Self-host Agent Vault

Agent Vault README

How to install Agent Vault

curl --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL https://get.agent-vault.dev | sh

How to configure Agent Vault

• AGENT_VAULT_ADDRExternally-reachable base URL of the server

  Externally-reachable base URL of the server

• AGENT_VAULT_ALLOW_PRIVATE_RANGES=falseWhether proxy may dial private/reserved IP ranges

  Whether proxy may dial private/reserved IP ranges

  values: true|false

• AGENT_VAULT_ISOLATIONIsolation mode for `agent-vault vault run` (optional) host (default, cooperative — runs on the host with HTTPS_PROXY) | container (non-cooperative Docker container with iptables egress lock)

  Isolation mode for `agent-vault vault run` (optional) host (default, cooperative — runs on the host with HTTPS_PROXY) | container (non-cooperative Docker container with iptables egress lock)

• AGENT_VAULT_LOG_LEVEL=infoLog verbosity

  Log verbosity

  values: info|debug

• AGENT_VAULT_LOGS_MAX_AGE_HOURSMaximum age, in hours, of rows retained in the per-vault request log.

  Maximum age, in hours, of rows retained in the per-vault request log.

• AGENT_VAULT_LOGS_MAX_ROWS_PER_VAULTMaximum number of rows retained per vault in the request log. Set to 0 to disable the row cap.

  Maximum number of rows retained per vault in the request log. Set to 0 to disable the row cap.

• AGENT_VAULT_LOGS_RETENTION_LOCKWhether to ignore owner-UI overrides for log retention and pin to env values.

  Whether to ignore owner-UI overrides for log retention and pin to env values.

• AGENT_VAULT_MASTER_PASSWORDMaster password used to derive KEK that wraps data encryption key

  Master password used to derive KEK that wraps data encryption key

• AGENT_VAULT_MAX_REQUEST_BYTESMaximum request body bytes the MITM proxy forwards to upstreams. Requests exceeding this receive HTTP 413. Overridden by --max-request-bytes.

  Maximum request body bytes the MITM proxy forwards to upstreams. Requests exceeding this receive HTTP 413. Overridden by --max-request-bytes.

• AGENT_VAULT_MAX_RESPONSE_BYTESMaximum response body bytes the MITM proxy streams back to agents. Responses are streamed with a small buffer so unlimited is safe. When set and exceeded, the proxy returns 502 or aborts the connection. Overridden by --max-response-bytes.

  Maximum response body bytes the MITM proxy streams back to agents. Responses are streamed with a small buffer so unlimited is safe. When set and exceeded, the proxy returns 502 or aborts the connection. Overridden by --max-response-bytes.

• AGENT_VAULT_NETWORK_ALLOWLISTComma-separated CIDRs or bare IPs the proxy may dial

  Comma-separated CIDRs or bare IPs the proxy may dial

• AGENT_VAULT_NO_TELEMETRYInstaller (install.sh only — not read by the server or CLI binary). Set to any non-empty value to disable the anonymous install/upgrade beacon. Must be passed to `sh`, not `curl`: curl -fsSL https://get.agent-vault.dev | AGENT_VAULT_NO_TELEMETRY=1 sh

  Installer (install.sh only — not read by the server or CLI binary). Set to any non-empty value to disable the anonymous install/upgrade beacon. Must be passed to `sh`, not `curl`: curl -fsSL https://get.agent-vault.dev | AGENT_VAULT_NO_TELEMETRY=1 sh

• AGENT_VAULT_RATELIMITPer-tier override. TIER is one of: AUTH, PROXY, AUTHED, GLOBAL. KNOB is one of: RATE (tokens/sec), BURST, WINDOW (e.g., 5m), MAX, CONCURRENCY. Always takes precedence over UI overrides.

  Per-tier override. TIER is one of: AUTH, PROXY, AUTHED, GLOBAL. KNOB is one of: RATE (tokens/sec), BURST, WINDOW (e.g., 5m), MAX, CONCURRENCY. Always takes precedence over UI overrides.

• AGENT_VAULT_RATELIMIT_LOCKWhen true, the owner UI cannot override rate-limit settings (operator pin).

  When true, the owner UI cannot override rate-limit settings (operator pin).

• AGENT_VAULT_RATELIMIT_PROFILERate limiting (optional) — tiered limits with sensible defaults. Profile: default | strict (≈0.5×) | loose (≈2×) | off (disable all limits).

