Configuration

Keel's hosts (API, Worker, Scheduler, MCP) read standard .NET configuration: appsettings.json, environment variables, user secrets in Development, and the Aspire AppHost's injected values. In environment variables, : becomes __ (Keel:Llm:ApiKey → Keel__Llm__ApiKey).

Connection strings

Name	Used by	Notes
ConnectionStrings:keel	API, Worker, Scheduler, MCP	The runtime role keel_app — not the owner, no BYPASSRLS, so row-level security applies
ConnectionStrings:keel-admin	API (migrate, start-up migration)	The owner / migration role; must be superuser (dev) or have BYPASSRLS (production) because platform security-definer functions run as it
ConnectionStrings:redis	API, MCP	Serving cache and rate-limit windows; optional (in-memory fallback, and an outage only means cache misses)

Other keys

Key	Default	Notes
Keel:Web:Origin	—	The web app's origin, for CORS
Keel:AccessPolicies:AttributeClaims	—	IdP claim types copied into member attributes for row filters (Admin-set attributes win)
Keel:Seed:Demo	false	Development only: seed the Anchor Demo tenant on start
Keel:Maintenance:Message	—	When set, every signed-in user sees a "Scheduled maintenance" banner with this text. It is reloaded without a restart.
Keel:Maintenance:StartsAt / EndsAt	—	The window (ISO 8601, UTC). The banner disappears once EndsAt has passed.
Keel:Maintenance:StatusUrl	—	An absolute http(s) link to the status page, shown as "Status page →" in the banner.

Sections

Generated from the options classes in the code. — means no default (must be supplied when the feature is used).

Keel:Agent

Settings of Keel.Worker in private-agent mode (section Keel:Agent, ADR-0006/0017). The agent needs no database and no Keel secrets: only the server URL, a one-time enrollment token for its first start, a writable state directory for its key pair, and the customer credentials in its local secret store.

Environment variable prefix: Keel__Agent__ · options class AgentOptions.

Key	Type	Default	Notes
Mode	string	"Server"	Server (default: the job worker) or Agent.
ServerUrl	Uri?	—	Keel's public URL, e.g. https://keel.example.com. Only outbound HTTPS to it is needed.
EnrollmentToken	string?	—	One-time token from Settings › Agents; used on the first start only (the state directory remembers the enrollment).
StateDirectory	string	"/var/lib/keel-agent"	Where the agent keeps its identity (agent id, certificate and private key). Mount a volume here.
SecretsDirectory	string	"/run/secrets/keel"	File secret store: one file per secret, named like the secret (Docker/Kubernetes secrets).
SecretEnvironmentPrefix	string	"KEEL_SECRET_"	Environment secret store: {prefix}{NAME} with the name upper-cased and non-alphanumerics as _.
Concurrency	int	4	Work items run at the same time.
ClaimWaitSeconds	int	20	Long-poll wait of a claim, in seconds (the server caps it).
MigrateWrite	bool	true	F22: whether this agent runs the Migrate write plane (runs, write-scope checks). Off makes a read-only agent: it reports the capability as off and refuses write work; the control plane does not schedule runs on it.
RotationCheckInterval	TimeSpan	TimeSpan.FromHours(1)	F22 AC2: how often the agent checks whether its certificate is due for rotation (30 days).
RotateAfter	TimeSpan	TimeSpan.FromDays(30)	F22 FR2: the certificate age that triggers rotation (30 days; shorter only for tests and drills).
Install	string?	—	M12.2: how the agent was installed — container, windows-service, binary or manual; detected when empty (the agent image sets container). Only Windows service and binary installs update themselves.
SelfUpdate	bool	true	M12.2: turn self-update off (the fleet then shows the agent as managed externally).
InstallDirectory	string?	—	M12.2: the folder the agent runs from, which an update replaces (default: the application's base directory).
ServiceName	string	"KeelAgent"	M12.2: the Windows service the helper stops and starts around the swap.
UpdateDrainTimeout	TimeSpan	TimeSpan.FromMinutes(10)	M12.2: how long an update waits for running work items to finish before it swaps anyway.
UpdateHealthTimeout	TimeSpan	TimeSpan.FromMinutes(3)	M12.2: a new version must report a successful heartbeat within this time, or the previous binary is put back.
UpdateMaxStarts	int	3	M12.2: starts of a new version that may fail before it is rolled back (a crash loop).

