Configuration

Keyraft can be configured via command-line flags and environment variables.

Command-Line Flags

keyrafted start \
  --data-dir /var/lib/keyraft \     # Data directory
  --listen :7200 \                   # Listen address
  --master-key "key-value" \         # Master key (or use env var)
  --master-key-file /path/to/key     # Master key file path

Init Command

keyrafted init --data-dir ./data

Environment Variables

Variable	Description
KEYRAFT_MASTER_KEY	Master encryption key for secrets (32+ bytes recommended)
KEYRAFT_DATA_DIR	Data directory path (overrides --data-dir flag)
KEYRAFT_LISTEN	HTTP listen address (overrides --listen flag)

Environment variables take precedence over command-line flags.

Defaults

Setting	Default
Listen address	:7200
Data directory	./data
API prefix	/v1

Example: Production Start

export KEYRAFT_MASTER_KEY=$(cat /run/secrets/keyraft-master-key)
export KEYRAFT_DATA_DIR=/var/lib/keyraft
export KEYRAFT_LISTEN=:7200

keyrafted start

Metrics

Prometheus metrics are available at /v1/metrics (no authentication required).

Health check at /v1/health (no authentication required).