v3.x.x (Current)

INFO
This documentation is up to date as of version 3.x.x.

All cellar configuration is handled through API settings, and such API configuration handled through environment variables.

You must configure both the application settings as well as one datastore and one cryptography engine. See below for details.

App

Name	Type	Min Version	Description	Default
`APP_CLIENT_ADDRESS`	string		Specifies the fully qualified domain name where Cellar will be hosted.	`http://127.0.0.1:8080`
`APP_BIND_ADDRESS`	string		Specifies the address on which the Cellar API will listen for requests.	`127.0.0.1:8080`
`APP_MAX_FILE_SIZE_MB`	integer	v3.2.0	Specifies the maximum file size in megabytes for v2 file uploads. See Security Best Practices for details.	`8`
`LOGGING_LEVEL`	string		Specifies the minimum level of logs that Cellar will output. Must be one of the following values: `trace`, `debug`, `info`, `warning`, `error`, `fatal`, `panic`.	`info`
`LOGGING_ENABLE_STDOUT`	boolean		Specifies whether Cellar should output logs to standard out.	`true`
`LOGGING_FORMAT`	string	v3.1.0	Specifies the format in which Cellar will output logs. Must be either `json` or `text`	`text`
`LOGGING_DIRECTORY` (optional)	string		Specifies a directory where Cellar should write logs. Cellar will create the directory if it does not exist.

Datastore

All datastore settings are contained in a “datastore” section

NOTE
Since there is currently only one datastore, it is enabled by default.

Redis

Name	Type	Min Version	Description	Default
`DATASTORE_REDIS_HOST`	string	v3.0.0	Specifies the host of the Redis database.	`localhost`
`DATASTORE_REDIS_PORT`	integer	v3.0.0	Specifies the host one which to connect to the Redis database.	`6379`
`DATASTORE_REDIS_PASSWORD` (optional)	string	v3.0.0	Specifies the password for the Redis database.
`DATASTORE_REDIS_DB`	integer	v3.0.0	Specifies which database to connect to on the Redis instance.	`0`

Cryptography

All cryptography settings are contained in a “cryptography” section. Each of them contains an “enabled” option. It must be set to true for that cryptography engine to be enabled. However, only one engine can be enabled at a time.

AWS KMS

Name	Type	Min Version	Description	Default
`CRYPTOGRAPHY_AWS_ENABLED`	boolean	v3.0.0	Enables AWS as a cryptography engine	`false`
`CRYPTOGRAPHY_AWS_REGION`	string	v3.0.0	Specifies the AWS region where your kms key is located.
`CRYPTOGRAPHY_AWS_KMS_KEY_ID`	string	v3.0.0	Specifies the ID of the KMS key from AWS to use for encrypting and decrypting.

Vault

Name	Type	Min Version	Description	Default
`CRYPTOGRAPHY_VAULT_ENABLED`	boolean	v3.0.0	Enables vault as a cryptography engine	`false`
`CRYPTOGRAPHY_VAULT_ADDRESS`	string	v3.0.0	Specifies the full address to the Vault instance.	`http://localhost:8200`
`CRYPTOGRAPHY_VAULT_ENCRYPTION_TOKEN_NAME`	string	v3.0.0	Specifies the name of the encryption key from the Vault Transit Secrets ENgine to use for encrypting and decrypting.
`CRYPTOGRAPHY_VAULT_AUTH_MOUNT_PATH`	string	v3.0.0	Specifies the mount path of the auth engine you whish to use to authenticate from Cellar API to vault (see below for more information)

Cellar supports multiple methods of authentication between your api and vault. You must configure exactly one of them.

For more information on how each of these auth methods work, please refer to the Vault Auth Methods documentation.

AppRole Auth

Name	Type	Min Version	Description	Default
`CRYPTOGRAPHY_VAULT_ROLE_ID`	string	v3.0.0	Specifies the `role_id` to use for authenticating to Vault with AppRole authentication.
`CRYPTOGRAPHY_VAULT_SECRET_ID`	string	v3.0.0	Specifies the `secret_id` to use for authenticating to Vault with AppRole authentication.

AWS IAM Auth

Name	Type	Min Version	Description	Default
`CRYPTOGRAPHY_VAULT_AUTH_AWSIAM_ROLE`	string	v3.0.0	Specifies the AWS IAM `role` to use for authenticating to vault with AWS IAM authentication.

GCP IAM Auth

Name	Type	Min Version	Description	Default
`CRYPTOGRAPHY_VAULT_AUTH_GCPIAM_ROLE`	string	v3.0.0	Specifies the GCP IAM `role` to use for authenticating to vault with GCP IAM authentication.

Kubernetes Auth

Name	Type	Min Version	Description	Default
`CRYPTOGRAPHY_VAULT_AUTH_KUBERNETES_ROLE`	string	v3.0.0	Specifies the K8s `role` to use for authenticating to vault with K8s authentication.