Configuration reference
Environment variables, ports, volumes and roles for the cluster manager, workers and updater agent.
Every setting each component reads, with its default. Values marked required cause the process to exit at startup if unset.
Cluster manager
The control plane. Listens on PORT behind the OpenResty edge, which owns ports 80 and
443.
Core
Prop
Type
In the container, VEIL_INSTALL_DIR is /srv/cluster-manager, backed by the cm-state
volume.
Authentication
Prop
Type
Licensing and registry
Prop
Type
Releases and storage
Prop
Type
Edge (OpenResty)
Prop
Type
Docker provisioning and self-update
Prop
Type
Worker (Local API)
Prop
Type
Cluster mode
Prop
Type
Set VEIL_MAX_BROWSERS on every cluster worker
The default of 0 means unlimited, so a worker will keep accepting launches until it
runs out of memory. Set it to what the host can actually hold, and the load balancer
will route overflow to another worker instead of degrading this one.
Container and display
Prop
Type
Updater agent
A sidecar that pulls and recreates a container on request, because a container cannot recreate itself.
Prop
Type
Ports
| Port | Component | Exposure |
|---|---|---|
| 80 | OpenResty edge | Public — ACME challenges, or the origin in Cloudflare Flexible mode |
| 443 | OpenResty edge | Public — console, wss://…/launch, release origin |
| 4180 | Cluster manager | Internal, behind the edge |
| 3000 | Worker | Internal; 38923 in the published container image |
| 3999 | Updater agent | Internal only — never expose it |
Volumes
| Volume | Mount | Contents |
|---|---|---|
cm-state | /srv/cluster-manager | Database, auth secret, setup token, TLS and ACME material, logs |
cm-webroot | /var/www/release | Published browser builds and profile bundles |
veil-install | /var/veil/install | Worker's browsers and profiles trees |
Workers also need at least 1 GB of /dev/shm and a writable /tmp, and must run
privileged (or with SYS_ADMIN plus the seccomp profile) for the Chromium sandbox.
Console roles
| Role | Can |
|---|---|
admin | Everything below, plus manage users, apply config reloads that touch the live load balancer, and delete releases |
operator | Edit the cluster and fleet, publish and activate releases, preview renders, manage uploads |
viewer | Read-only dashboards |
The first admin is created in the first-run wizard from a one-time setup token. Add more users under Users in the console.
Next steps
- Installation — where these values get set.
- Troubleshooting — what a misconfiguration looks like.
- Backup & restore — which of these paths to protect.