Keel:Agent:Vault

The agent's secret provider (ADR-0006, F22): a secret NAME from a source's agent:{name} reference is resolved on the agent host — locally (files, environment) or in the customer's own vault. Values never leave the agent.

Environment variable prefix: Keel__Agent__Vault__ · options class AgentVaultOptions.

Key	Type	Default	Notes
Provider	AgentVaultProviderKind	AgentVaultProviderKind.Local
LocalOverrides	bool	true	With a vault provider, a local secret (file or environment variable of the same name) is used first, so an operator can override one secret on the host. False: the vault only.
CacheSeconds	int	300	How long a value read from the vault is reused, in seconds; 0 reads the vault every time.
NotFoundCacheSeconds	int	30	How long "not found" is remembered, in seconds (capped by CacheSeconds); 0 disables.
AzureKeyVault	AzureKeyVaultOptions	new()
AwsSecretsManager	AwsSecretsManagerOptions	new()
HashiCorpVault	HashiCorpVaultOptions	new()

Keel:Agents

Private-agent settings of the server (section Keel:Agents).

Environment variable prefix: Keel__Agents__ · options class AgentServerOptions.

Key	Type	Default	Notes
OfflineAfter	TimeSpan	Agent.OfflineAfter	An agent is offline when its last heartbeat is older than this (default 90 s; heartbeats every 30 s).
HeartbeatSeconds	int	30
ClaimPollInterval	TimeSpan	TimeSpan.FromMilliseconds(500)	How often a waiting claim looks for new work (long poll).
RequireClientCertificate	bool	—	Require a TLS client certificate matching the pinned thumbprint on every agent request (mTLS, the production path of ADR-0006). Off only where TLS ends before Keel without certificate forwarding (local development, tests); the request signature made with the same certificate's key is checked in every mode.
PublicUrl	string?	—	Public URL agents call (shown in the enrollment's docker run command); defaults to the request's origin.
Registry	string	AgentDistribution.Registry	M12.3 E8: where the agent image and the Helm chart are published ({Registry}/keel-agent, oci://{Registry}/charts/keel-agent) — the one owner name every install command derives from. Production sets the company's GitHub organisation (docs/10).
ReleaseRepository	string	AgentDistribution.Repository	M12.3 E8: the GitHub repository whose Releases carry the Windows package ({ReleaseRepository}/releases/download/agent-v{version}/…).
LatestVersion	string?	—	F22: the agent version this control plane ships (install and update commands, the fleet's "latest version", version skew). Defaults to the server's own version: agents and the control plane are released together.
RotationOverlap	TimeSpan	TimeSpan.FromMinutes(10)	F22 AC2: how long the certificate replaced by a rotation keeps authenticating (in-flight requests, run reports).
MaxCertificateValidity	TimeSpan	TimeSpan.FromDays(90)	The longest validity a rotated certificate may claim (agents create 37-day certificates and rotate at 30 days).
Releases	AgentReleaseOptions	new()	M12.2: release channels, packages and the release-signing key (agent self-update).

Keel:Analytics

Product analytics settings (section Keel:Analytics, F25).

Environment variable prefix: Keel__Analytics__ · options class ProductAnalyticsOptions.

Key	Type	Default	Notes
Provider	string	"none"	none (default: nothing leaves) or posthog (a PostHog-compatible capture API).
HashKey	string?	—	HMAC-SHA256 key for tenant and user ids (≥ 32 characters; from the host's secrets). Without it ids are hashed with a per-process random key, so they cannot be joined across restarts — set it wherever a sink is enabled.
AppVersion	string?	—	The release reported as app_version; defaults to the entry assembly's informational version.
PostHog	PostHogOptions	new()

Keel:ApiKeys

API key settings (section Keel:ApiKeys).

