONDSTimeout in seconds for HTTP requests made during event delivery to webhook destinations.5No
DESTINATIONS_AWS_KINESIS_METADATA_IN_PAYLOADIf true, includes Outpost metadata (event ID, topic, etc.) within the Kinesis record payload.trueNo
DESTINATIONS_METADATA_PATHPath to the directory containing custom destination type definitions. This can be overridden by the root-level 'destination_metadata_path' if also set.config/outpost/destinationsNo
DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_EVENT_ID_HEADERIf true, disables adding the default 'X-Outpost-Event-Id' header to webhook requests.falseNo
DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_SIGNATURE_HEADERIf true, disables adding the default 'X-Outpost-Signature' header to webhook requests.falseNo
DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_TIMESTAMP_HEADERIf true, disables adding the default 'X-Outpost-Timestamp' header to webhook requests.falseNo
DESTINATIONS_WEBHOOK_DISABLE_DEFAULT_TOPIC_HEADERIf true, disables adding the default 'X-Outpost-Topic' header to webhook requests.falseNo
DESTINATIONS_WEBHOOK_HEADER_PREFIXPrefix for custom headers added to webhook requests (e.g., 'X-MyOrg-').x-outpost-No
DESTINATIONS_WEBHOOK_SIGNATURE_ALGORITHMAlgorithm used for signing webhook requests (e.g., 'hmac-sha256').hmac-sha256No
DESTINATIONS_WEBHOOK_SIGNATURE_CONTENT_TEMPLATEGo template for constructing the content to be signed for webhook requests.{{.Timestamp.Unix}}.{{.Body}}No
DESTINATIONS_WEBHOOK_SIGNATURE_ENCODINGEncoding for the signature (e.g., 'hex', 'base64').hexNo
DESTINATIONS_WEBHOOK_SIGNATURE_HEADER_TEMPLATEGo template for the value of the signature header.t={{.Timestamp.Unix}},v0={{.Signatures | join ","}}No
DESTINATION_METADATA_PATHPath to the directory containing custom destination type definitions. Overrides 'destinations.metadata_path' if set.nilNo
DISABLE_TELEMETRYGlobal flag to disable all telemetry (anonymous usage statistics to Hookdeck and error reporting to Sentry). If true, overrides 'telemetry.disabled'.falseNo
GCP_PUBSUB_DELIVERY_SUBSCRIPTIONName of the GCP Pub/Sub subscription for delivery events.outpost-delivery-subNo
GCP_PUBSUB_DELIVERY_TOPICName of the GCP Pub/Sub topic for delivery events.outpost-deliveryNo
GCP_PUBSUB_LOG_SUBSCRIPTIONName of the GCP Pub/Sub subscription for log events.outpost-log-subNo
GCP_PUBSUB_LOG_TOPICName of the GCP Pub/Sub topic for log events.outpost-logNo
GCP_PUBSUB_PROJECTGCP Project ID for Pub/Sub. Required if GCP Pub/Sub is the chosen MQ provider.nilConditional (see description)
GCP_PUBSUB_SERVICE_ACCOUNT_CREDENTIALSJSON string or path to a file containing GCP service account credentials for Pub/Sub. Required if GCP Pub/Sub is the chosen MQ provider and not running in an environment with implicit credentials (e.g., GCE, GKE).nilConditional (see description)
GIN_MODESets the Gin framework mode (e.g., 'debug', 'release', 'test'). See Gin documentation for details.releaseNo
HTTP_USER_AGENTCustom HTTP User-Agent string for outgoing webhook deliveries. If unset, a default (OrganizationName/Version) is used.nilNo
LOG_BATCH_SIZEMaximum number of log entries to batch together before writing to storage.1000No
LOG_BATCH_THRESHOLD_SECONDSMaximum time in seconds to buffer logs before flushing them to storage, if batch size is not reached.10No
LOG_LEVELDefines the verbosity of application logs. Common values: 'trace', 'debug', 'info', 'warn', 'error'.infoNo
LOG_MAX_CONCURRENCYMaximum number of log writing operations to process concurrently.1No
MAX_DESTINATIONS_PER_TENANTMaximum number of destinations allowed per tenant/organization.20No
MAX_RETRY_LIMITMaximum number of retry attempts for a single event delivery before giving up.10No
ORGANIZATION_NAMEName of the organization, used for display purposes and potentially in user agent strings.nilNo
OTEL_EXPORTERSpecifies the OTLP exporter to use for this telemetry type (e.g., 'otlp'). Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_ENDPOINT.nilConditional (see description)
OTEL_PROTOCOLSpecifies the OTLP protocol ('grpc' or 'http') for this telemetry type. Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_PROTOCOL.nilConditional (see description)
OTEL_SERVICE_NAMEThe service name reported to OpenTelemetry. If set, OpenTelemetry will be enabled.nilNo
