Configuration
Flags, environment variables, and the policy file. There is no `cirvix.toml` — configuration is deliberately a short list rather than a format to learn.
Three things configure Cirvix: command-line flags, environment variables, and the rule set itself. Flags win over environment variables. There is no configuration file format beyond the policy file — a container has to be configurable without a rebuild, and a config file baked into an image is one someone will forget to rotate.
The policy file
cirvix.policy.json is an ordered array of rules, or { rules: [...] }. It is the same file wherever it is read — the CLI, CI, the gateway, and both SDKs evaluate it identically. See the policy schema.
$ cirvix check --policy cirvix.policy.json --action fs.read --resource .env$ cirvix gateway --policy cirvix.policy.json --servers ~/.cursor/mcp.jsonEndpoint environment variables
| Variable | Used by | Meaning |
|---|---|---|
CIRVIX_API_URL | gateway, daemon, why, replay | Control-plane base URL. Same as --api |
CIRVIX_API_KEY | gateway, daemon, why, replay | API key, cvx_…. Same as --key |
NO_COLOR / FORCE_COLOR | all | Colour control |
Control-plane environment variables
Configuration comes from the environment only.
| Variable | Required | Default | Notes |
|---|---|---|---|
CIRVIX_JWT_SECRET | **yes** | — | ≥32 chars. The process refuses to start without it |
CIRVIX_MASTER_KEY | for secrets | — | ≥32 chars. Absent → the secret routes are not served |
CIRVIX_DATA | ./data/cirvix.db | Database path | |
PORT | 8787 | ||
CIRVIX_CORS_ORIGIN | for browsers | none | The console's exact origin. No wildcard mode |
CIRVIX_CONSOLE_URL | none | Deep links in alerts; the default SSO redirect base | |
CIRVIX_SSO_REDIRECT_URIS | for SSO | <console>/dashboard/sso/callback | Comma-separated allowlist |
CIRVIX_RATE_LIMIT | 600 | Requests/min per credential | |
CIRVIX_METRICS_TOKEN | none | Requires a bearer token on /metrics | |
CIRVIX_LEAD_TOKEN | for lead triage | none | Operator token for GET /v1/leads. Never issued to a tenant; unset → everyone is refused |
CIRVIX_ALLOW_PRIVATE_EGRESS | unset | Permits outbound requests to private ranges | |
CIRVIX_BOOTSTRAP_ORG | first boot | — | Ignored once any tenant exists |
CIRVIX_BOOTSTRAP_EMAIL | first boot | owner@example.com | |
CIRVIX_BOOTSTRAP_PASSWORD | first boot | — |
Console environment variables
| Variable | Notes |
|---|---|
NEXT_PUBLIC_CIRVIX_API | Control-plane origin. Inlined at build time **and** compiled into the CSP connect-src — a change needs a rebuild |
CIRVIX_JWT_SECRET signs everyone out, which is survivable. Losing CIRVIX_MASTER_KEY loses every stored secret permanently — values are sealed under a key derived from it, and there is deliberately no escrow. Back both up wherever you keep other root credentials, and never in the same place as the database.Fail-closed by construction
There is no fail_open setting. An empty or unparseable rule set denies everything, an unknown condition operator fails closed, and a control-plane outage leaves the last cached rule set enforcing rather than opening the door. That is not configurable, because the configuration that turns it off is the one nobody discovers until it is being used against them.