  Rate limiting (optional) — tiered limits with sensible defaults. Profile: default | strict (≈0.5×) | loose (≈2×) | off (disable all limits).

• AGENT_VAULT_RATELIMIT_PROXY_BURSTFine-grained overrides (rare): AGENT_VAULT_RATELIMIT_<TIER>_<KNOB> where TIER ∈ AUTH | PROXY | AUTHED | GLOBAL and KNOB ∈ RATE | BURST | WINDOW | MAX | CONCURRENCY. Example:

  Fine-grained overrides (rare): AGENT_VAULT_RATELIMIT_<TIER>_<KNOB> where TIER ∈ AUTH | PROXY | AUTHED | GLOBAL and KNOB ∈ RATE | BURST | WINDOW | MAX | CONCURRENCY. Example:

• AGENT_VAULT_SMTP_FROM
• AGENT_VAULT_SMTP_FROM_NAME
• AGENT_VAULT_SMTP_HOSTSMTP server hostname

  SMTP server hostname

• AGENT_VAULT_SMTP_PASSWORD
• AGENT_VAULT_SMTP_PORT
• AGENT_VAULT_SMTP_TLS_MODE
• AGENT_VAULT_SMTP_TLS_SKIP_VERIFY
• AGENT_VAULT_SMTP_USERNAME
• AGENT_VAULT_TELEMETRYTelemetry (optional) Agent Vault reports anonymous usage events (command invocations, feature usage) to PostHog. No credential values or request payloads are ever included. Set to "false" to disable. Also overridable with --telemetry=false on the CLI.

  Telemetry (optional) Agent Vault reports anonymous usage events (command invocations, feature usage) to PostHog. No credential values or request payloads are ever included. Set to "false" to disable. Also overridable with --telemetry=false on the CLI.

• AGENT_VAULT_TRUSTED_PROXIESComma-separated CIDRs of reverse proxies

  Comma-separated CIDRs of reverse proxies

• DATABASE_URLPostgreSQL connection URL for production deployments

  PostgreSQL connection URL for production deployments

• DB_CONN_MAX_LIFETIMEMaximum lifetime of a Postgres connection before it is closed and replaced. Go duration string (e.g. 5m, 1h). Only applies when DATABASE_URL is set. See connection pooling.

  Maximum lifetime of a Postgres connection before it is closed and replaced. Go duration string (e.g. 5m, 1h). Only applies when DATABASE_URL is set. See connection pooling.

• DB_MAX_IDLE_CONNSMaximum number of idle Postgres connections kept in the pool per instance. Only applies when DATABASE_URL is set. See connection pooling.

  Maximum number of idle Postgres connections kept in the pool per instance. Only applies when DATABASE_URL is set. See connection pooling.

• DB_MAX_OPEN_CONNSMaximum number of open Postgres connections per instance. Only applies when DATABASE_URL is set. See connection pooling.

  Maximum number of open Postgres connections per instance. Only applies when DATABASE_URL is set. See connection pooling.

• FLY_APP_NAMEThe Fly.io app name. Used to derive AGENT_VAULT_ADDR when unset.

  The Fly.io app name. Used to derive AGENT_VAULT_ADDR when unset.

• INFISICAL_AWS_IAM_AUTH_IDENTITY_IDAWS IAM Auth:

  AWS IAM Auth:

• INFISICAL_GCP_AUTH_IDENTITY_IDGCP IAM Auth (identity ID plus service-account key file):

  GCP IAM Auth (identity ID plus service-account key file):

• INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH
• INFISICAL_KUBERNETES_IDENTITY_IDKubernetes Auth:

  Kubernetes Auth:

• INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH
• INFISICAL_LDAP_AUTH_IDENTITY_IDLDAP Auth (all three required):

  LDAP Auth (all three required):

• INFISICAL_LDAP_AUTH_PASSWORD
• INFISICAL_LDAP_AUTH_USERNAME
• INFISICAL_UNIVERSAL_AUTH_CLIENT_IDUniversal Auth (recommended):

  Universal Auth (recommended):

• INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET
• INFISICAL_URLBase URL of Infisical instance for external credential store

  Base URL of Infisical instance for external credential store

• PORT=14321The TCP port the server listens on

  The TCP port the server listens on