install.env Reference

install.env holds every setting the installer reads. Copy install.env.example to install.env, uncomment what you need, and leave the rest alone to keep the defaults.

cp install.env.example install.env
chmod 0600 install.env

The file is sourced by both entrypoints and exported to every component script. It is git-ignored. Never commit it: it holds credentials. This page is a lookup table. For the reasoning behind a group of settings, follow the links in each section.

Identity

Set these first. Every resource name and hostname derives from them.

Variable	Default	Purpose
`SUBDOMAIN`	none, required	Environment subdomain. Hostnames become `<name>-<SUBDOMAIN>.<DNS_DOMAIN>`.
`DNS_DOMAIN`	none, required	Base domain. Required on both flavors.
`PREFIX`	unset	Terraform resource prefix. Setting it derives `CLUSTER_NAME`, `RDS_IDENTIFIER`, `S3_BUCKET`, `SQS_QUEUE_URL` and the `*_ROLE_NAME` values.
`AWS_REGION`	`us-east-1`	Region for the S3 endpoint and SQS URL.
`AWS_ACCOUNT_ID`	from `aws sts get-caller-identity`	Used to build resource ARNs.
`AWS_PROFILE`	the default profile	AWS CLI named profile.

Pre-existing Resources

Set these when your infrastructure does not follow the <PREFIX>-<suffix> naming. Each one bypasses the derived lookup.

Variable	Default	Purpose
`CONNECTORS_ADMIN_PASSWORD`	none, required in seed mode	Login for the `/connectors-admin` console. The install fails loudly if unset. Under an ESO backend it comes from your secret store instead.
`CLUSTER_NAME`	`<PREFIX>-eks`	EKS cluster to target.
`RDS_IDENTIFIER`	`<PREFIX>-rds`	RDS instance lookup key.
`DB_NAME`	`lilt_dev`	Application database.
`S3_BUCKET`	`<PREFIX>-s3`	Object storage bucket.
`SQS_QUEUE_URL`	derived from region, account and prefix	Queue for asynchronous work.
`SA_NAME`	`lilt-s3-workload`	Service account granted S3 access.
`MONGO_PASS`	`dummypass`	MongoDB `lilt` user password. Change it.
`APP_WORKLOAD_ROLE_NAME`	`<PREFIX>-app-workload`	IAM role name, matched as a substring.
`CLUSTER_AUTOSCALER_ROLE_NAME`	`<PREFIX>-cluster-autoscaler`	IAM role name for Cluster Autoscaler.
`CERT_MANAGER_ROLE_NAME`	`<PREFIX>-cert-manager-role`	IAM role name for cert-manager.
`IAM_AUTH_METHOD`	`irsa`	`irsa` or `pod_identity`. Must match how your roles are bound. See Provision AWS infrastructure with Terraform.

DNS and TLS

See Set custom domain and certificates for the hostname list and the required certificate names.

Variable	Default	Purpose
`HOSTED_ZONE_ID`	unset	Route53 zone for `DNS_DOMAIN`.
`ENABLE_DNS`	`false`	Create Route53 records. Needs `HOSTED_ZONE_ID` and Route53 write access.
`ENABLE_CERT_MANAGER`	`false`	Issue the certificate with cert-manager over Route53 DNS-01.
`TLS_CRT_FILE`	unset	Path to your PEM chain. Must not be set together with `ENABLE_CERT_MANAGER=true`.
`TLS_KEY_FILE`	unset	Path to the matching private key.
`LB_IP`	unset	On-premises only. The address MetalLB hands the ingress gateway. Required when `ENABLE_METALLB` is true.

Image Registry

A full image reference is <REGISTRY_BASE>/<REGISTRY_PATH_*>/<image>. See Install package.

Variable	Default	Purpose
`REGISTRY_BASE`	`harbor.<SUBDOMAIN>.<DNS_DOMAIN>` on EKS	The registry host to pull from.
`REGISTRY_PATH_APP`	`proxy-gcr/lilt-service-48916b30`	Path segment for most application images. Set empty for plain ECR.
`REGISTRY_PATH_GAR`	`proxy-gar-core/lilt-service-48916b30`	Path segment for core images. Set empty for plain ECR.
`REGISTRY_PATH_INFRA`	`proxy-gar-core/lilt-service-48916b30/chainguard/lilt.com`	Path segment for infrastructure base images. Set empty for plain ECR.
`CHART_BASE`	an OCI registry URL	Helm chart source. Set this to an absolute path such as `/opt/lilt/charts` to install from the charts in the tarball.
`CHART_REGISTRY_BASE`	`us-central1-docker.pkg.dev/lilt-service-48916b30`	Host and project behind the default `CHART_BASE`.
`STORAGE_CLASS`	`ebs-gp3` on EKS, `openebs-hostpath` on-premises	StorageClass every stateful component requests.
`STORAGE_CLASS_RETAIN`	`<STORAGE_CLASS>-retain`	Retaining variant.

