Environment variables reference
Source: crates/server-config registry + live std::env reads. Precedence: env → vion.toml → default.
Process: CP = control-plane, RT = runtime-core, HW = historian-writer, Drv = driver.
Database and bootstrap
| Env | Process | Default | Note |
|---|---|---|---|
VION_DATABASE_URL | CP | — | Required; secret |
VION_BOOTSTRAP_ADMIN_USERNAME | CP | — | First admin |
VION_BOOTSTRAP_ADMIN_PASSWORD | CP | — | Secret; ≥12 characters recommended |
Network and TLS
| Env | Process | Default | Note |
|---|---|---|---|
VION_HTTP_BIND | CP/RT | 0.0.0.0:8080 / :8081 | Listen |
VION_ALLOW_INSECURE_HTTP | CP/RT | false | true local only |
VION_TLS_CERT / VION_TLS_KEY | CP/RT | — | HTTP TLS PEM |
VION_CORS_ORIGIN | CP/RT | http://127.0.0.1:5173 | Advanced |
VION_CERT_INVENTORY_DIR | CP | — | Certificate inventory |
VION_TLS_RELOAD_SECS | CP | — | PEM reload interval |
VION_TRUST_PROXY | CP | false | X-Forwarded-For |
VION_CERT_EXPIRING_DAYS | CP | — | Unregistered; warning threshold |
Runtime / gRPC
| Env | Process | Default | Note |
|---|---|---|---|
VION_TENANT_ID | RT | — | Set → Stage rejects other tenants |
VION_GRPC_BIND | RT | 0.0.0.0:50051 | |
VION_RUNTIME_GRPC_URL | CP | — | Default tenant unbound target |
VION_RUNTIME_GRPC_ALLOW_REMOTE | CP | false | Remote runtime registration |
VION_RUNTIME_GRPC_TLS_CA / _CERT / _KEY | CP | — | Client TLS/mTLS |
VION_RUNTIME_APP_TOKEN | CP/RT | — | x-vion-app-token |
VION_GRPC_KEEPALIVE_SECS | CP/RT | — | HTTP/2 PING |
VION_GRPC_TLS_CERT / _KEY / _CLIENT_CA | RT | — | Server TLS/mTLS |
VION_RUNTIME_HTTP_URL | CP | — | Report / registered HTTP |
VION_SNAPSHOT_PATH | RT | — | Load at startup |
Commands
| Env | Process | Default | Note |
|---|---|---|---|
VION_COMMAND_TOKEN | RT | — | Empty = commands off; live read on |
VION_COMMAND_STEP_UP | RT | — | Step-up proof |
VION_COMMAND_REASON_REQUIRED | RT | false | Hot; empty reason → 400 |
Historian
| Env | Process | Default | Note |
|---|---|---|---|
VION_SPOOL_DIR | RT/HW | under temp | Required on HW |
VION_HISTORIAN_DIR | RT/HW | — | Embedded columnar |
VION_HISTORIAN_DATABASE_URL | RT/HW | — | Read (RT) / write (HW) |
VION_HISTORIAN | HW | columnar | columnar | postgres |
VION_HISTORIAN_RETENTION_DAYS | HW | — | |
VION_HISTORIAN_RETENTION_SECS | HW | — | Unregistered; if conflicts with days, secs wins |
Identity / OIDC / session
| Env | Process | Default | Note |
|---|---|---|---|
VION_BREAK_GLASS_TOTP_SECRET | CP | — | Emergency access |
VION_BREAK_GLASS_USERNAME | CP | — | |
VION_OIDC_ISSUER | CP | — | |
VION_OIDC_CLIENT_ID / _SECRET | CP | — | |
VION_OIDC_REDIRECT_URI | CP | — | |
VION_OIDC_AUTO_PROVISION | CP | — | |
VION_OIDC_UI_REDIRECT | CP | — | Unregistered |
VION_OIDC_ROLE_MAP / _ROLE_CLAIM | CP | — | Unregistered |
VION_OIDC_END_SESSION_ENDPOINT | CP | — | Unregistered |
VION_API_TOKEN_TTL_HOURS | CP | — | |
VION_API_TOKEN_TTL_DAYS | CP | — | Unregistered; if hours missing |
VION_LOGIN_LOCKOUT_THRESHOLD | CP | 5 | 0 = off |
VION_LOGIN_LOCKOUT_MINUTES | CP | 15 | 1–1440 |
VION_MULTI_TENANT | CP | — | 1/true → tenant API |
Not available yet
There is no LDAP / SAML. OIDC is partial; local users always exist.
