Registry stack documentation: machine-readable Markdown.
Index of all pages: https://docs.registrystack.org/llms.txt
Full corpus: https://docs.registrystack.org/llms-full.txt

# Environment variable reference

> Environment variables read by Registry Notary, Registry Relay, and registryctl, with links to the full configuration references.

This page lists the environment variables read directly by the Registry Notary binary, the Registry Relay binary, and registryctl. These are fixed variable names that the process resolves itself.

Secret material such as credential hashes, signing keys, and upstream tokens is not read from a fixed variable name. Instead, each config field names the environment variable to read, and the operator chooses the name. Those per-deployment variables are documented in the synced configuration references rather than repeated on this page. See the [Registry Notary operator config reference](../../products/registry-notary/operator-config-reference/) and the [Registry Relay configuration reference](../../products/registry-relay/configuration/) for the config fields that name secret environment variables.

## Configuration expansion

Registry Notary and Registry Relay expand `${VAR}` expressions before YAML
parsing.
`${VAR}` requires `VAR` to be set to a non-empty value.
`${VAR:-fallback}` uses `fallback` when `VAR` is unset or empty, including
`${VAR:-}` for an explicit empty result.
`${VAR:?message}` fails with `message` when `VAR` is unset or empty.
Whitespace-only values are non-empty.
Diagnostics name the variable or use the supplied message; they never include
the variable value.

## Registry Notary

The Registry Notary binary reads the variables below. Each also has an equivalent command-line flag.

| Name | Purpose | Default or required |
| --- | --- | --- |
| `REGISTRY_NOTARY_CONFIG` | YAML config path. Equivalent to `--config`. | Required for commands that load config. |
| `REGISTRY_NOTARY_ENV_FILE` | Dotenv-style file to load before config validation resolves env vars. Equivalent to `--env-file`. | Optional. |
| `REGISTRY_NOTARY_BIND` | Override `server.bind` after config load. Equivalent to `--bind`. | Optional. |
| `REGISTRY_NOTARY_HEALTHCHECK_URL` | Health endpoint URL for the `healthcheck` command. | Defaults to `http://127.0.0.1:8080/healthz`. |
| `REGISTRY_NOTARY_HEALTHCHECK_TIMEOUT_MS` | Health probe timeout in milliseconds for the `healthcheck` command. | Defaults to `5000`. |
| `REGISTRY_NOTARY_LOG_FORMAT` | Operational log format: `text` or `json`. | Defaults to `text`. |

## Registry Relay

The Registry Relay binary reads the variables below.

| Name | Purpose | Default or required |
| --- | --- | --- |
| `REGISTRY_RELAY_CONFIG` | YAML config path used when `--config` is not passed. | Falls back to `./config/example.yaml`. |
| `REGISTRY_RELAY_ENV_FILE` | Dotenv-style file to load before config validation resolves env vars, used when `--env-file` is not passed. | Optional. |
| `REGISTRY_RELAY_BIND` | Override `server.bind`. | Optional. |
| `REGISTRY_RELAY_LOG_FORMAT` | Operational log format: `json` or `jsonl` select JSON output; any other value selects text. | Defaults to text. |
| `DATA_GATE_POSTGRES_ROOT_CERT_PATH` | Path to a PEM file with a custom root certificate to trust for a Postgres source connector's TLS connection. | Optional. Falls back to the system default trust store when unset. |

The audit hash secret and other secret material are read from operator-named variables declared in config fields such as `audit.hash_secret_env` (for example, `REGISTRY_RELAY_AUDIT_HASH_SECRET`), API key fingerprint env names, and the Postgres `connection_env`. For the full list of config fields that name secret environment variables, see the [Registry Relay configuration reference](../../products/registry-relay/configuration/).

## registryctl

registryctl reads the variables below. Registry Stack projects bind source and credential values
through operator-selected secret references in environment files; the authored project and
generated inputs contain the reference names, not the secret values.

| Name | Purpose | Default or required |
| --- | --- | --- |
| `REGISTRYCTL_NO_UPDATE_CHECK` | Disable the automatic update check when set to a non-empty value other than `0` or `false`. | Optional. |
| `REGISTRYCTL_UPDATE_CHECK` | Disable the automatic update check when set to `0` or `false`. | Optional. |
| `REGISTRYCTL_VERSION` | Pinned release the installer downloads. Read by the install script, not the running binary. | Defaults to the installer's pinned release. |
| `CI` | When set to a non-empty value other than `0` or `false`, disables the automatic update check. | Optional. |

## Source

The fixed variable names above are transcribed from the binaries and the registryctl source. For the canonical definitions, read the [Registry Notary binary entry point](https://github.com/registrystack/registry-stack/blob/main/crates/registry-notary/src/main.rs), the [Registry Relay binary entry point](https://github.com/registrystack/registry-stack/blob/main/crates/registry-relay/src/main.rs), and the [registryctl library source](https://github.com/registrystack/registry-stack/blob/main/crates/registryctl/src/lib.rs). The operator-named secret variables are documented in the [Registry Notary operator config reference](../../products/registry-notary/operator-config-reference/) and the [Registry Relay configuration reference](../../products/registry-relay/configuration/).