Environment variable reference

This page lists the environment variables read directly by the Relay binary, the Evidence Gateway binary, and the Registry Mint binary, plus the variables their install scripts read. These are fixed variable names that the process resolves itself.

The stack’s other kind of environment variable is operator-named. Secret material such as an audit integrity key is not read from a fixed variable name: a configuration field carries a reference that names the variable, and the operator chooses the name. Relay is the product that works that way, and the reference grammar is closed rather than free-form. Evidence Gateway and Registry Mint read no secret from the environment under either kind of name, as the sections for each product record.

Configuration expansion

None of the three binaries expands environment references inside its configuration documents. Each parses its documents as written: Relay in RelayRuntime::parse_yaml and RegistryContract::parse_yaml (crates/registry-relay-v2/src/contract.rs), Evidence Gateway in RuntimeConfig::parse_yaml (crates/registry-evidence/src/config.rs), and Registry Mint in MintConfig::load (crates/registry-mint/src/config.rs).

Relay

The relay binary reads the variables below.

Name	Purpose	Default or required
RELAY_RUNTIME	Path to the deployment binding that names the sealed package, the local sources, authentication, audit, and limits. Equivalent to the --runtime flag on relay serve.	Required for relay serve, by flag or by variable.
RELAY_HEALTHCHECK_URL	Complete HTTP or HTTPS URL of the unauthenticated /health endpoint to probe. Equivalent to the --url flag on relay healthcheck.	Defaults to http://127.0.0.1:8080/health.
RELAY_LOG	Level for the JSON operational records the process writes on standard error.	Defaults to info.

RELAY_LOG is a closed enumeration, not a tracing filter directive. It accepts exactly off, error, warn, info, debug, and trace, and each value applies to the registry_relay_v2 target only. Any other value, including a valid-looking directive such as trace,hyper=trace, falls back to info. An arbitrary directive could enable dependency events carrying URLs or headers, so the process refuses to accept one.

Secret references in runtime.yaml

Relay resolves secrets through two providers, environment and file, rooted at the directory holding the runtime file. Two fields take a reference: audit.integrityKeyRef, which is required, and cursor.integrityKeyRef, which applies when the deployment enables cursors.

Grammar	Resolves to	Accepted name
secret:env/<NAME>	The value of the environment variable <NAME>	Starts with an uppercase ASCII letter, then uppercase ASCII letters, digits, or _, up to 128 characters
secret:file/<name>	A file named <name> under the runtime file’s directory	Starts with a lowercase ASCII letter, then lowercase ASCII letters, digits, ., _, or -, up to 128 characters

A reference that matches neither grammar makes the runtime document invalid, so the process refuses to start rather than serving with an unresolved secret. The variable names themselves are the operator’s choice and appear nowhere in Relay’s source. See Configure Relay for the fields around them.

Relay installer

The install script reads the variables below. They are read by the script, not by the running binary.

Name	Purpose	Default or required
RELAY_VERSION	Relay tag to install. A published installer asset embeds its own tag and refuses an override that does not match it.	Defaults to the installer’s pinned tag.
RELAY_INSTALL_DIR	Directory the script installs into.	Defaults to ~/.local/bin.
RELAY_ASSET_DIR	Directory of already-downloaded release assets to read instead of downloading. Use it after verifying a release with release/VERIFY.md.	Optional.

The script verifies the downloaded binary against the release SHA256SUMS before anything reaches the install directory. It does not verify release authenticity.

Relay adopter tooling has no installer. relayctl ships as a plain binary asset; see the relayctl command reference.

Relayctl

relayctl reads no environment variable. Every input is a positional path or an explicit flag, and every secret reference stays inside the project’s runtime.yaml for relay to resolve at startup.

Evidence Gateway

The evidence binary reads the two variables below. Each is a global that applies to every subcommand.

Name	Purpose	Default or required
REGISTRY_EVIDENCE_RUNTIME	Absolute path to the one operator runtime file that binds the governed bundle. Equivalent to the global --runtime flag.	Defaults to /etc/registry-evidence/runtime.yaml.
EVIDENCE_LOG	Tracing filter for the operational records the serving process writes as line-delimited JSON on standard output.	Defaults to info. Read by evidence serve only; offline commands install no log subscriber.

Evidence Gateway reads no secret from an environment variable. A configured secret reference uses one grammar, secret:file/<name>, enforced by SecretRef::parse in crates/registry-evidence/src/config.rs, and resolves to an owner-only regular file under the secretProviders.file.root directory named in runtime.yaml (crates/registry-evidence/src/secrets.rs). Neither the runtime file nor the governed bundle can name an environment variable to read a credential from. See Configure Evidence Gateway for the runtime file and the bundle it binds.

Registry Mint

The mint binary reads the variables below.

Name	Purpose	Default or required
MINT_CONFIG	YAML config path for mint check and mint serve. Equivalent to --config.	Required for those two subcommands, by flag or by variable.
RUST_LOG	Tracing filter for the JSON operational logs. Applies to every subcommand; mint token sends its logs to standard error so the access token stays alone on standard output.	Defaults to info.

Registry Mint’s governed service public keys, Transit proxy settings, and client registrations are named in its configuration: signing.activePublicJwkFile, signing.publishedPublicJwkFiles, signing.revokedKeyIds, signer, and clients.directory. None is an environment variable. The mint token subcommand is a caller tool rather than an operator one: it reads no server configuration at all, and takes the caller’s private JWK and any delegation subject as file paths rather than as values. See the Registry Mint reference for the full configuration surface.

Source

The fixed variable names above are transcribed from the binaries and the install scripts, at the paths given here. For the canonical definitions, read the Relay binary entry point crates/registry-relay-v2/src/main.rs (the Command enum, install_operational_logging, and operational_log_directive), the Relay secret grammar in crates/registry-relay-v2/src/contract.rs (valid_secret_reference) with its resolver in crates/registry-relay-v2/src/startup.rs (resolve_secret), the Relay install script crates/registry-relay-v2/install.sh, the Evidence Gateway binary entry point crates/registry-evidence/src/main.rs (the Cli struct and install_operational_logging), and the Registry Mint binary entry point crates/registry-mint/src/main.rs (the Command enum and main).