Docker Configuration

Docker deployments use two configuration layers:

Layer	Location	Changed via
Bootstrap	.env next to docker-compose.yml	Edit .env, then restart the stack
Runtime	HSM-stored data objects	Key Manager UI

Bootstrap Configuration

The bootstrap configuration are the settings that must exist so that the KMS can start and connect to its Base Partition. These settings are stored in the .env file and thus available in a sealed state. They are accessed by multiple services (Key Manager UI, TSB, ...).

Modifying .env File

The installer creates the initial .env and regenerates it on every rerun. The .env file is created based on user input in the installer and (possibly) based on the previous .env file (keeping existing, unmodified settings). The installer backs up the previous file as .env.bak.<timestamp>.

While it is possible to edit this file manually, we recommend to only modify it through the installer script (simply re-run the script).

warning

.env holds HSM, database, and registry credentials in clear text and is created with mode 0600. Securely back it up, but do not commit it to version control. If you lose the .env file, you need to re-install the KMS.

Sample .env

# =============================================================================
#  Securosys Key Manager - deployment configuration
# =============================================================================
#  Generated by install.sh 1.1.0 on 2026-08-05T12:31:26Z.
#
#  REGENERATED ON EVERY RE-RUN of install.sh. Values are read back first, so
#  edits you make here survive; the comments, grouping and ordering below do
#  not. The previous file is kept alongside as .env.bak.<timestamp>.
#
#  Holds HSM, database and registry credentials in clear text. Mode 0600 -
#  do not commit it, and copy it (not just the install dir) when migrating.
#
#  Contents
#    1  Deployment                     6  Dashboard TLS (envoy)
#    2  Images and registry            7  Optional services and features
#    3  Service ports                  8  KMIP server
#    4  Shared database                9  Auth, seal and internal wiring
#    5  TSB
# =============================================================================


# -----------------------------------------------------------------------------
# 1  Deployment
# -----------------------------------------------------------------------------
ENV="production"
LOG_LEVEL="info"
# Indicator this installation is air-gapped (offline).
OFFLINE="false"


# -----------------------------------------------------------------------------
# 2  Images and registry
# -----------------------------------------------------------------------------
KMS_IMAGE_REGISTRY="securosys.jfrog.io/kms/kms"
KMS_IMAGE_TAG="1.1.0"
KMS_IMAGE_PLATFORM="linux/amd64"

KMIP_IMAGE_REGISTRY="securosys.jfrog.io/docker/securosys-kmip"
KMIP_IMAGE_TAG="1.0.0"

REGISTRY_DEFAULT_USER="external.reader"
REGISTRY_DEFAULT_PASS="kw...jU"


# -----------------------------------------------------------------------------
# 3  Service ports
# -----------------------------------------------------------------------------
# Published on the host.
PORT_HTTPS="8443"
PORT_GATEWAY="8080"


# -----------------------------------------------------------------------------
# 4  Shared database
# -----------------------------------------------------------------------------
# One PostgreSQL instance serves on-prem TSB and the KMIP server. This is the
# neutral 'postgres' superuser; the per-application users and databases
# (securosys, kmip) are created by db-init.sh and configured in sections 5
# and 8, so adding a consumer later does not re-initialise the data volume.
DB_PASSWORD="HR...fK"


# -----------------------------------------------------------------------------
# 5  TSB (Transaction Security Broker)
# -----------------------------------------------------------------------------
# cloud = Securosys CloudHSM / TSBaaS; onprem = TSB containers, one
# instance per HSM partition (see TSB_INSTANCE_COUNT).
TSB_DEPLOYMENT_MODE="onprem"
TSB_API_URL="https://tsb-rest-api:8080"
TSB_ACCESS_TOKEN=""
TSB_VERIFY_TLS="true"
TSB_CA_CERT_PATH="/app/tsb-ca.crt"
TSB_TIMEOUT="120"
TSB_INSTANCE_COUNT="1"
TSB_LOG_QUIET="true"

# --- 5.1  TSB #1: HSM partition and database ---------------------------------
TSB_ONPREM_HOST_PORT="8090"
TSB_HSM_HOST="ch01-api.cloudshsm.com,ch02-api.cloudshsm.com,us02-api.cloudshsm.com,sg01-api.cloudshsm.com"
TSB_HSM_JCE_PORT="2300"
TSB_HSM_USERNAME="AN...IL"
TSB_HSM_SETUP_PASSWORD="PS...us"
TSB_HSM_ENCRYPTION_PASSWORD="pq...fF"
# Securosys CloudHSM (HSMaaS) subscriptions only; empty for on-prem Primus.
TSB_HSM_PROXY_USERNAME="el...jd"
TSB_HSM_PROXY_PASSWORD="bU...5v"