Environment variable prefix: Keel__ApiKeys__ · options class ApiKeyOptions.

Key	Type	Default	Notes
CacheTtl	TimeSpan	TimeSpan.FromSeconds(30)	How long a key lookup is cached; capped at 60 s so revocation propagates within F01 AC5.

Keel:Auth

Authentication settings (section Keel:Auth, docs/08 §1).

Environment variable prefix: Keel__Auth__ · options class KeelAuthOptions.

Key	Type	Default	Notes
Authority	string?	—	OIDC authority (issuer), e.g. the Keycloak realm URL. Dev: Keycloak via Aspire.
Audience	string	"keel-api"
RequireHttpsMetadata	bool	true

Keel:Billing

Section Keel:Billing (docs/10 "Billing").

Environment variable prefix: Keel__Billing__ · options class BillingOptions.

Key	Type	Default	Notes
Provider	string	"none"	stripe (needs SecretKey) or none (default: no checkout, trials only).
TrialPlan	string	"business"	The sign-up trial's plan (decisions log 2026-09-30: 14 days of Business).
TrialDays	int	14
EntitlementsCacheTtl	TimeSpan	TimeSpan.FromSeconds(30)	How long an instance keeps a tenant's entitlements; a change on another instance shows within this time.
UsageCacheTtl	TimeSpan	TimeSpan.FromSeconds(5)	How long an instance keeps a tenant's monthly usage counts between its own increments.
BillingPageUrl	Uri?	—	The web app's billing page (checkout/portal return links). Defaults to {Keel:Web:Origin}/settings/billing.
Catalog	CatalogOptions?	—	The versioned catalog; when absent, Default (development placeholders).
Stripe	StripeOptions	new()

Keel:Connectors

Connector settings shared by every module that opens source connections (section Keel:Connectors).

Environment variable prefix: Keel__Connectors__ · options class ConnectorOptions.

Key	Type	Default	Notes
AllowPrivateNetworks	bool	—	Allow Direct-mode connections to private/internal addresses. Off in SaaS (F02 Security, docs/08 §5); on for local development and self-hosted installs whose databases live on the same network.
AllowedCloudHosts	List<string>	[]	Extra hosts cloud connectors may reach besides their provider's domains (CloudHostPolicy, ADR-0015): exact names or *.suffix patterns, e.g. a private-link domain, an emulator or a test fake.

Keel:Database

Database settings (section Keel:Database).

Environment variable prefix: Keel__Database__ · options class DatabaseOptions.

Key	Type	Default	Notes
AppConnectionStringName	string	"keel"	Runtime connection string name: the non-owner keel_app role, subject to RLS.
AdminConnectionStringName	string	"keel-admin"	Migration connection string name: schema owner / admin. Used only by the migrator.
MigrateOnStartup	bool	—	Apply migrations when the API starts (development only).

Keel:Email

SMTP settings (section Keel:Email). Dev: Mailpit via Aspire; prod: the deployment's relay/provider.

Environment variable prefix: Keel__Email__ · options class EmailOptions, LeadsEmailOptions.

Key	Type	Default	Notes
SmtpHost	string?	—
SmtpPort	int	25
EnableSsl	bool	—
Username	string?	—
Password	string?	—
From	string	"Anchor Keel <no-reply@anchorkeel.local>"
WebOrigin	string	"http://localhost:5173"	Public web origin used to build links (e.g. https://app.anchorkeel.io).

Keel:Exports:Git

Section Keel:Exports:Git: outbound Git delivery of exports (F15).

Environment variable prefix: Keel__Exports__Git__ · options class GitDeliveryOptions.

Key	Type	Default	Notes
AllowPrivateNetworks	bool	—	Self-hosted only: allow private and internal addresses (and plain http) for Git hosts such as an on-premises GitHub Enterprise Server. Off by default, as in SaaS (docs/08 §5 SSRF).
AllowedHosts	List<string>	[]	Hosts allowed even when they are private, over http too (e.g. 127.0.0.1 for a local test server).
TimeoutSeconds	int	30	Whole-request timeout per call.

