Synqly Embedded supports reading configuration through both command-line flags and environment variables. This page lists every available option and is updated automatically when new configuration options are added.
The Synqly Embedded Helm chart automatically generates a mixture of command-line flags and environment variables based on the values in your values.yaml. Non-sensitive values, such as ports and hostnames, are passed as command-line flags. Secrets, such as database passwords and tokens, are set as environment variables read from Kubernetes Secrets, so they never appear in observability tool run arg logging.
If you use the Synqly Embedded Helm Chart, this page is only required for options that the chart doesn't yet expose through values.yaml. When setting these values, add the variable to embedded.environmentVariables in your values.yaml. For a secret, use valueFrom so the value stays in a Kubernetes Secret:
embedded:
environmentVariables:
- name: SYNQLY_<FLAG>
valueFrom:
secretKeyRef:
name: <SECRET_NAME>
key: <SECRET_KEY>When running Synqly Embedded outside of Helm, such as with Docker or Google Cloud Run, you set every option yourself. Each option below has a command-line flag and an equivalent environment variable. Use whichever makes the best sense for your setup. We recommend environment variables for secrets, as they are generally better protected from accidental logging or exposure.
- Each environment variable is the flag name in upper case, with
-replaced by_and aSYNQLY_prefix. For example,--db-passreadsSYNQLY_DB_PASS. The tables below show the few options that use a different name. - The order of precedence is CLI flags > environment variables > config file > default values. CLI flags will override any other setting, and CLI flags, environment variables, and config files will always be read instead of a default value.
- Synqly Embedded ignores an environment variable that is set but empty, and uses the next source instead.
- If a value can't be read, such as text for a number option, Synqly Embedded stops at startup with an error that names the variable. The error doesn't include the value to protect against logging sensitive values.
| Option | Details | Description |
|---|---|---|
| String Optional | Username of a default organization administrator. Only applied on the first Synqly Embedded run against a clean database |
| String Optional | Password of the default organization administrator. Only applied on the first Synqly Embedded run against a clean database |
| String Optional | Comma-separated email addresses to invite as organization administrators |
| String Optional | Display name of the Synqly Organization created on first startup, such as |
| String Required | ID of the Synqly Organization created on first startup. Use a lowercase, hyphenated string such as |
| Boolean Optional Default: | Disable printing the auto-generated organization token to the log when the organization is first created |
| String Required | Root token used to administer Synqly Embedded and create the first organization. Generate one with |
| String Required | Base64-encoded 32-byte key that signs organization and integration tokens. Generate one with |
| Option | Details | Description |
|---|---|---|
| List Optional | Allowed DNS, IPv4 and IPv6 host:port egress addresses and optional port (port defaults to 443 or 80; IPv6 addresses must be enclosed in '[]'). Required for any embedded integrations using non-public IP addresses such as an internal SIEM test instance |
| String Optional | Public base URL of the Synqly API, such as |
| String Optional | Base URL of the management UI, such as |
| Integer Optional Default: | Port the Synqly API listens on |
| Integer Optional Default: | Requests per minute allowed for the root token. Must be between 100 and 1000000 |
| String Optional | Path to a PEM TLS certificate file the Synqly API uses to serve HTTPS |
| String Optional | Path to the PEM private key file for |
| Option | Details | Description |
|---|---|---|
| String Optional Default: | Database host address |
| Duration Optional Default: | How long a session may sit idle inside an open transaction before the server terminates it, releasing the row locks it holds |
| String Optional Default: | Database name |
| String Optional | Database password |
| Integer Optional Default: | Database port |
| String Optional Default: | Database user |
Set SYNQLY_KMS_TYPE, then the options for that key management service.
| Option | Details | Description |
|---|---|---|
| String Optional | Azure Key Vault DNS suffix (e.g. vault.usgovcloudapi.net for Azure US Government); defaults to vault.azure.net |
| String Optional | Azure KMS Key name (bring your own key) |
| String Optional Default: | Azure rotation period in days [90d-2560d], 0d to disable rotation |
| String Optional | AWS access key id |
| String Optional | AWS KMS key (KMS alias, arn or id: bring your own key) |
| String Required if | AWS region of the KMS keys |
| String Optional | ARN of the IAM role used to access AWS KMS |
| String Optional Default: | AWS rotation period in days [90d-2560d], 0d to disable rotation |
| String Optional | AWS secret access key |
| String Optional | Path to a GCP service account key JSON file. Leave unset to use Application Default Credentials |
| String Optional | Full resource name of a pre-existing GCP KMS key to use instead of generated keys, such as |
| String Required if | GCP keyring name |
| String Required if | GCP project id |
| String Required if | GCP region name |
| String Optional Default: | GCP rotation period in days [1d-3650d], 0d to disable rotation |
| String Optional | Azure application client id |
| String Optional | Azure application client secret value |
| String Optional | Azure application tenant id |
| String Optional Default: | Key management service that holds the encryption keys: |
| String Required if | Azure key vault name |
| String Required if | HashiCorp Vault address, such as |
| String Required if | Path of the HashiCorp Vault transit secrets engine, such as |
| String Optional | Vault approle role id |
| String Optional | Vault approle secret id |
| String Optional | Vault access token |
Synqly Embedded uses SMTP to send invite and password reset emails.
| Option | Details | Description |
|---|---|---|
| String Optional Default: | Base URL of the management UI, used for links in invite and password reset emails |
| String Optional | SMTP password |
| String Optional | Reply-to address for invite and password reset emails |
| String Required if | SMTP server (e.g. smtp-mail.outlook.com:587) |
| String Optional | SMTP user |
Synqly Embedded only uses these options to assume an AWS role for integrations that use AWS role-based authentication. Safe to leave unset if you only support IAM User authentication to AWS hosted providers. To assume the role, Synqly Embedded uses the AWS SDK's default credentials, such as IRSA, EKS Pod Identity, or the standard AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY variables.
| Option | Details | Description |
|---|---|---|
| String Optional | ARN of the AWS role used for cross-account role assumption |
| String Optional | AWS region used for role assumption |
Synqly Embedded only uses these options for the Bridge feature. Safe to leave unset if you don't use Bridge.
| Option | Details | Description |
|---|---|---|
| String Optional | Path to the Bridge account NKey seed file |
| String Optional | Path to the Bridge credentials file |
| List Optional | Synqly bridge server address (e.g. tls://bridge.synqly.com:4222) |
| Option | Details | Description |
|---|---|---|
| String Optional | JSON object of feature flag overrides |
| Integer Optional Default: | Log level: |
| String Optional Default: | Path to the Synqly license file. Only required if you need the embedded container to run for more than 90 days without a version upgrade. Reach out to Synqly Support for more details |