PORTAL_BRAND_COLORPrimary brand color (hex code) for theming the Outpost Portal (e.g., '#6122E7'). Also referred to as Accent Color in some contexts.nilNo
PORTAL_DISABLE_OUTPOST_BRANDINGIf true, disables Outpost branding in the portal.falseNo
PORTAL_FAVICON_URLURL for the favicon to be used in the Outpost Portal.nilNo
PORTAL_FORCE_THEMEForce a specific theme for the Outpost Portal (e.g., 'light', 'dark').nilNo
PORTAL_LOGOURL for the light-mode logo to be displayed in the Outpost Portal.nilNo
PORTAL_LOGO_DARKURL for the dark-mode logo to be displayed in the Outpost Portal.nilNo
PORTAL_ORGANIZATION_NAMEOrganization name displayed in the Outpost Portal.nilNo
PORTAL_PROXY_URLURL to proxy the Outpost Portal through. If set, Outpost serves the portal assets, and this URL is used as the base. Must be a valid URL.nilNo
PORTAL_REFERER_URLThe expected Referer URL for accessing the portal. This is a security measure. Required if the Outpost Portal is enabled/used. Example: 'https://admin.example.com'.nilConditional (see description)
POSTGRES_URLConnection URL for PostgreSQL, used as an alternative log storage. Example: 'postgres://user@host/dbname?sslmode=disable'. Required if ClickHouse is not configured and log storage is needed.nilConditional (see description)
PUBLISH_AWS_SQS_ACCESS_KEY_IDAWS Access Key ID for the SQS publish queue. Required if AWS SQS is the chosen publish MQ provider.nilConditional (see description)
PUBLISH_AWS_SQS_ENDPOINTCustom AWS SQS endpoint URL for the publish queue. Optional.nilNo
PUBLISH_AWS_SQS_QUEUEName of the SQS queue for publishing events. Required if AWS SQS is the chosen publish MQ provider.nilConditional (see description)
PUBLISH_AWS_SQS_REGIONAWS Region for the SQS publish queue. Required if AWS SQS is the chosen publish MQ provider.nilConditional (see description)
PUBLISH_AWS_SQS_SECRET_ACCESS_KEYAWS Secret Access Key for the SQS publish queue. Required if AWS SQS is the chosen publish MQ provider.nilConditional (see description)
PUBLISH_GCP_PUBSUB_PROJECTGCP Project ID for the Pub/Sub publish topic. Required if GCP Pub/Sub is the chosen publish MQ provider.nilConditional (see description)
PUBLISH_GCP_PUBSUB_SERVICE_ACCOUNT_CREDENTIALSJSON string or path to a file containing GCP service account credentials for the Pub/Sub publish topic. Required if GCP Pub/Sub is chosen and not using implicit credentials.nilConditional (see description)
PUBLISH_GCP_PUBSUB_SUBSCRIPTIONName of the GCP Pub/Sub subscription to read published events from. Required if GCP Pub/Sub is the chosen publish MQ provider.nilConditional (see description)
PUBLISH_GCP_PUBSUB_TOPICName of the GCP Pub/Sub topic for publishing events. Required if GCP Pub/Sub is the chosen publish MQ provider.nilConditional (see description)
PUBLISH_MAX_CONCURRENCYMaximum number of messages to process concurrently from the publish queue.1No
PUBLISH_RABBITMQ_EXCHANGEName of the RabbitMQ exchange for the publish queue.nilNo
PUBLISH_RABBITMQ_QUEUEName of the RabbitMQ queue for publishing events. Required if RabbitMQ is the chosen publish MQ provider.nilConditional (see description)
PUBLISH_RABBITMQ_SERVER_URLRabbitMQ server connection URL for the publish queue. Required if RabbitMQ is the chosen publish MQ provider.nilConditional (see description)
RABBITMQ_DELIVERY_QUEUEName of the RabbitMQ queue for delivery events.outpost-deliveryNo
RABBITMQ_EXCHANGEName of the RabbitMQ exchange to use.outpostNo
RABBITMQ_LOG_QUEUEName of the RabbitMQ queue for log events.outpost-logNo
RABBITMQ_SERVER_URLRabbitMQ server connection URL (e.g., 'amqp://user@host/vhost'). Required if RabbitMQ is the chosen MQ provider.nilConditional (see description)
REDIS_DATABASERedis database number to select after connecting.0Yes
REDIS_HOSTHostname or IP address of the Redis server.127.0.0.1Yes
REDIS_PASSWORDPassword for Redis authentication, if required by the server.nilYes
REDIS_PORTPort number for the Redis server.6379Yes
RETRY_INTERVAL_SECONDSInterval in seconds between delivery retry attempts for failed webhooks.30No
SERVICESpecifies the service type to run. Valid values: 'api', 'log', 'delivery', or empty/all for singular mode (runs all services).nilNo