Keel:Http

Options for HttpHardening (Keel:Http).

Environment variable prefix: Keel__Http__ · options class HttpHardeningOptions.

Key	Type	Default	Notes
SensitivePermitsPerMinute	int	20	Requests per minute per caller and endpoint on auth-sensitive endpoints (tenant sign-up, invitations, API keys, secrets, connection tests).
SupportRequestsPerHour	int	5	"Contact support" requests per person per hour (F23 FR6).
PublicReadPermitsPerMinute	int	60	Requests per minute per caller (or client IP) on anonymous read endpoints such as the status page.
ForwardLimit	int	1	How many trusted proxy hops X-Forwarded-For is unwound (default 1). Behind Azure Front Door and the Container Apps ingress it is 2 (docs/10 "Production deployment"); every hop must be inside TrustedProxies.
MaxRequestBodyBytes	long	30 * 1024 * 1024	Largest request body accepted, in bytes (Kestrel; default 30 MB). Endpoints may lower it.
RequiredFrontDoorId	string?	—	Azure Front Door profile id (X-Azure-FDID) every request must carry, or empty (no check). Set by the lean hosting profile (deploy/infra README "Cost profiles"), where the apps' ingress is public but admits only Front Door's shared backend addresses: the header tells Keel's own Front Door from another customer's.

Keel:Inference

Section Keel:Inference: bounds of the inference stages (F04/F05).

Environment variable prefix: Keel__Inference__ · options class InferenceOptions.

Key	Type	Default	Notes
InclusionSample	int	1000	Distinct source values sampled per relationship candidate (F04 step 2).
GrainRowSample	int	100_000	Rows sampled when proving a grain (F05).
MaxGrainProbes	int	6	At most this many grain candidates are probed per table.
MaxCandidates	int	5000	At most this many candidates are validated against the source per run.
LlmReviewMin	double	0.3	Only candidates scoring in this band are sent to the LLM for a bounded adjustment (ADR-0007).
LlmReviewMax	double	0.9
LlmBatchSize	int	20
Weights	RelationshipWeights	RelationshipWeights.Default

Keel:Jobs

Environment variable prefix: Keel__Jobs__ · options class JobWorkerOptions.

Key	Type	Default	Notes
WorkerId	string	$"{Environment.MachineName}-{Guid.NewGuid():N}"
BatchSize	int	10
PollInterval	TimeSpan	TimeSpan.FromSeconds(1)
Lease	TimeSpan	TimeSpan.FromMinutes(5)

Keel:Keycloak:Admin

Section Keel:Keycloak:Admin: the service-account client Keel uses to create self-serve accounts (F21), register tenants' identity providers and list or end a person's sessions (docs/13 #41, #42). It needs the realm-management roles manage-users, view-users and manage-identity-providers and nothing else. The dev realm ships one (keel-identity-admin, deploy/keycloak); production supplies the secret from the secret provider.

Environment variable prefix: Keel__Keycloak__Admin__ · options class KeycloakAdminOptions.

Key	Type	Default	Notes
BaseUrl	string?	—	Keycloak's base URL, e.g. https://id.example.com. Empty: derived from Keel:Auth:Authority.
Realm	string?	—	The realm. Empty: derived from Keel:Auth:Authority (…/realms/{realm}).
ClientId	string?	—
ClientSecret	string?	—
WebClientId	string	"keel-web"	The web app's client: Keycloak returns to its redirect URIs after the person sets their password.
SetPasswordLinkLifespanSeconds	int	24 * 60 * 60	How long the "set your password" link is valid.
TimeoutSeconds	int	10
AllowPrivateIdentityProviderUrls	bool	—	Let tenants register identity providers on private or loopback addresses (Keycloak fetches their discovery document or metadata). Off by default (SSRF, docs/08 §5); dev and test stacks with a local IdP turn it on.

Keel:Llm

Section Keel:Llm.

Environment variable prefix: Keel__Llm__ · options class LlmOptions.