NVCR_REGISTRY and K8S_REGISTRY default to routing through REGISTRY_BASE like every other image. Setting them explicitly to nvcr.io or registry.k8s.io makes those components pull straight from the public internet, which breaks an air-gapped install. Leave them unset unless you know you want that.

Pointing STORAGE_CLASS at a class you already have, without also setting ENABLE_CLUSTER_PREREQS=false, makes Helm take ownership of it. A later uninstall then deletes it.

Registry Seeding

Off by default. See Seed your container registry.

Variable	Default	Purpose
`ENABLE_SEED_REGISTRY`	`false`	Run `seed-registry.sh` as part of the install.
`SEED_REGISTRY_RELEASE`	unset	Extracted release directory, or an `s3://` prefix.
`SEED_REGISTRY_TARGET`	`REGISTRY_BASE`	Destination registry.
`SEED_REGISTRY_PATH`	`REGISTRY_PATH_APP`	Destination path segment.
`SEED_REGISTRY_APPLY`	`false`	`true` pushes. `false` only reports.
`SEED_REGISTRY_WORK_DIR`	`/var/tmp`	Staging directory. Must be on real disk, not tmpfs.
`SEED_REGISTRY_FORCE`	`false`	Re-push images the registry already has.
`SEED_REGISTRY_CREATE_REPOS`	`true`	Create each ECR repository before its first push.

Feature Toggles

Each component self-gates on its own flag. See Install System (AWS EKS) for the full list and the dependency warnings. On-premises infrastructure, all default true. Set to false on a managed cluster that brings its own.

Variable	Component
`ENABLE_FLANNEL`	Flannel CNI
`ENABLE_LOCALPV_PROVISIONER`	Local persistent-volume provisioner
`ENABLE_METALLB`	MetalLB. Off means `LB_IP` is not required.
`ENABLE_MINIO`	MinIO object storage
`ENABLE_MYSQL`	In-cluster MySQL

GPU

Variable	Default	Purpose
`ENABLE_NVIDIA_GPU_OPERATOR`	`true` on EKS, `false` on-premises	Install the NVIDIA GPU Operator.
`ENABLE_NVIDIA_DEVICE_PLUGIN`	the inverse of the GPU Operator flag	Standalone device plugin, for clusters not using the operator.
`NVIDIA_DRIVER_ENABLED`	unset	Let the GPU Operator manage the driver. Changes node runtime configuration.
`NVIDIA_TOOLKIT_ENABLED`	unset	Let the GPU Operator manage the container toolkit. Changes node runtime configuration.

GPU sizing is not set here. See GPU profiles and values overlays.

Notifications

notification-core sends transactional email, such as assignment and review-request notifications. It is off by default, and the SMTP values it ships with are placeholders rather than a working relay. Supply your own relay details and verify that mail is delivered before you enable it.

Variable	Default	Purpose
`NOTIFICATIONS_SERVICE_ENABLED`	`false`	Deploy `notification-core`.
`SMTP_HOST`	a placeholder	Your relay host. The shipped value does not resolve on a customer install.
`SMTP_PORT`	`1025`	Your relay port.
`SMTP_USERNAME`	unset	Relay user. Note the name: `SMTP_USERNAME`, not `SMTP_USER`.
`SMTP_PASSWORD`	unset	Relay password. Seed mode only; under an ESO backend it comes from `<SMTP_SECRET_PATH>`, property `smtp_password`, and this variable is ignored.
`DEFAULT_SENDER_EMAIL`	a test address	The `From:` address on outbound mail.
`NOTIFICATION_DOMAIN`	empty	Host used to build links inside emails. Empty renders links with no host, so set it to your front origin.
`WHITE_LIST_EMAIL_DOMAINS`	empty	Comma-separated recipient domain allow-list.
`MAILER_PROVIDER`	derived	`front`’s mailer: `smtp`, `sendgrid`, or empty. Defaults to `smtp` when notifications are enabled.

An empty WHITE_LIST_EMAIL_DOMAINS means send to everyone, not block everyone. The service treats an empty list as no restriction. Set it on any non-production install, or a test run mails real customers.

In seed mode the installer inlines SMTP_PASSWORD into YAML with awk, so a password containing a double quote, a backslash, or a newline corrupts the file. Use a secret backend for passwords like that.Setting MAILER_PROVIDER=smtp explicitly makes front send even when notifications are disabled, because its SMTP path ignores the enable flag. Set SMTP_HOST too, or it dials the placeholder host and mail silently goes nowhere.

Secret Backend

See Secrets and Vault for the full path and key inventory.

