> ## Documentation Index > Fetch the complete documentation index at: https://support.lilt.com/llms.txt > Use this file to discover all available pages before exploring further. # install.env Reference `install.env` holds every setting the installer reads. Copy `install.env.example` to `install.env`, uncomment what you need, and leave the rest alone to keep the defaults. ```bash theme={null} cp install.env.example install.env chmod 0600 install.env ``` The file is sourced by both entrypoints and exported to every component script. It is git-ignored. Never commit it: it holds credentials. This page is a lookup table. For the reasoning behind a group of settings, follow the links in each section. ## Identity Set these first. Every resource name and hostname derives from them. | Variable | Default | Purpose | | ---------------- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | `SUBDOMAIN` | none, **required** | Environment subdomain. Hostnames become `-.`. | | `DNS_DOMAIN` | none, **required** | Base domain. Required on both flavors. | | `PREFIX` | unset | Terraform resource prefix. Setting it derives `CLUSTER_NAME`, `RDS_IDENTIFIER`, `S3_BUCKET`, `SQS_QUEUE_URL` and the `*_ROLE_NAME` values. | | `AWS_REGION` | `us-east-1` | Region for the S3 endpoint and SQS URL. | | `AWS_ACCOUNT_ID` | from `aws sts get-caller-identity` | Used to build resource ARNs. | | `AWS_PROFILE` | the default profile | AWS CLI named profile. | ## Pre-existing Resources Set these when your infrastructure does not follow the `-` naming. Each one bypasses the derived lookup. | Variable | Default | Purpose | | ------------------------------ | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `CONNECTORS_ADMIN_PASSWORD` | none, **required** in seed mode | Login for the `/connectors-admin` console. The install fails loudly if unset. Under an ESO backend it comes from your secret store instead. | | `CLUSTER_NAME` | `-eks` | EKS cluster to target. | | `RDS_IDENTIFIER` | `-rds` | RDS instance lookup key. | | `DB_NAME` | `lilt_dev` | Application database. | | `S3_BUCKET` | `-s3` | Object storage bucket. | | `SQS_QUEUE_URL` | derived from region, account and prefix | Queue for asynchronous work. | | `SA_NAME` | `lilt-s3-workload` | Service account granted S3 access. | | `MONGO_PASS` | `dummypass` | MongoDB `lilt` user password. Change it. | | `APP_WORKLOAD_ROLE_NAME` | `-app-workload` | IAM role name, matched as a substring. | | `CLUSTER_AUTOSCALER_ROLE_NAME` | `-cluster-autoscaler` | IAM role name for Cluster Autoscaler. | | `CERT_MANAGER_ROLE_NAME` | `-cert-manager-role` | IAM role name for cert-manager. | | `IAM_AUTH_METHOD` | `irsa` | `irsa` or `pod_identity`. Must match how your roles are bound. See [Provision AWS infrastructure with Terraform](/kb/install-aws-terraform-module#workload-identity). | ## DNS and TLS See [Set custom domain and certificates](/kb/set-custom-domain-and-certificates) for the hostname list and the required certificate names. | Variable | Default | Purpose | | --------------------- | ------- | -------------------------------------------------------------------------------------------------------- | | `HOSTED_ZONE_ID` | unset | Route53 zone for `DNS_DOMAIN`. | | `ENABLE_DNS` | `false` | Create Route53 records. Needs `HOSTED_ZONE_ID` and Route53 write access. | | `ENABLE_CERT_MANAGER` | `false` | Issue the certificate with cert-manager over Route53 DNS-01. | | `TLS_CRT_FILE` | unset | Path to your PEM chain. Must not be set together with `ENABLE_CERT_MANAGER=true`. | | `TLS_KEY_FILE` | unset | Path to the matching private key. | | `LB_IP` | unset | On-premises only. The address MetalLB hands the ingress gateway. Required when `ENABLE_METALLB` is true. | ## Image Registry A full image reference is `//`. See [Install package](/kb/install-package). | Variable | Default | Purpose | | ---------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | `REGISTRY_BASE` | `harbor..