Audit and document the shipped D.1–D.4 proxy/worker env surface: dial target vs server bind, assemble vs library timeouts, turn-buffer TTL, enqueue URL/token/host/port, and Redis ownership.
Milestone 3.5.D.5 — Config, Feature Flags, and Env Vars
Status: Completed
Goal: Track D — Proxy Integration
Phase: 3.5 — Extraction & Context Assembly
Estimated effort: 1 day
Track: Track D — Proxy Integration
Depends on: Milestones 3.5.D.1–3.5.D.4
Outcome
Consolidation pass only: document the actual env vars shipped in D.1–D.4, correct stale planning-sketch names, and record the D.4 security posture for enqueue /health and Bearer enablement. No new functional knobs.
Canonical registry: ENVIRONMENT_VARIABLES.md (§9 Proxy, §11 Worker).
Shipped env surface (D.1–D.4)
Proxy (services/proxy)
| Variable | Required | Default | Notes |
|---|---|---|---|
IBEX_CONTEXT_ENABLED | No (3.5.D.2) | false | Master switch; false = Phase 2 directive-only |
IBEX_CONTEXT_GRPC_TARGET | No (3.5.D.1) | 127.0.0.1:9092 | Dial target for ContextAssemblyService (≠ server bind IBEX_CONTEXT_GRPC_ADDR) |
IBEX_CONTEXT_ASSEMBLE_TIMEOUT | No (3.5.D.1) | 45ms | Per-call Assemble budget on the proxy client (≠ library IBEX_CONTEXT_TIMEOUT) |
IBEX_CONTEXT_EMBED_METADATA | No (3.5.D.3) | false | Embed top-level ibex JSON via IBEXMetadataStage |
IBEX_EXTRACTION_TURNS_TTL | No (3.5.D.4) | same as idle timeout | Turn-buffer Redis TTL on shared REDIS_URL |
IBEX_WORKER_ENQUEUE_BASE_URL | No (3.5.D.4) | (empty) | Worker enqueue origin; empty disables client |
IBEX_WORKER_ENQUEUE_API_TOKEN | Conditional (3.5.D.4) | (empty) | Shared Bearer; empty disables client; no non-empty default |
Worker (services/worker)
| Variable | Required | Default | Notes |
|---|---|---|---|
IBEX_WORKER_ENQUEUE_HOST | No (3.5.D.4) | 127.0.0.1 | Bind host; compose uses 0.0.0.0 |
IBEX_WORKER_ENQUEUE_PORT | No (3.5.D.4) | 8007 | Enqueue Starlette port |
IBEX_WORKER_ENQUEUE_API_TOKEN | Yes* (3.5.D.4) | (none) | Required to start enqueue HTTP; missing → server not started |
IBEX_EXTRACTION_REDIS_URL | No | falls back to REDIS_URL | Worker Redis base alias; proxy does not read this |
Related names (not proxy dial/client knobs)
| Variable | Owner | Role |
|---|---|---|
IBEX_CONTEXT_GRPC_ADDR | Context server | Bind address |
IBEX_CONTEXT_TIMEOUT | Context library/server | Outer retrieval deadline |
Planning sketches that called ADDR a “target” and TIMEOUT a “client-side deadline” were superseded intentionally in D.1; D.5 documents the rename rather than inventing new names.
Security nits (D.4 follow-up)
GET /healthon the enqueue port — intentionally unauthenticated (liveness only; no secrets). MutatingPOST /internal/extraction/enqueuerequires Bearer. Matches embedder probe posture.- Enqueue Bearer default — already fail-closed:
None/blank default; enqueue HTTP does not start without an explicit token.
Success signals
- Env vars follow proxy/worker registry convention (
Required/Default/Notes/ security annotations) - Documentation updated (
ENVIRONMENT_VARIABLES.md, this milestone, worker README) - Repo guards / CI checks still pass
Prerequisites
- Milestones 3.5.D.1–3.5.D.4
Last updated on