Configuration

Settings are environment variables on the services; the Helm chart exposes the ones a customer sets as values and derives the rest. Defaults below are the chart’s.

Keys

Setting	Format	Used for
VAULT_KEY	64 hex characters	Token derivation and encryption of vault values. Without it, tokens are ephemeral.
FPE_KEY	32, 48 or 64 hex characters	Format-preserving mode
AUDIT_ENC_KEY	64 hex characters	Encryption of matched text in the audit store
GATEWAY_ASSERTION_KEY	64 hex characters	Signed assertions from the gateway to the main service
BOOTSTRAP_ADMIN_SHA256	SHA-256 of the bootstrap key	One-time creation of the first administrator

Keys live in Kubernetes secrets (salus-keys, salus-gateway-auth), never in Helm values. Rotating the vault or audit key does not re-encrypt existing rows.

Redaction

Setting	Default	Meaning
REDACTION_MODE	vault	vault or fpe. A caller can override per text request.
FPE_TWEAK_MODE	per_document	per_document or deterministic ciphertexts in FPE mode
VAULT_TENANT	default	Namespace prefix for vault sessions

Detection

Setting	Default	Meaning
VERIFIER_DROP_SCOPE	all	Which model spans the verifier may drop: all, normaliser (only spans the normaliser touched) or none (score only)
role.enabled	true	Run the role model for dates of birth
ROLE_THRESHOLD	0.3	Role model confidence threshold
TYPE_JUDGE_ENABLED	false	Let the role model arbitrate person versus organisation
ocr.enabled	false	Deploy the OCR service and engine. ocr.engine.variant is cuda or cpu; ocr.maxPages defaults to 20.
DETECT_ALLOW_DEGRADED	false	Development only. Never set in production; the chart does not expose it.

Limits and timing

Setting	Default	Meaning
MAX_BODY_BYTES	16 MiB (33 MiB with OCR)	Request body limit at the gateway and the main service
REQ_TIMEOUT_MS	10000	Budget per downstream detection call; one retry on transport errors, none on timeout
GATEWAY_UPSTREAM_TIMEOUT_MS	30000 (OCR budget + 10 s with OCR)	How long the gateway waits for the engine
GATEWAY_UNAUTH_RATE_PER_MINUTE	60	Unauthenticated requests per source address
GATEWAY_ADMIN_RATE_PER_MINUTE	30	Administration calls per key
GATEWAY_AUTH_FAILURE_THRESHOLD / GATEWAY_AUTH_BLOCK_SECONDS	10 / 900	Failed authentications in five minutes before a source is blocked, and for how long
Per tenant rate_per_minute, burst, max_concurrency	30 / 5 / 2	Set on the tenant through the admin API
CACHE_CAPACITY / REDIS_CACHE_TTL_SECS	128 / 900	Detection cache
REDACTION_LEDGER_CAPACITY / REDIS_LEDGER_TTL_SECS	128 / 3600	FPE recovery ledger

Audit

Setting	Default	Meaning
AUDIT_ENABLED	true	Write detection runs and spans to the audit store
AUDIT_ENCRYPT_TEXT	true	Store matched text encrypted under the audit key; a hash is always stored
AUDIT_RETENTION_DAYS	30	Purge detection runs older than this, hourly. 0 keeps everything.
AUDIT_STORAGE_MODE	database	database or s3 (with the AUDIT_S3_* settings)

Logging and metrics

Setting	Default	Meaning
LOG_FORMAT / RUST_LOG	json / info	Structured logs on standard output
METRICS_ENABLED / METRICS_PORT	true / 9090	OpenMetrics endpoint per service
TRUSTED_PROXY_CIDRS	empty	Proxies whose forwarded-for header is trusted for the source address
CONSOLE_PUBLIC_ORIGIN	the route	Must be an HTTPS origin; used for console cookies and identity-provider redirects