Configuration¶

sluice serve --config <file> reads the server config, a YAML file.

An environment variable overrides a key: SLUICE_REST__LISTEN sets rest.listen. No variable sets approval.webhooks. Server config explains secret references.

A key with an empty default is a string. Write a time like its default: 30s, 5m.

Key	Default	Meaning
`rest.listen`	`:8080`	REST API address.
`rest.tls.certFile`		Certificate file. Needs `keyFile`.
`rest.tls.keyFile`		Key file. Needs `certFile`.
`rest.tls.clientCA`		CA file. Clients must send a certificate.
`rest.tls.clientAuth`		Only `require_and_verify`. Needs `clientCA`.
`rest.maxBodyBytes`	`1048576`	Largest request body.
`rest.requestTimeout`	`30s`	Time limit of a request.
`mcp.enabled`	`false`	Start MCP in `sluice serve`.
`mcp.transport`	`stdio`	`stdio` or `streamable_http`.
`mcp.listen`		Address for `streamable_http`. Required for it.
`mcp.tls.certFile`		Certificate file. Needs `keyFile`.
`mcp.tls.keyFile`		Key file. Needs `certFile`.
`mcp.tls.clientCA`		CA file. Clients must send a certificate.
`mcp.tls.clientAuth`		Only `require_and_verify`. Needs `clientCA`.
`mcp.sessionIdleMax`	`30m`	HTTP idle timeout.
`mcp.tokenRef`		Secret reference: JWT for `stdio`.
`mcp.apiKeyRef`		Secret reference: API key for `stdio`.
`mcp.allowAnonymous`	`false`	Accept clients without a credential.
`admin.enabled`	`false`	Start the admin API.
`admin.listen`	`:9091`	Admin API address.
`admin.token`		Bearer token, as plain text or a secret reference. Empty means no check.
`admin.tls.certFile`		Certificate file. Needs `keyFile`.
`admin.tls.keyFile`		Key file. Needs `certFile`.
`admin.tls.clientCA`		CA file. Clients must send a certificate.
`admin.tls.clientAuth`		Only `require_and_verify`. Needs `clientCA`.
`duckdb.memoryLimit`	`4GB`	DuckDB `memory_limit`.
`duckdb.threads`	`0`	DuckDB `threads`. `0` means the DuckDB default.
`duckdb.tempDir`		DuckDB `temp_directory`.
`duckdb.maxOpen`	`4`	Maximum open connections.
`duckdb.maxIdle`	`2`	Maximum idle connections.
`duckdb.connMaxIdle`	`5m`	Idle time before a connection closes.
`datasources.failFast`	`true`	Stop at start when a data source fails.
`policies.directory`	`./policies.d`	The policy directory.
`policies.reload`	`true`	Reload when a file changes.
`policies.engine`	`yaml`	`yaml`, `opa` or `composite`.
`policies.composite.members`	`[yaml]`	`yaml`, `opa`, `rebac`.
`policies.opa.moduleDir`		Directory of the `.rego` files.
`policies.opa.query`	`data.sluice.main`	Rego query for the decision.
`policies.rebac.cacheTtl`	`10s`	Lifetime of a cached check.
`policies.rebac.cacheSize`	`10000`	Maximum cached checks.
`audit.file.path`		Audit log directory. Empty means `sluice-audit` in the temp directory.
`audit.file.rotateDaily`	`false`	New file each UTC day. Always on when `rotateSizeMB` is `0`.
`audit.file.rotateSizeMB`	`0`	New file after this size.
`audit.file.genesis`		Secret reference: genesis.
`audit.syslog.network`	`udp`	`udp`, `tcp`, `unix` or `unixgram`.
`audit.syslog.address`		Required. `host:port` or socket path.
`audit.syslog.facility`	`local0`	`kern`, `user`, `daemon`, `auth`, `syslog`, `local0` to `local7`.
`audit.syslog.tag`	`sluice`	Syslog app name.
`audit.s3.endpoint`	`s3.amazonaws.com`	S3 host.
`audit.s3.bucket`		Required.
`audit.s3.prefix`	`audit/`	Object key prefix.
`audit.s3.region`		S3 region.
`audit.s3.insecure`	`false`	Use HTTP, not HTTPS.
`audit.s3.forcePathStyle`	`false`	Path-style URLs.
`audit.s3.objectLock`		`governance` or `compliance`. Needs `retentionDays`.
`audit.s3.retentionDays`	`0`	Lock time in days.
`audit.s3.credentialsRef`		Secret reference: JSON with `accessKeyId`, `secretAccessKey`.