` on EKS | The registry host to pull from. | | `REGISTRY_PATH_APP` | `proxy-gcr/lilt-service-48916b30` | Path segment for most application images. Set empty for plain ECR. | | `REGISTRY_PATH_GAR` | `proxy-gar-core/lilt-service-48916b30` | Path segment for core images. Set empty for plain ECR. | | `REGISTRY_PATH_INFRA` | `proxy-gar-core/lilt-service-48916b30/chainguard/lilt.com` | Path segment for infrastructure base images. Set empty for plain ECR. | | `CHART_BASE` | an OCI registry URL | Helm chart source. **Set this to an absolute path such as `/opt/lilt/charts` to install from the charts in the tarball.** | | `CHART_REGISTRY_BASE` | `us-central1-docker.pkg.dev/lilt-service-48916b30` | Host and project behind the default `CHART_BASE`. | | `STORAGE_CLASS` | `ebs-gp3` on EKS, `openebs-hostpath` on-premises | StorageClass every stateful component requests. | | `STORAGE_CLASS_RETAIN` | `-retain` | Retaining variant. | `NVCR_REGISTRY` and `K8S_REGISTRY` default to routing through `REGISTRY_BASE` like every other image. Setting them explicitly to `nvcr.io` or `registry.k8s.io` makes those components pull straight from the public internet, which breaks an air-gapped install. Leave them unset unless you know you want that. Pointing `STORAGE_CLASS` at a class you already have, without also setting `ENABLE_CLUSTER_PREREQS=false`, makes Helm take ownership of it. A later uninstall then deletes it. ## Registry Seeding Off by default. See [Seed your container registry](/kb/install-package#seed-your-container-registry). | Variable | Default | Purpose | | ---------------------------- | ------------------- | --------------------------------------------------- | | `ENABLE_SEED_REGISTRY` | `false` | Run `seed-registry.sh` as part of the install. | | `SEED_REGISTRY_RELEASE` | unset | Extracted release directory, or an `s3://` prefix. | | `SEED_REGISTRY_TARGET` | `REGISTRY_BASE` | Destination registry. | | `SEED_REGISTRY_PATH` | `REGISTRY_PATH_APP` | Destination path segment. | | `SEED_REGISTRY_APPLY` | `false` | `true` pushes. `false` only reports. | | `SEED_REGISTRY_WORK_DIR` | `/var/tmp` | Staging directory. Must be on real disk, not tmpfs. | | `SEED_REGISTRY_FORCE` | `false` | Re-push images the registry already has. | | `SEED_REGISTRY_CREATE_REPOS` | `true` | Create each ECR repository before its first push. | ## Feature Toggles Each component self-gates on its own flag. See [Install System (AWS EKS)](/kb/install-system-aws-eks#component-flags) for the full list and the dependency warnings. **On-premises infrastructure**, all default `true`. Set to `false` on a managed cluster that brings its own. | Variable | Component | | ---------------------------- | ------------------------------------------- | | `ENABLE_FLANNEL` | Flannel CNI | | `ENABLE_LOCALPV_PROVISIONER` | Local persistent-volume provisioner | | `ENABLE_METALLB` | MetalLB. Off means `LB_IP` is not required. | | `ENABLE_MINIO` | MinIO object storage | | `ENABLE_MYSQL` | In-cluster MySQL | **GPU** | Variable | Default | Purpose | | ----------------------------- | ------------------------------------ | -------------------------------------------------------------------------------------- | | `ENABLE_NVIDIA_GPU_OPERATOR` | `true` on EKS, `false` on-premises | Install the NVIDIA GPU Operator. | | `ENABLE_NVIDIA_DEVICE_PLUGIN` | the inverse of the GPU Operator flag | Standalone device plugin, for clusters not using the operator. | | `NVIDIA_DRIVER_ENABLED` | unset | Let the GPU Operator manage the driver. Changes node runtime configuration. | | `NVIDIA_TOOLKIT_ENABLED` | unset | Let the GPU Operator manage the container toolkit. Changes node runtime configuration. | GPU sizing is not set here. See [GPU profiles and values overlays](/kb/gpu-profiles-and-values-overlays). ## Notifications `notification-core` sends transactional email, such as assignment and review-request notifications. It is off by default, and the SMTP values it ships with are placeholders rather than a working relay. Supply your own relay details and verify that mail is delivered before you enable it. | Variable | Default | Purpose | | ------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | `NOTIFICATIONS_SERVICE_ENABLED` | `false` | Deploy `notification-core`. | | `SMTP_HOST` | a placeholder | Your relay host. The shipped value does not resolve on a customer install. | | `SMTP_PORT` | `1025` | Your relay port. | | `SMTP_USERNAME` | unset | Relay user. Note the name: `SMTP_USERNAME`, not `SMTP_USER`. | | `SMTP_PASSWORD` | unset | Relay password. Seed mode only; under an ESO backend it comes from ``, property `smtp_password`, and this variable is ignored. | | `DEFAULT_SENDER_EMAIL` | a test address | The `From:` address on outbound mail. | | `NOTIFICATION_DOMAIN` | empty | Host used to build links inside emails. Empty renders links with no host, so set it to your front origin. | | `WHITE_LIST_EMAIL_DOMAINS` | empty | Comma-separated recipient domain allow-list. | | `MAILER_PROVIDER` | derived | `front`'s mailer: `smtp`, `sendgrid`, or empty. Defaults to `smtp` when notifications are enabled. | An empty `WHITE_LIST_EMAIL_DOMAINS` means **send to everyone**, not block everyone. The service treats an empty list as no restriction. Set it on any non-production install, or a test run mails real customers. In seed mode the installer inlines `SMTP_PASSWORD` into YAML with `awk`, so a password containing a double quote, a backslash, or a newline corrupts the file. Use a secret backend for passwords like that. Setting `MAILER_PROVIDER=smtp` explicitly makes `front` send even when notifications are disabled, because its SMTP path ignores the enable flag. Set `SMTP_HOST` too, or it dials the placeholder host and mail silently goes nowhere. ## Secret Backend See [Secrets and Vault](/kb/secrets-and-vault) for the full path and key inventory. | Variable | Default | Purpose | | -------------------- | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `SECRET_BACKEND` | `seed` | `seed`, `vault`, or `aws`. No effect on the on-premises flavor. | | `BASE_VAULT_PATH` | `lilt/bare/aws` | Prefix every secret lives under. | | `_SECRET_PATH` | derived from the base | Relocate one secret. `MYSQL_`, `MONGODB_`, `RABBITMQ_`, `CACHE_REDIS_`, `CLICKHOUSE_`, `DATADOG_`, `RDS_CA_`, `AUTH_`, `API_KEYS_`, `CONNECTORS_`, `SMTP_`, `LILT_SECRETS_`. | ## In-cluster Vault | Variable | Default | Purpose | | ---------------------------- | ----------------------------------- | ---------------------------------------------------------------------------------- | | `ENABLE_VAULT` | `true` | Install the shipped Vault as the ESO backend. | | `ENABLE_VAULT_BOOTSTRAP` | `true` | Initialise, unseal, and wire ESO. Set `false` to manage it yourself. | | `VAULT_SEAL_MODE` | `awskms` on EKS, `shamir` elsewhere | Auto-unseal or manual. Use `shamir` for AWS without KMS. | | `VAULT_SEAL_KMS_KEY_ID` | `alias/-vault-unseal` | KMS key for auto-unseal. | | `VAULT_UNSEAL_ROLE_NAME` | `-vault-unseal-role` | IAM role for the Vault service account. | | `VAULT_KV_MOUNT` | `lilt` | KV v2 mount path. | | `VAULT_ESO_ROLE` | `eso` | Vault Kubernetes auth role bound to the ESO service account. | | `VAULT_AUTH` | `kubernetes` | `kubernetes` for the in-cluster Vault, `approle` for your own. | | `ENABLE_VAULT_UI` | `false` | Publish the Vault UI on its own hostname. | | `VAULT_UI_HOST` | `vault..