TELEMETRY_BATCH_INTERVALMaximum time in seconds to wait before sending a batch of telemetry events if batch size is not reached.5No
TELEMETRY_BATCH_SIZEMaximum number of telemetry events to batch before sending.100No
TELEMETRY_HOOKDECK_SOURCE_URLThe Hookdeck Source URL to send anonymous usage telemetry data to. Set to empty to disable sending to Hookdeck.https://hkdk.events/yhk665ljz3rn6lNo
TELEMETRY_SENTRY_DSNSentry DSN for error reporting. If provided and telemetry is not disabled, Sentry integration will be enabled.https://examplePublicKey@o0.ingest.sentry.io/0No
TOPICSComma-separated list of topics that this Outpost instance should subscribe to for event processing.[]No

YAML

# Outpost Configuration Example (Generated) # This example shows all available keys with their default values where applicable. # A 16, 24, or 32 byte secret key used for AES encryption of sensitive data at rest. aes_encryption_secret: "" alert: # If true, automatically disables a destination after 'consecutive_failure_count' is reached. auto_disable_destination: true # URL to which Outpost will send a POST request when an alert is triggered (e.g., for destination failures). callback_url: "" # Number of consecutive delivery failures for a destination before triggering an alert and potentially disabling it. consecutive_failure_count: 20 # Secret key for signing and verifying JWTs if JWT authentication is used for the API. api_jwt_secret: "" # API key for authenticating requests to the Outpost API. api_key: "" # Port number for the API server to listen on. api_port: 3333 # Enables or disables audit logging for significant events. audit_log: true clickhouse: # Address (host:port) of the ClickHouse server. Example: 'localhost:9000'. Required if ClickHouse is used for log storage. addr: "" # Database name in ClickHouse to use. database: "outpost" # Password for ClickHouse authentication. password: "" # Username for ClickHouse authentication. username: "" # Maximum number of delivery attempts to process concurrently. delivery_max_concurrency: 1 # Timeout in seconds for HTTP requests made during event delivery to webhook destinations. delivery_timeout_seconds: 5 # Path to the directory containing custom destination type definitions. Overrides 'destinations.metadata_path' if set. destination_metadata_path: "" destinations: # Configuration specific to AWS Kinesis destinations. aws_kinesis: # If true, includes Outpost metadata (event ID, topic, etc.) within the Kinesis record payload. metadata_in_payload: true # Path to the directory containing custom destination type definitions. This can be overridden by the root-level 'destination_metadata_path' if also set. metadata_path: "config/outpost/destinations" # Configuration specific to webhook destinations. webhook: # If true, disables adding the default 'X-Outpost-Event-Id' header to webhook requests. disable_default_event_id_header: false # If true, disables adding the default 'X-Outpost-Signature' header to webhook requests. disable_default_signature_header: false # If true, disables adding the default 'X-Outpost-Timestamp' header to webhook requests. disable_default_timestamp_header: false # If true, disables adding the default 'X-Outpost-Topic' header to webhook requests. disable_default_topic_header: false # Prefix for custom headers added to webhook requests (e.g., 'X-MyOrg-'). header_prefix: "x-outpost-" # Algorithm used for signing webhook requests (e.g., 'hmac-sha256'). signature_algorithm: "hmac-sha256" # Go template for constructing the content to be signed for webhook requests. signature_content_template: "{{.Timestamp.Unix}}.{{.Body}}" # Encoding for the signature (e.g., 'hex', 'base64'). signature_encoding: "hex" # Go template for the value of the signature header. signature_header_template: "t={{.Timestamp.Unix}},v0={{.Signatures | join \",\"}}" # Global flag to disable all telemetry (anonymous usage statistics to Hookdeck and error reporting to Sentry). If true, overrides 'telemetry.disabled'. disable_telemetry: false # Sets the Gin framework mode (e.g., 'debug', 'release', 'test'). See Gin documentation for details. gin_mode: "release" # Custom HTTP User-Agent string for outgoing webhook deliveries. If unset, a default (OrganizationName/Version) is used. http_user_agent: "" # Maximum number of log entries