Key	Type	Default	Notes
Provider	string	"anthropic"	anthropic, fake (tests/dev) or none. Without an API key Anthropic is disabled.
ApiKey	string?	—
BaseUrl	Uri	new("https://api.anthropic.com/")
DefaultModel	string	"claude-sonnet-5"
DailyTokenBudgetPerTenant	int	500_000	Per-tenant daily token budget (docs/01 §6), a guard against runaway loops. The plan's monthly allowance (F20 llmTokens) is enforced on top of it through IEntitlements.
CacheTtl	TimeSpan	TimeSpan.FromHours(24)

Keel:Maintenance

Keel:Maintenance: the operator's maintenance flag (reloaded without a restart). A notice shows while Message is set and EndsAt has not passed.

Environment variable prefix: Keel__Maintenance__ · options class MaintenanceOptions.

Key	Type	Default	Notes
Message	string?	—	What happens, e.g. "Sat 4 Oct, 02:00–02:30 UTC. Scans will queue; the API stays read-only."
StartsAt	DateTimeOffset?	—
EndsAt	DateTimeOffset?	—	After this, the notice disappears by itself.
StatusUrl	string?	—	The public status page (e.g. https://status.example.com).

Keel:Migrate:Runs

Write-plane settings (Keel:Migrate:Runs).

Environment variable prefix: Keel__Migrate__Runs__ · options class MigrateRunSettings.

Key	Type	Default	Notes
Lease	TimeSpan	TimeSpan.FromMinutes(2)	How long a report keeps the agent's lease (reports come every few seconds).
ClaimWindow	TimeSpan	TimeSpan.FromMinutes(15)	How long the agent has to claim an assignment (first lease).
FreezeWindow	TimeSpan	TimeSpan.FromMinutes(5)	Cutover step 1: no new changes for this long before the freeze is confirmed.
ReportFreshness	TimeSpan	TimeSpan.FromMinutes(2)	The freeze check needs a report at most this old.
RollbackWindow	TimeSpan	TimeSpan.FromHours(72)	F19 FR5 step 5: how long serving can be rolled back to the source.
StopAfterWindow	bool	true	Release change capture (the Stop command) when the rollback window ends.
ReconcileEvery	TimeSpan	TimeSpan.FromMinutes(15)	F19 FR4: reconcile this often while syncing.
LagAlertSeconds	double	60	F19 FR6: alert when change capture lag exceeds this.
ScopeCheckTimeout	TimeSpan	TimeSpan.FromSeconds(60)
CommandWindow	TimeSpan	TimeSpan.FromDays(7)	How long a Stop/Abort sent by claim waits for the agent (it releases change capture when the agent is back).
AutoReissuesPerHour	int	3	F19 restart recovery: a stalled run (lease expired) whose agent is online again — it heartbeats but does not report the run, so it lost it in a restart — is handed to it again automatically, at most this many times per hour.

Keel:Notifications:Channels

Section Keel:Notifications:Channels: outbound Slack/Teams/webhook delivery.

Environment variable prefix: Keel__Notifications__Channels__ · options class ChannelOptions.

Key	Type	Default	Notes
AllowPrivateNetworks	bool	—	Dev/self-hosted only: allow private and internal addresses (and plain http). Off by default, as in SaaS (docs/08 §5 SSRF): channels must post to public https endpoints.
AllowedHosts	List<string>	[]	Hosts allowed even when they are private, over http too (e.g. 127.0.0.1 for a local test receiver).
TimeoutSeconds	int	10	Whole-request timeout per attempt.
DeliveryRetentionDays	int	ChannelDelivery.DefaultRetentionDays	Days finished deliveries stay in the delivery log (1–3650; default DefaultRetentionDays).

Keel:Onboarding:SampleSource

Section Keel:Onboarding:SampleSource (F21 "Explore with sample data"): a read-only sample warehouse the deployment hosts, with a read-only login. The dev AppHost points it at the Chinook sample; production points it at an Anchor-hosted AdventureWorks replica. Unset (no host): the wizard offers only "Connect your database".

Environment variable prefix: Keel__Onboarding__SampleSource__ · options class OnboardingSampleOptions.