HA / deployment
| Env | Process | Default | Note |
|---|---|---|---|
VION_NODE_ID | CP | local | |
VION_NODE_ROLE | CP | active | |
VION_HA_PEERS | CP | — | |
VION_HA_LAG_WARN_MS | CP | — | Studio lag badge |
VION_HA_FAILOVER | CP | — | Unregistered; in-memory promote |
VION_RESTART_POLICY | CP/RT | — | supervised → exit 75 |
VION_STUDIO_DIR | CP | — | Static Studio dist |
VION_CONFIG_FILE | all | OS default | Meta |
Backup / report
| Env | Process | Default | Note |
|---|---|---|---|
VION_BACKUP_DIR | CP | — | |
VION_BACKUP_INTERVAL_SECS | CP | — | |
VION_BACKUP_KEEP | CP | 7 | |
VION_BACKUP_PASSWORD | CP | — | Secret |
VION_REPORT_DIR | CP | — | Both required together |
VION_REPORT_INTERVAL_SECS | CP | — |
License
| Env | Process | Default | Note |
|---|---|---|---|
VION_LICENSE_EXPIRES_AT | CP | — | |
VION_LICENSE_GRACE_DAYS | CP | 30 | |
VION_LICENSE_MAX_TAGS / _MAX_RUNTIMES / _MAX_SCREENS | CP | — | |
VION_LICENSE_MAX_NODES | CP | — | Unregistered; max runtimes alias |
OPC UA server (expose)
| Env | Process | Default | Note |
|---|---|---|---|
VION_OPCUA_SERVER | RT | — | 1/true enables |
VION_OPCUA_SERVER_BIND | RT | 0.0.0.0:4841 | |
VION_OPCUA_SERVER_PORT | RT | — | Unregistered alias |
VION_OPCUA_SERVER_PKI | RT | — | |
VION_OPCUA_SERVER_USERS | RT | — | JSON user list |
VION_OPCUA_SERVER_ALLOW_INSECURE | RT | — | loopback only |
VION_OPCUA_SERVER_MODE | RT | active | standby rejects writes |
VION_OPCUA_SERVER_HISTORY / _EVENTS | RT | — | |
VION_OPCUA_SERVER_APPLICATION_URI | RT | urn:mikrodev:vion:opcua-server | Per runtime. Whitespace or over 512 characters refuses startup |
VION_OPCUA_SERVER_DEFAULT_REASON | RT | opcua.write | Unregistered |
VION_OPCUA_SUBSCRIBE | RT | — | Unregistered; client subscription |
Webhook / observability / other
| Env | Process | Default | Note |
|---|---|---|---|
VION_ALARM_WEBHOOK_URL | RT | — | ACTIVE/CLEAR |
VION_ALARM_WEBHOOK_TOKEN | RT | — | Bearer |
VION_OTEL_ENDPOINT | CP/RT | — | OTLP |
RUST_LOG | all | info | Hot |
VION_STALE_MS | RT | — | Stale quality |
VION_TOTALIZER_PATH | RT | — | |
VION_TOTALIZER_SHIFT_HOURS | RT | — | |
VION_TOTALIZER_SHIFT_CRON | RT | — | Unregistered |
VION_MQTT_QOS | Drv | — | Operate default QoS |
VION_IEC104_CLOCK_SYNC | Drv | — | |
VION_SIM_PLAYBACK_PATH / VION_SIM_SINE | RT | — | Unregistered; sim |
*Unregistered* = not in the server-config schema; process code reads it. Adding to the schema is recommended.