Security
Security and encryption configuration variables.
Agent Authentication
Section titled “Agent Authentication”AGENT_SECRET
Section titled “AGENT_SECRET”- Name:
CROW_AGENT_SECRET - Description: Server-agent shared password.
- Default: none
GRPC_SECRET
Section titled “GRPC_SECRET”- Name:
CROW_GRPC_SECRET - Description: gRPC JWT secret.
- Default:
secret
Encryption
Section titled “Encryption”ENCRYPTION_TINK_KEYSET_FILE
Section titled “ENCRYPTION_TINK_KEYSET_FILE”- Name:
CROW_ENCRYPTION_TINK_KEYSET_FILE - Description: Path to a Google Tink AEAD keyset file for encrypting secrets, registry passwords, OAuth tokens, and forge client secrets at rest. Supports key rotation. See Encryption for setup instructions.
- Default: none
ENCRYPTION_DISABLE_FLAG
Section titled “ENCRYPTION_DISABLE_FLAG”- Name:
CROW_ENCRYPTION_DISABLE - Description: When set to
true, decrypts all encrypted data (secrets, registry passwords, OAuth tokens, forge client secrets) and disables encryption. Use only for migration or development purposes. - Default:
false
Docker Configuration
Section titled “Docker Configuration”DOCKER_CONFIG
Section titled “DOCKER_CONFIG”- Name:
CROW_DOCKER_CONFIG - Description: Docker configuration.
- Default: none