`audit.s3.uploadInterval`	`30s`	Longest time between uploads.
`audit.s3.uploadBytes`	`1048576`	Batch size that starts an upload.
`audit.s3.maxBufferBytes`	`8388608`	Buffer size. More records are dropped.
`audit.failClosed`	`true`	Refuse queries when the audit log fails.
`audit.sqlSampleBytes`	`2048`	SQL bytes in an audit record.
`audit.chainKeyRef`		Secret reference: key of the hash chain, 32 bytes or more. Empty means a chain without a key.
`logging.level`	`info`	`debug`, `info`, `warn` or `error`.
`logging.format`	`json`	`json` or `text`.
`logging.maxErrorBytes`	`4096`	Cut logged errors at this size. `0` means no cut.
`tracing.enabled`	`false`	Send OpenTelemetry traces.
`tracing.endpoint`		OTLP `host:port`. Required when enabled.
`tracing.protocol`	`grpc`	`grpc` or `http`.
`tracing.insecure`	`false`	Send without TLS.
`tracing.sampleRatio`	`1`	Share of traces sent, 0 to 1.
`identity.apiKeyPepper`		Secret reference: pepper for API key hashes.
`limits.maxRows`	`100000`	Row limit when the request sets none.
`limits.maxRowsCeiling`	`100000`	Highest row limit a request can set.
`limits.maxResultBytes`	`67108864`	Size limit of a result in bytes. Sluice cuts the result before the row that crosses it. `0` means no limit.
`limits.maxSqlBytes`	`1048576`	Largest SQL text.
`limits.queryTimeout`	`30s`	Timeout when the request sets none.
`limits.maxQueryTimeout`	`30s`	Longest timeout a request can set.
`limits.maxConcurrent`	`100`	Queries running at one time.
`limits.disableCrossCatalog`	`false`	Reject queries that read several catalogs.
`limits.globalRps`	`500`	Requests per second of all clients, REST queries and MCP over HTTP together. `0` means no limit.
`limits.globalBurst`	`1000`	Burst for `globalRps`.
`limits.perIpRps`	`0`	Requests per second per client IP, counted like `globalRps`. `0` means no limit.
`limits.perIpBurst`	`0`	Burst for `perIpRps`.
`limits.perIpMaxBuckets`	`10000`	Maximum client IPs tracked.
`limits.defaultSubjectRps`	`0`	Requests per second per subject without `rateLimit`. `0` means no limit.
`limits.defaultSubjectBurst`	`0`	Burst for `defaultSubjectRps`.
`cache.rewrite.enabled`	`false`	Cache decisions and rewritten SQL.
`cache.rewrite.size`	`4096`	Maximum cached entries.
`cache.rewrite.ttl`	`1m`	Lifetime of an entry.
`approval.publicBaseUrl`		Base URL of the accept and reject links.
`approval.webhooks[].url`		Receiver of approval requests.
`approval.webhooks[].headersRef`		Secret reference: JSON object of headers.
`approval.webhooks[].timeout`	`10s`	Timeout of one delivery. At most 10s.
`approval.syncWait`	`20s`	Wait for a decision before `ERR_APPROVAL_PENDING`. At most `rest.requestTimeout` minus 2 s.
`approval.requestTtl`	`15m`	Lifetime of a pending approval.
`approval.grantTtl`	`5m`	Lifetime of a grant.
`approval.maxPending`	`1000`	Maximum pending approvals.
`approval.sqlSampleBytes`	`2048`	SQL bytes in the webhook.
`approval.persist`	`false`	Keep approvals over a restart.
`approval.stateDir`	`./state`	Directory of the approval store.
`budget.enabled`	`false`	Turn on budgets.
`budget.stateDir`	`./state`	Directory of the budget store.
`budget.flushInterval`	`5s`	Time between writes to the store.
`budget.failClosed`	`true`	Stop at start when the store cannot open.
`budget.retentionDays`	`35`	Days of usage kept.
`sample.maxRows`	`10000`	Most rows of one sample.
`sample.minGroupRows`	`10`	Smallest group a stratified sample keeps.
`synthetic.dir`	`./synthetic`	Folder of the synthetic snapshots and reports. Sluice reads it. Builds write to it.
`synthetic.maxRatio`	`0.2`	Largest share of source rows a synthetic table may have. A build over it fails.