to batch together before writing to storage. log_batch_size: 1000 # Maximum time in seconds to buffer logs before flushing them to storage, if batch size is not reached. log_batch_threshold_seconds: 10 # Defines the verbosity of application logs. Common values: 'trace', 'debug', 'info', 'warn', 'error'. log_level: "info" # Maximum number of log writing operations to process concurrently. log_max_concurrency: 1 # Maximum number of destinations allowed per tenant/organization. max_destinations_per_tenant: 20 mqs: # Choose one of the following MQ providers: # Configuration for using AWS SQS as the message queue. Only one MQ provider (AWSSQS, GCPPubSub, RabbitMQ) should be configured. aws_sqs: # AWS Access Key ID for SQS. Required if AWS SQS is the chosen MQ provider. access_key_id: "" # Name of the SQS queue for delivery events. delivery_queue: "outpost-delivery" # Custom AWS SQS endpoint URL. Optional, typically used for local testing (e.g., LocalStack). endpoint: "" # Name of the SQS queue for log events. log_queue: "outpost-log" # AWS Region for SQS. Required if AWS SQS is the chosen MQ provider. region: "" # AWS Secret Access Key for SQS. Required if AWS SQS is the chosen MQ provider. secret_access_key: "" # Configuration for using GCP Pub/Sub as the message queue. Only one MQ provider (AWSSQS, GCPPubSub, RabbitMQ) should be configured. gcp_pubsub: # Name of the GCP Pub/Sub subscription for delivery events. delivery_subscription: "outpost-delivery-sub" # Name of the GCP Pub/Sub topic for delivery events. delivery_topic: "outpost-delivery" # Name of the GCP Pub/Sub subscription for log events. log_subscription: "outpost-log-sub" # Name of the GCP Pub/Sub topic for log events. log_topic: "outpost-log" # GCP Project ID for Pub/Sub. Required if GCP Pub/Sub is the chosen MQ provider. project: "" # JSON string or path to a file containing GCP service account credentials for Pub/Sub. Required if GCP Pub/Sub is the chosen MQ provider and not running in an environment with implicit credentials (e.g., GCE, GKE). service_account_credentials: "" # Configuration for using RabbitMQ as the message queue. Only one MQ provider (AWSSQS, GCPPubSub, RabbitMQ) should be configured. rabbitmq: # Name of the RabbitMQ queue for delivery events. delivery_queue: "outpost-delivery" # Name of the RabbitMQ exchange to use. exchange: "outpost" # Name of the RabbitMQ queue for log events. log_queue: "outpost-log" # RabbitMQ server connection URL (e.g., 'amqp://user:pass@host:port/vhost'). Required if RabbitMQ is the chosen MQ provider. server_url: "" # Name of the organization, used for display purposes and potentially in user agent strings. organization_name: "" otel: # OpenTelemetry configuration specific to logs. logs: # Specifies the OTLP exporter to use for this telemetry type (e.g., 'otlp'). Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. exporter: "" # Specifies the OTLP protocol ('grpc' or 'http') for this telemetry type. Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_PROTOCOL. protocol: "" # OpenTelemetry configuration specific to metrics. metrics: # Specifies the OTLP exporter to use for this telemetry type (e.g., 'otlp'). Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. exporter: "" # Specifies the OTLP protocol ('grpc' or 'http') for this telemetry type. Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_PROTOCOL. protocol: "" # The service name reported to OpenTelemetry. If set, OpenTelemetry will be enabled. service_name: "" # OpenTelemetry configuration specific to traces. traces: # Specifies the OTLP exporter to use for this telemetry type (e.g., 'otlp'). Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. exporter: "" # Specifies the OTLP protocol ('grpc' or 'http') for this telemetry type. Typically used with environment variables like OTEL_EXPORTER_OTLP_TRACES_PROTOCOL. protocol: "" portal: # Primary brand color (hex code) for theming the Outpost Portal (e.g., '#6122E7'). Also referred to as Accent Color in some contexts. brand_color: "" # If true, disables Outpost branding in the portal. disable_outpost_branding: false # URL for the favicon to be used in the Outpost Portal. favicon_url: "" # Force a specific theme for the Outpost Portal (e.g., 'light', 'dark'). force_theme: "" # URL for the light-mode logo to be displayed in the Outpost Portal. logo: "" # URL for the dark-mode logo to be displayed in the Outpost Portal. logo_dark: "" # Organization name displayed in the Outpost Portal. org_name: "" # URL to proxy the Outpost Portal through. If set, Outpost serves the portal assets, and this URL is used as the base. Must be a valid URL. proxy_url: "" # The expected Referer URL for accessing the portal. This is a security measure. Required if the Outpost Portal is enabled/used. Example: 'https://admin.example.com'. referer_url: "" # Connection URL for PostgreSQL, used as an alternative log storage. Example: 'postgres://user:pass@host:port/dbname?sslmode=disable'. Required if ClickHouse is not configured and log storage is needed. postgres: "" # Maximum number of messages to process concurrently from the publish queue. publish_max_concurrency: 1 publishmq: # Choose one of the following MQ providers: # Configuration for using AWS SQS as the publish message queue. Only one publish MQ provider should be configured. aws_sqs: # AWS Access Key ID for the SQS publish queue. Required if AWS SQS is the chosen publish MQ provider. access_key_id: "" # Custom AWS SQS endpoint URL for the publish queue. Optional. endpoint: "" # Name of the SQS queue for publishing events. Required if AWS SQS is the chosen publish MQ provider. queue: "" # AWS Region for the SQS publish queue. Required if AWS SQS is the chosen publish MQ provider. region: "" # AWS Secret Access Key for the SQS publish queue. Required if AWS SQS is the chosen publish MQ provider. secret_access_key: "" # Configuration for using GCP Pub/Sub as the publish message queue. Only one publish MQ provider should be configured. gcp_pubsub: # GCP Project ID for the Pub/Sub publish topic. Required if GCP Pub/Sub is the chosen publish MQ provider. project: "" # JSON string or path to a file containing GCP service account credentials for the Pub/Sub publish topic. Required if GCP Pub/Sub is chosen and not using implicit credentials. service_account_credentials: "" # Name of the GCP Pub/Sub subscription to read published events from. Required if GCP Pub/Sub is the chosen publish MQ provider. subscription: "" # Name of the GCP Pub/Sub topic for publishing events. Required if GCP Pub/Sub is the chosen publish MQ provider. topic: "" # Configuration for using RabbitMQ as the publish message queue. Only one publish MQ provider should be configured. rabbitmq: # Name of the RabbitMQ exchange for the publish queue. exchange: "" # Name of the RabbitMQ queue for publishing events. Required if RabbitMQ is the chosen publish MQ provider. queue: "" # RabbitMQ server connection URL for the publish queue. Required if RabbitMQ is the chosen publish MQ provider. server_url: "" redis: # Redis database number to select after connecting. database: 0 # Hostname or IP address of the Redis server. host: "127.0.0.1" # Password for Redis authentication, if required by the server. password: "" # Port number for the Redis server. port: 6379 # Interval in seconds between delivery retry attempts for failed webhooks. retry_interval_seconds: 30 # Maximum number of retry attempts for a single event delivery before giving up. retry_max_limit: 10 # Specifies the service type to run. Valid values: 'api', 'log', 'delivery', or empty/all for singular mode (runs all services). service: "" telemetry: # Maximum time in seconds to wait before sending a batch of telemetry events if batch size is not reached. batch_interval: 5 # Maximum number of telemetry events to batch before sending. batch_size: 100 # Disables telemetry within the 'telemetry' block (Hookdeck usage stats and Sentry). Can be overridden by the global 'disable_telemetry' flag at the root of the configuration. disabled: false # The Hookdeck Source URL to send anonymous usage telemetry data to. Set to empty to disable sending to Hookdeck. hookdeck_source_url: "https://hkdk.events/yhk665ljz3rn6l" # Sentry DSN for error reporting. If provided and telemetry is not disabled, Sentry integration will be enabled. sentry_dsn: "https://examplePublicKey@o0.ingest.sentry.io/0" # Comma-separated list of topics that this Outpost instance should subscribe to for event processing. topics: [] # Empty list
yaml