Key	Type	Default	Notes
Name	string	"Sample warehouse"
Host	string?	—
Port	int	5432
Database	string	string.Empty
Username	string	string.Empty
Password	string	string.Empty	The sample's read-only password (secret provider); stored per tenant through the secret store like any source.
Include	List<string>	["*"]
Options	Dictionary<string, string>	[]
AllowPrivateNetwork	bool	—	Allow a private-network host for the sample only (dev stacks, self-hosted); the SaaS sample is public.

Keel:Operations

Offboarding settings (section Keel:Operations).

Environment variable prefix: Keel__Operations__ · options class OperationsOptions.

Key	Type	Default	Notes
ExportDirectory	string?	—	Where tenant exports are written (a volume shared by the worker and the API that serves downloads). Default: a keel-tenant-exports folder in the temp directory. Exports hold customer metadata: keep the folder private and delete files once handed over (the runbook says 30 days at most).

Keel:Operators

Section Keel:Operators (F23, M12.4). Platform roles live in operations.platform_member; configuration only seeds them once (when the table has no owner) and stays as a break-glass list that is logged loudly whenever it is what grants access.

Environment variable prefix: Keel__Operators__ · options class OperatorOptions.

Key	Type	Default	Notes
Owner	string?	—	The platform owner's IdP sub, taken once when no owner exists. Absent: the first of Subjects.
Subjects	string[]	[]	IdP sub values seeded as operators on first start, and afterwards a break-glass list: a subject listed here keeps operator rights (never owner rights) even when it is not, or no longer, a platform member — remove it here as well.
RequiredAmr	string?	—	When set, the token's amr must contain this method (e.g. hwk, a hardware key) for platform rights, unless a member's own required method overrides it.

Keel:Outbox

Environment variable prefix: Keel__Outbox__ · options class OutboxOptions.

Key	Type	Default	Notes
BatchSize	int	100
PollInterval	TimeSpan	TimeSpan.FromSeconds(1)
MaxAttempts	int	10

Keel:Quality

Read directly by QualityModule.

Environment variable prefix: Keel__Quality__ · options class QualityModule.

Key	Type	Default	Notes
AutoResolveAfterPasses	int	3
TrendDays	int	14

Keel:Sales

Section Keel:Sales (M12.3 E7): the sales address the web app links to ("Talk to sales" for Enterprise, the EU region at sign-up), served publicly with the sign-in options.

Environment variable prefix: Keel__Sales__ · options class SalesOptions.

Key	Type	Default	Notes
Email	string	DefaultEmail

Keel:Secrets

Secret store settings (section Keel:Secrets).

Environment variable prefix: Keel__Secrets__ · options class SecretStoreOptions.

Key	Type	Default	Notes
Provider	string	"local"	local (encrypted in the metadata database) or keyvault (Azure Key Vault).
MasterKey	string?	—	Master key for the local provider: base64 of 32 bytes, or a random passphrase of at least 32 characters. Supplied by the host's secret configuration (user secrets / AppHost parameter in dev, a vault in production).
KeyVaultUri	Uri?	—	Vault URI for the Key Vault provider, e.g. https://keel-prod.vault.azure.net/.

Keel:Seed:Samples

Section Keel:Seed:Samples (development only).

Environment variable prefix: Keel__Seed__Samples__ · options class SampleSourcesOptions.

Key	Type	Default	Notes
Sources	List<SampleSource>	[]

Keel:Seed:Samples:SqlServer

Section Keel:Seed:Samples:SqlServer (development only).

Environment variable prefix: Keel__Seed__Samples__SqlServer__ · options class SqlServerSampleOptions.

Key	Type	Default	Notes
AdminConnectionString	string?	—	Administrator connection to the sample SQL Server container (AppHost).
ScriptsPath	string?	—	Folder with Chinook_SqlServer.sql (deploy/samples/chinook).
ReaderPassword	string	string.Empty

Keel:SignIn

Section Keel:SignIn: what the sign-in page offers (F21 FR1, docs/10 "Sign-in and sign-up").

Environment variable prefix: Keel__SignIn__ · options class SignInOptions.