` | That hostname. Needs a DNS record and certificate coverage. | | `VAULT_CHART_VERSION` | set by the installer | Override the wrapper chart version. | | `ONBOARD_VAULT_PLACEHOLDERS` | `false` | Seed placeholder entries during the install so ESO can sync against a fresh Vault. | | `VAULT_TOKEN` | unset | Write token, required only when onboarding placeholders. | | `VAULT_K8S_NAMESPACE` | `vault` | Namespace of the in-cluster Vault. | | `VAULT_K8S_SERVICE` | `vault` | Service name of the in-cluster Vault. | ## External Vault This section applies only if you already run your own HashiCorp Vault and want LILT to read its secrets from it, instead of from the Vault that ships in the tarball. If you are using the shipped one, skip this section entirely: it authenticates with a Kubernetes service account token and needs none of these settings. To use your own Vault, set three things: ```bash theme={null} # install.env ENABLE_VAULT=false # do not deploy the shipped Vault SECRET_BACKEND=vault # read secrets through External Secrets Operator VAULT_AUTH=approle # authenticate to your Vault with AppRole VAULT_ADDR=https://vault.example.com ``` | Variable | Default | Purpose | | ------------ | ------- | --------------------------------------------- | | `VAULT_ADDR` | unset | Your Vault server URL. Required on this path. | Set `ENABLE_VAULT=false` as well. The shipped Vault and your own are mutually exclusive, and two secret stores of the same name must never be active on one cluster. ### The AppRole Credentials The AppRole role ID and secret ID are deliberately not `install.env` variables. There are no `VAULT_ROLE_ID` or `VAULT_SECRET_ID` settings, and no install script reads them from the environment, so they never pass through a file that could be committed or a shell that logs its arguments. Instead, External Secrets reads them from a Kubernetes Secret named `vault-approle` in the `external-secrets` namespace. Create it before you run the installer: ```bash theme={null} kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f - kubectl create secret generic vault-approle \ --namespace external-secrets \ --from-literal=role-id= \ --from-literal=secret-id= ``` The key names matter: `role-id` and `secret-id`. The installer never creates this Secret and stops with an error if it is missing. The AppRole you use needs read access to every path in the secret inventory. See [Secrets and Vault](/kb/secrets-and-vault#what-vault-must-contain). ## Advanced Escape hatches. Do not set these without a reason. | Variable | Default | Purpose | | ------------------------ | ------------------------ | ------------------------------------------------------------- | | `ENV_NAME` | `lilt` | The chart custom-values directory under `lilt/environments/`. | | `ALLOW_RELEASE_DELETE` | `false` | Let the installer delete a stuck Helm release. | | `SKIP_BOOTSTRAP` | unset | Skip the database bootstrap step. | | `NODE_TYPE` | `application` | Node-selector value for application pods. | | `TLS_CERT_PASSWORD_FILE` | `/certs/client/password` | Path to the Java truststore password file. | | `CLOUDENV` | `on-prem` | Runtime environment label. Documentation only. | ## Related Articles * [Install System (AWS EKS)](/kb/install-system-aws-eks) * [Install package](/kb/install-package) * [Secrets and Vault](/kb/secrets-and-vault) * [Set custom domain and certificates](/kb/set-custom-domain-and-certificates) * [GPU profiles and values overlays](/kb/gpu-profiles-and-values-overlays)