Environment Variables
An environment variable is a named value the operating system hands to a program when it starts. Bridge uses them to receive settings - especially secrets and per-deployment values - without writing them into the config file.
Environment variables have the highest precedence: when a setting can be supplied both in the YAML file and as an environment variable, the environment variable wins. (See Configuration overview for how the layers stack up.)
Most environment variables mirror a YAML setting. A few are environment-only and have no YAML equivalent - these are called out below.
Deployment & cluster
These control which role a Bridge process plays and how the pieces of a cluster find each other.
| Variable | Config equivalent | Description |
|---|---|---|
BRIDGE_ROLE | cluster.role | The role this process runs as: single, session, proxy, or orchestrator. |
BRIDGE_CONFIG | (none - selects the config file) | Full path to the YAML config file. Defaults to /etc/britive-bridge/config.yaml. |
BRIDGE_CLUSTER_TOKEN | (environment-only) | Shared secret that members of a cluster use to trust each other. Used only in clustered deployments. |
BRIDGE_WORKER_ID | (environment-only) | Identifier for a session worker. |
BRIDGE_WORKER_ADDR | (environment-only) | Network address a session worker advertises to the rest of the cluster. |
BRIDGE_CLUSTER_ADDR | (environment-only) | Address used for cluster coordination. |
BRIDGE_INSTANCE_ID | (environment-only) | Unique identifier for this running instance. |
BRIDGE_NAMESPACE | (environment-only) | Kubernetes namespace, used by the Kubernetes worker provisioner. |
Datastore
These configure the mandatory PostgreSQL connection and mirror the server.datastore.* settings.
| Variable | Config equivalent | Description |
|---|---|---|
BRIDGE_DATASTORE_HOST | server.datastore.host | PostgreSQL hostname or IP. |
BRIDGE_DATASTORE_PORT | server.datastore.port | PostgreSQL port. |
BRIDGE_DATASTORE_USER | server.datastore.user | Database username. |
BRIDGE_DATASTORE_PASSWORD | server.datastore.password | Database password. |
BRIDGE_DATASTORE_NAME | server.datastore.name | Database name. |
BRIDGE_DATASTORE_SSLMODE | server.datastore.sslmode | Connection security: disable, require, verify-ca, or verify-full. |
Security & secrets
| Variable | Config equivalent | Description |
|---|---|---|
BRIDGE_ENCRYPTION_KEY_B64 | (environment-only) | The key that encrypts checkout credentials at rest. Required with PostgreSQL. See below. |
BRIDGE_TLS_ENABLED | server.tls.enabled | Whether Bridge serves HTTPS directly. Set to false when a load balancer terminates TLS for you. |
BRIDGE_HOST_KEY_SEED | ssh.native.host_key_seed | A seed that makes the SSH host key deterministic, so every replica presents the same SSH fingerprint to clients. |
BRIDGE_ENCRYPTION_KEY_B64 is required when using PostgreSQL (which is every deployment). It is a 32-byte key, base64-encoded (a text-friendly way of writing binary data). Bridge uses it to encrypt the credentials held for each checkout before they are written to the database, so that anyone with database access alone cannot read them.
This key is environment-only - there is no YAML setting for it - and it must stay constant. Changing it makes existing encrypted data unreadable. See Operations → rotating secrets for the implications.
You can generate a suitable key like this:
# Generate a random 32-byte key, base64-encoded
openssl rand -base64 32Authentication
| Variable | Config equivalent | Description |
|---|---|---|
BRITIVE_TENANT | server.auth.britive.tenant | Your Britive tenant (subdomain or full URL). |
BRIDGE_LDAP_BIND_PASSWORD | server.auth.ldap.bind_password | Password for the LDAP bind (service) account. Supplying it here keeps it out of the config file. |
Licensing
| Variable | Config equivalent | Description |
|---|---|---|
BRITIVE_BROKER_AUTH_TOKEN | (enables platform retrieval) | When set, Bridge automatically fetches and renews the license from the platform on a daily heartbeat (takes precedence over the options below). Also the broker-pool token. See Licensing. |
BRIDGE_LICENSE | server.license.key | The license blob, provided inline. Highest precedence among the directly-provided sources. |
BRIDGE_LICENSE_PATH | server.license.path | Path to a file containing the license blob. |