ibexharness
DocsBlogReleasesRoadmap
GitHub
ibexharness

Documentation

OverviewConfigurationAuthenticationRate limitingRequest routingProvider adapters
Proxy›Configuration
Proxy

Configuration

Environment variables and config files for the proxy service.

The proxy loads configuration from environment variables at startup via packages/config. There is no config.yaml — missing required values panic with a clear message so misconfiguration surfaces before the first request, not during traffic.

Copy services/proxy/.env.example to services/proxy/.env for local development. The canonical registry is docs/ENVIRONMENT_VARIABLES.md §9.

Local dev timeout

Set IBEX_AUTH_VALIDATE_TIMEOUT=2s on developer machines. The production default 50ms is often too tight for Argon2 token verification over loopback; without the override, bearer requests may return 503 SERVICE_DEGRADED.

Required variables

ParameterTypeDescription
IBEX_AUTH_GRPC_ADDRRequiredstring (host:port)
Auth service gRPC target for ValidateToken and ValidateAgent.
Default: 127.0.0.1:9091
REDIS_URLRequiredstring (URL)
Redis connection for org-level rate limiting. Required for /ready when set.

No direct Postgres

The proxy does not read POSTGRES_DSN in Phase 1. All identity data flows through auth gRPC — see Architecture services.

HTTP and auth tuning

ParameterTypeDescription
IBEX_PORTinteger
HTTP listen port.
Default: 8080
IBEX_AUTH_VALIDATE_TIMEOUTduration
Per-request ValidateToken deadline.
Default: 50ms (2s in .env.example)
IBEX_MAX_REQUEST_BODY_BYTESinteger
Maximum chat completion JSON body size.
Default: 1048576 (1 MiB)
IBEX_SHUTDOWN_TIMEOUTduration
Graceful drain window on SIGTERM.
Default: 30s

Rate limiting

ParameterTypeDescription
IBEX_RATE_LIMIT_DEFAULT_RPMinteger
Requests per minute for orgs without an override.
Default: 60
IBEX_RATE_LIMIT_ORG_OVERRIDESstring
Comma-separated org_uuid=rpm pairs for tenant-specific budgets.

Redis keys follow ratelimit:{org_id}:rpm:{unix_minute} — org_id is always the second segment per Tenant isolation.

Correlation and errors

ParameterTypeDescription
IBEX_REQUEST_ID_HEADERstring
Inbound/outbound request ID header name.
Default: X-Request-ID
IBEX_TRACE_ID_HEADERstring
Trace ID response header name.
Default: X-Trace-ID
IBEX_ERROR_DOCS_BASEstring (URL)
Optional prefix for docs_url in JSON error envelopes.

Observability

ParameterTypeDescription
OTEL_SERVICE_NAMEstring
OpenTelemetry service.name resource attribute.
Default: ibex-proxy
OTEL_EXPORTER_OTLP_ENDPOINTstring (URL)
OTLP exporter endpoint; unset = no-op tracer.
IBEX_LOG_LEVELstring
Structured log verbosity (debug, info, warn, error).
Default: info

Example .env excerpt

services/proxy/.env
IBEX_PORT=8080
IBEX_AUTH_GRPC_ADDR=127.0.0.1:9091
IBEX_AUTH_VALIDATE_TIMEOUT=2s
REDIS_URL=redis://localhost:6379/0
IBEX_MAX_REQUEST_BODY_BYTES=1048576
IBEX_RATE_LIMIT_DEFAULT_RPM=60
IBEX_LOG_LEVEL=debug

Smoke-test convenience variables (IBEX_DEV_TOKEN, IBEX_DEV_AGENT_ID) are documented in .env.example but are not read by the proxy binary — they exist for make dev-smoke only.

Readiness dependencies

GET /ready reports critical dependency health:

CheckWhen evaluatedFailure impact
auth_grpcAlwaysOrchestrator should not route traffic
redisWhen REDIS_URL is setRate limiter degraded; requests still allowed

Liveness (GET /health) does not probe dependencies — use it for process-up checks only. Details: ADR-0022.

Boot order

1

Infrastructure

make compose-dev-up — Postgres (auth), Redis (proxy rate limit).

2

Migrations and seed

make db-migrate && make db-seed — org, agent, and dev PAT for smoke tests.

3

Auth first

Start auth on gRPC 9091 before the proxy. See Auth configuration.

4

Proxy

go run ./services/proxy/cmd/proxy with env from .env.

Verify configuration

bash
curl -s http://localhost:8080/health | jq
curl -s http://localhost:8080/ready | jq

Expected: /health returns {"status":"ok"}. /ready returns ok when auth gRPC and Redis are reachable.

Related

  • Overview — middleware order and endpoint table
  • Rate limiting — how RPM config maps to Redis
  • Docker Compose — production-like local stack
  • Environment variables — full cross-service registry

Was this page helpful?

Edit on GitHub

Last updated on

PreviousOverviewNextAuthentication

On this page

  • Required variables
  • HTTP and auth tuning
  • Rate limiting
  • Correlation and errors
  • Observability
  • Example .env excerpt
  • Readiness dependencies
  • Boot order
  • Verify configuration
  • Related
0%