Variable	Default	Purpose
`SECRET_BACKEND`	`seed`	`seed`, `vault`, or `aws`. No effect on the on-premises flavor.
`BASE_VAULT_PATH`	`lilt/bare/aws`	Prefix every secret lives under.
`<NAME>_SECRET_PATH`	derived from the base	Relocate one secret. `MYSQL_`, `MONGODB_`, `RABBITMQ_`, `CACHE_REDIS_`, `CLICKHOUSE_`, `DATADOG_`, `RDS_CA_`, `AUTH_`, `API_KEYS_`, `CONNECTORS_`, `SMTP_`, `LILT_SECRETS_`.

In-cluster Vault

Variable	Default	Purpose
`ENABLE_VAULT`	`true`	Install the shipped Vault as the ESO backend.
`ENABLE_VAULT_BOOTSTRAP`	`true`	Initialise, unseal, and wire ESO. Set `false` to manage it yourself.
`VAULT_SEAL_MODE`	`awskms` on EKS, `shamir` elsewhere	Auto-unseal or manual. Use `shamir` for AWS without KMS.
`VAULT_SEAL_KMS_KEY_ID`	`alias/<PREFIX>-vault-unseal`	KMS key for auto-unseal.
`VAULT_UNSEAL_ROLE_NAME`	`<PREFIX>-vault-unseal-role`	IAM role for the Vault service account.
`VAULT_KV_MOUNT`	`lilt`	KV v2 mount path.
`VAULT_ESO_ROLE`	`eso`	Vault Kubernetes auth role bound to the ESO service account.
`VAULT_AUTH`	`kubernetes`	`kubernetes` for the in-cluster Vault, `approle` for your own.
`ENABLE_VAULT_UI`	`false`	Publish the Vault UI on its own hostname.
`VAULT_UI_HOST`	`vault.<SUBDOMAIN>.<DNS_DOMAIN>`	That hostname. Needs a DNS record and certificate coverage.
`VAULT_CHART_VERSION`	set by the installer	Override the wrapper chart version.
`ONBOARD_VAULT_PLACEHOLDERS`	`false`	Seed placeholder entries during the install so ESO can sync against a fresh Vault.
`VAULT_TOKEN`	unset	Write token, required only when onboarding placeholders.
`VAULT_K8S_NAMESPACE`	`vault`	Namespace of the in-cluster Vault.
`VAULT_K8S_SERVICE`	`vault`	Service name of the in-cluster Vault.

External Vault

This section applies only if you already run your own HashiCorp Vault and want LILT to read its secrets from it, instead of from the Vault that ships in the tarball. If you are using the shipped one, skip this section entirely: it authenticates with a Kubernetes service account token and needs none of these settings. To use your own Vault, set three things:

# install.env
ENABLE_VAULT=false        # do not deploy the shipped Vault
SECRET_BACKEND=vault      # read secrets through External Secrets Operator
VAULT_AUTH=approle        # authenticate to your Vault with AppRole
VAULT_ADDR=https://vault.example.com

Variable	Default	Purpose
`VAULT_ADDR`	unset	Your Vault server URL. Required on this path.

Set ENABLE_VAULT=false as well. The shipped Vault and your own are mutually exclusive, and two secret stores of the same name must never be active on one cluster.

The AppRole Credentials

The AppRole role ID and secret ID are deliberately not install.env variables. There are no VAULT_ROLE_ID or VAULT_SECRET_ID settings, and no install script reads them from the environment, so they never pass through a file that could be committed or a shell that logs its arguments. Instead, External Secrets reads them from a Kubernetes Secret named vault-approle in the external-secrets namespace. Create it before you run the installer:

kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f -

kubectl create secret generic vault-approle \
  --namespace external-secrets \
  --from-literal=role-id=<your-role-id> \
  --from-literal=secret-id=<your-secret-id>

The key names matter: role-id and secret-id. The installer never creates this Secret and stops with an error if it is missing. The AppRole you use needs read access to every path in the secret inventory. See Secrets and Vault.

Advanced

Escape hatches. Do not set these without a reason.

Variable	Default	Purpose
`ENV_NAME`	`lilt`	The chart custom-values directory under `lilt/environments/`.
`ALLOW_RELEASE_DELETE`	`false`	Let the installer delete a stuck Helm release.
`SKIP_BOOTSTRAP`	unset	Skip the database bootstrap step.
`NODE_TYPE`	`application`	Node-selector value for application pods.
`TLS_CERT_PASSWORD_FILE`	`/certs/client/password`	Path to the Java truststore password file.
`CLOUDENV`	`on-prem`	Runtime environment label. Documentation only.

​Identity

​Pre-existing Resources

​DNS and TLS

​Image Registry

​Registry Seeding

​Feature Toggles

​Notifications

​Secret Backend

​In-cluster Vault

​External Vault

​The AppRole Credentials

​Advanced

​Related Articles

Identity

Pre-existing Resources

DNS and TLS

Image Registry

Registry Seeding

Feature Toggles

Notifications

Secret Backend

In-cluster Vault

External Vault

The AppRole Credentials

Advanced

Related Articles