Home › Docs › Configuration
Configuration
Each setting is a flag of jwks-bridge serve and an environment variable. Flags win over the environment.
Listeners
| Variable | Flag | Default | Description |
|---|
JWKSB_PUBLIC_ADDR | --public-addr | :8080 | Public JWKS and health. Empty disables it. |
JWKSB_PRIVATE_ADDR | --private-addr | :8443 | Private keyset listener. Empty disables it. |
JWKSB_ADMIN_ADDR | --admin-addr | :9090 | Metrics and probes. |
Private listener
| Variable | Flag | Description |
|---|
JWKSB_TLS_CERT, JWKSB_TLS_KEY | --tls-cert, --tls-key | Server certificate and key. Required. Reloaded when the files change. |
JWKSB_CLIENT_CA | --client-ca | CA bundle; enables mTLS client authentication. |
JWKSB_ALLOWED_CLIENT_SANS | --allowed-client-sans | Comma-separated SAN or CN allowlist. Empty accepts any certificate from the CA. |
JWKSB_BASIC_USER | --basic-user | Basic auth user. |
JWKSB_BASIC_PASSWORD_FILE | --basic-password-file | File holding the Basic auth password. |
JWKSB_PRIVATE_INSECURE_PLAINTEXT | --private-insecure-plaintext | true serves the keyset without TLS. Local development only. |
At least one of mTLS or Basic auth is required. When both are set, either one admits the caller.
Source and keysets
| Variable | Flag | Default | Description |
|---|
JWKSB_SOURCE | --source | vault | vault or file. |
JWKSB_KEYSETS | --keysets | default=secret/jwks-bridge/default | Comma-separated name=path pairs. |
JWKSB_FILE_DIR | --file-dir | | Base directory for relative paths with the file source. |
Vault
| Variable | Flag | Default | Description |
|---|
JWKSB_VAULT_AUTH | --vault-auth | token | token, kubernetes or approle. |
JWKSB_VAULT_ROLE | --vault-role | | Kubernetes auth role. |
JWKSB_VAULT_AUTH_MOUNT | --vault-auth-mount | method name | Auth mount path. |
JWKSB_VAULT_K8S_TOKEN_PATH | --vault-k8s-token-path | projected SA token | Service account token file. |
JWKSB_VAULT_APPROLE_ROLE_ID | --vault-approle-role-id | | AppRole role id. |
JWKSB_VAULT_APPROLE_SECRET_ID_FILE | --vault-approle-secret-id-file | | File holding the AppRole secret id. |
The Vault client also reads VAULT_ADDR, VAULT_TOKEN, VAULT_CACERT, VAULT_NAMESPACE and the other standard variables.
Timing
| Variable | Flag | Default | Description |
|---|
JWKSB_REFRESH_INTERVAL | --refresh-interval | 30s | Source poll interval, ±10 % jitter. |
JWKSB_MAX_STALE | --max-stale | 1h | /readyz fails when the source has not confirmed a keyset for longer. |
JWKSB_JWKS_MAX_AGE | --jwks-max-age | 300s | Cache-Control: max-age of the public JWKS. |
JWKSB_MIN_STAGE_DURATION | --min-stage-duration | 10m | Staging guard; at least twice the refresh interval. |
Logging and tracing
JWKSB_LOG_LEVEL (debug, info, warn, error) and JWKSB_LOG_FORMAT (json, text). Tracing uses the OTEL_* variables listed in Metrics and tracing.