Environment variable reference
This page lists the environment variables read directly by the Registry Notary binary, the Registry Relay binary, and registryctl. These are fixed variable names that the process resolves itself.
Secret material such as credential hashes, signing keys, and upstream tokens is not read from a fixed variable name. Instead, each config field names the environment variable to read, and the operator chooses the name. Those per-deployment variables are documented in the synced configuration references rather than repeated on this page. See the Registry Notary operator config reference and the Registry Relay configuration reference for the config fields that name secret environment variables.
Configuration expansion
Section titled “Configuration expansion”Registry Notary and Registry Relay expand ${VAR} expressions before YAML
parsing.
${VAR} requires VAR to be set to a non-empty value.
${VAR:-fallback} uses fallback when VAR is unset or empty, including
${VAR:-} for an explicit empty result.
${VAR:?message} fails with message when VAR is unset or empty.
Whitespace-only values are non-empty.
Diagnostics name the variable or use the supplied message; they never include
the variable value.
Registry Notary
Section titled “Registry Notary”The Registry Notary binary reads the variables below. Each also has an equivalent command-line flag.
| Name | Purpose | Default or required |
|---|---|---|
REGISTRY_NOTARY_CONFIG | YAML config path. Equivalent to --config. | Required for commands that load config. |
REGISTRY_NOTARY_ENV_FILE | Dotenv-style file to load before config validation resolves env vars. Equivalent to --env-file. | Optional. |
REGISTRY_NOTARY_BIND | Override server.bind after config load. Equivalent to --bind. | Optional. |
REGISTRY_NOTARY_HEALTHCHECK_URL | Health endpoint URL for the healthcheck command. | Defaults to http://127.0.0.1:8080/healthz. |
REGISTRY_NOTARY_HEALTHCHECK_TIMEOUT_MS | Health probe timeout in milliseconds for the healthcheck command. | Defaults to 5000. |
REGISTRY_NOTARY_LOG_FORMAT | Operational log format: text or json. | Defaults to text. |
Registry Relay
Section titled “Registry Relay”The Registry Relay binary reads the variables below.
| Name | Purpose | Default or required |
|---|---|---|
REGISTRY_RELAY_CONFIG | YAML config path used when --config is not passed. | Falls back to ./config/example.yaml. |
REGISTRY_RELAY_ENV_FILE | Dotenv-style file to load before config validation resolves env vars, used when --env-file is not passed. | Optional. |
REGISTRY_RELAY_BIND | Override server.bind. | Optional. |
REGISTRY_RELAY_LOG_FORMAT | Operational log format: json or jsonl select JSON output; any other value selects text. | Defaults to text. |
DATA_GATE_POSTGRES_ROOT_CERT_PATH | Path to a PEM file with a custom root certificate to trust for a Postgres source connector’s TLS connection. | Optional. Falls back to the system default trust store when unset. |
The audit hash secret and other secret material are read from operator-named variables declared in config fields such as audit.hash_secret_env (for example, REGISTRY_RELAY_AUDIT_HASH_SECRET), API key fingerprint env names, and the Postgres connection_env. For the full list of config fields that name secret environment variables, see the Registry Relay configuration reference.
registryctl
Section titled “registryctl”registryctl reads the variables below. Registry Stack projects bind source and credential values through operator-selected secret references in environment files; the authored project and generated inputs contain the reference names, not the secret values.
| Name | Purpose | Default or required |
|---|---|---|
REGISTRYCTL_NO_UPDATE_CHECK | Disable the automatic update check when set to a non-empty value other than 0 or false. | Optional. |
REGISTRYCTL_UPDATE_CHECK | Disable the automatic update check when set to 0 or false. | Optional. |
REGISTRYCTL_VERSION | Pinned release the installer downloads. Read by the install script, not the running binary. | Defaults to the installer’s pinned release. |
CI | When set to a non-empty value other than 0 or false, disables the automatic update check. | Optional. |
Source
Section titled “Source”The fixed variable names above are transcribed from the binaries and the registryctl source. For the canonical definitions, read the Registry Notary binary entry point, the Registry Relay binary entry point, and the registryctl library source. The operator-named secret variables are documented in the Registry Notary operator config reference and the Registry Relay configuration reference.