TSB_DB_NAME="securosys_rest_api"
TSB_DB_USERNAME="securosys"
TSB_DB_PASSWORD="cX...Lm"

# --- 5.2  TSB #1: TLS and client authentication ------------------------------
TSB_TLS_MODE="self-signed"
TSB_TLS_HOSTNAME="localhost"
TSB_TLS_PROVIDED_CERT=""
TSB_TLS_PROVIDED_KEY=""
TSB_CLIENT_AUTH="true"
# HSM key label of the client-auth issuing CA.
TSB_CLIENT_CA_KEY_LABEL="kms.tsb.user.ca"

# --- 5.3  TSB HSM key labels -------------------------------------------------
TSB_APPROVER_BACKUP_KEY_NAME="approver-mgmt-backup-key-rsa-wrapping"
TSB_ATTESTATION_KEY_NAME="attestation-key"
TSB_TIMESTAMP_KEY_NAME="timestamp-key"


# -----------------------------------------------------------------------------
# 6  Dashboard TLS (envoy)
# -----------------------------------------------------------------------------
# Terminates TLS for the dashboard and API on PORT_HTTPS (section 3).
ENVOY_TLS_MODE="self-signed"
ENVOY_TLS_HOSTNAME="localhost"
ENVOY_TLS_CERT_FILE="/etc/envoy/tls/server.crt"
ENVOY_TLS_KEY_FILE="/etc/envoy/tls/server.key"
# Custom subjectAltName list, set by 'keymanager tls-rotate --san ...'.
ENVOY_TLS_SAN=""
ENVOY_TLS_PROVIDED_CERT=""
ENVOY_TLS_PROVIDED_KEY=""
# Set false to bypass the Go supervisor and run plain nginx
# (Podman / non-Docker fallback).
DASHBOARD_TLS_AGENT="true"


# -----------------------------------------------------------------------------
# 7  Optional services and features
# -----------------------------------------------------------------------------
# Core services (auth, keycore, dashboard) are always deployed. Toggle these
# with 'keymanager services' rather than by hand - it rewrites
# COMPOSE_PROFILES to match and restarts what needs restarting.
DEPLOY_MCP="false"
DEPLOY_DISCOVERY="false"
DEPLOY_COMPLIANCE="false"
DEPLOY_KMIP="true"
# Derived from the DEPLOY_* flags above - which compose profiles come up.
COMPOSE_PROFILES="kmip,kmip-server"
# UI-only gates; no separate service behind them.
ALERTS_ENABLED="true"
CRYPTO_AGILITY_ENABLED="false"


# -----------------------------------------------------------------------------
# 8  KMIP server
# -----------------------------------------------------------------------------
KMIP_DB_NAME="kmip"
KMIP_DB_USERNAME="kmip"
KMIP_DB_PASSWORD="d1...M6"
# true|false (empty -> prompt). Store primus.password BLINDED
# (blinded-aes:) in kmipserver.properties; needs java + primus-tools.jar.
KMIP_BLIND_PERMANENT_SECRET="true"
PRIMUS_TOOLS_ZIP_URL="https://securosys.jfrog.io/artifactory/jce-provider/PrimusTools_JCE-v2.5.3.zip"
# Explicit primus-tools.jar path, air-gapped (offline).
PRIMUS_TOOLS_JAR=""


# -----------------------------------------------------------------------------
# 9  Auth, seal and internal wiring
# -----------------------------------------------------------------------------
AUTH_PROVIDER="hsm_auth"
CORS_ALLOWED_ORIGINS="http://localhost:5173"

# Sealed-state material. The wrapping key lives in the HSM.
SEAL_WRAPPER_KEY_LABEL="kms.seal.wrapper"
SEAL_ENVELOPE_PATH="/app/seal.enc"
APP_SKENC_PATH="/app/sk-app.enc"
AUDIT_LOG_DIR="/app/logs"

# Shared secret the services register with the auth broker on start-up.
INTERNAL_REGISTER_TOKEN="Cn...4M"
INTERNAL_AUTH_URL="http://auth:8001"

Runtime Configuration

Most configuration can be done inside the Key Manager web interface:

• Session and JWT settings
• Login and MFA settings
• OAuth provider parameters
• SMTP and notification settings
• Syslog settings
• Audit log settings
• Module configuration such as KMIP or MCP-backed features

See the Configuration Guide for detailed explanations of these settings. In order to change these settings, the Key Manager must be unsealed and you need to hold the admin role.

Some runtime settings can also be seeded from environment variables in .env, such as JWT_*, SESSION_TIMEOUT_MINUTES, TOTP_*, OAUTH_*, LLM_*, MCP_SERVER_URL. However, they only provide the initial values for the very first start. Subsequent restarts use the runtime config stored in HSM data objects.