Key	Type	Default	Notes
SocialProviders	string[]	[]	Social identity brokers configured and enabled in the IdP, as Keycloak identity-provider aliases (google, microsoft). Each becomes a button that redirects with kc_idp_hint. Empty (default): no buttons.
MagicLink	MagicLinkOptions	new()
DemoUrl	string	string.Empty	The marketing site's demo form (F17), e.g. https://example.com/demo. Empty: the link is hidden.
DnsOverHttpsUrl	Uri	new("https://cloudflare-dns.com/dns-query")	DNS-over-HTTPS JSON endpoint used to verify single sign-on domains (TXT records).

Keel:Signup

Section Keel:Signup (decisions log 2026-09-30: SalesLed by default).

Environment variable prefix: Keel__Signup__ · options class SignupOptions.

Key	Type	Default	Notes
Mode	SignupMode	SignupMode.SalesLed
AllowTenantCreation	bool	—	Sales-led only: let any signed-in person without a tenant create one through POST /tenants (onboarding). Off by default — Google/Microsoft brokers would otherwise let anyone open a tenant; platform operators always may.
PerDomainPerDay	int	20	Sign-ups started per email domain per rolling 24 hours (the F17 demo form allows 20).
FreeMailDomains	string[]	[.. WorkEmail.DefaultFreeMailDomains]	Consumer mailbox domains refused at sign-up; the F17 list by default.
TurnstileSiteKey	string?	—	The public Turnstile site key the sign-up page renders (the secret is Leads:Turnstile:SecretKey).

Keel:SqlGateway

Settings of the SQL interface (section Keel:SqlGateway, ADR-0018).

Environment variable prefix: Keel__SqlGateway__ · options class SqlGatewayOptions.

Key	Type	Default	Notes
Port	int	5433	TCP port of the PostgreSQL wire protocol (0 picks a free port, for tests). Default 5433.
ListenAddress	string	"0.0.0.0"	Address to listen on (default all interfaces).
MaxConnections	int	200	Open connections per gateway instance; further connections get 53300 too_many_connections.
MaxMessageBytes	int	1 << 20	Largest frontend message accepted (a query text or a Bind with its parameters).
AuthenticationTimeout	TimeSpan	TimeSpan.FromSeconds(30)	Time allowed from connect to authenticated.
IdleTimeout	TimeSpan	TimeSpan.FromHours(1)	Idle sessions are closed after this long without a message.
CertificatePath	string?	—	PKCS#12 (.pfx) certificate for TLS (SSLRequest → 'S', then a TLS handshake). Without one the gateway answers 'N' and expects TLS to be terminated in front of it (a TCP load balancer).
CertificatePassword	string?	—	Password of CertificatePath (a secret: user secrets or the environment).
AllowCleartextPasswordWithoutTls	bool	—	Accept the password (an API key) on a connection that did not negotiate TLS. Off by default; on in development and when TLS is terminated by a trusted proxy in front of the gateway.
ServerVersion	string	"16.0"	The server_version reported to clients (drivers pick SQL features by it).

Keel:Status

Status page settings (section Keel:Status, docs/10 "Status page").

Environment variable prefix: Keel__Status__ · options class StatusOptions.

Key	Type	Default	Notes
Region	string	"US"	This deployment's region id (shown in the region switch).
RegionLabel	string	"US region"
OtherRegions	List<StatusRegionOptions>	[]	Other regions' status pages, for the switch (each region serves its own page).
ApiUrl	string?	—	The API's base URL as the worker reaches it (e.g. http://api:8080). The recording job probes {ApiUrl}/status so the history includes the API; unset, the API's signal is recorded as unknown.
LinkKey	string?	—	HMAC key (≥ 32 characters) for the confirm and unsubscribe links in status emails. Must be the same on every API and worker instance; without it a random per-process key is used and links stop working after a restart.

Keel:Support

Contact support settings (section Keel:Support).

Environment variable prefix: Keel__Support__ · options class SupportOptions.

Key	Type	Default	Notes
Email	string?	—	Where "Contact support" requests are sent (decisions log 2026-09-30). Unset: the help panel says support isn't set up.