Configuration

The Fides application configuration variables are provided in a fides.toml file. Fides will use the first config file it reads from the following locations, in order:

1. At the path specified using the config file argument passed through the CLI
2. At the path specified by the FIDES__CONFIG_PATH environment variable
3. In the current working directory
4. In the parent working directory
5. Two directories up from the current working directory
6. The parent directory followed by /.fides
7. The user's home (~) directory

Fides can also run exclusively via environment variables. These can be used in tandem with a toml configuration file, with the environment variables overriding the toml configuration values.

Viewing your configuration#

You can view the current configuration of your application via either the CLI or API

CLI#

To view your application configuration via the CLI, run:

fides view config

The output will look something like this:

fides> fides view config 
Loading config from: .fides/fides.toml
Directory './.fides' already exists.
Configuration file already exists: ./.fides/fides.toml
To learn more about configuring fides, see:
        https://ethyca.github.io/fides/installation/configuration/
----------
test_mode = false
is_test_mode = false
hot_reloading = false
dev_mode = false

[admin_ui]
enabled = true

[cli]
local_mode = false
analytics_id = "internal"
server_protocol = "http"
server_host = "localhost"
...

The output after the initial separator (----------) is valid TOML, and can be copy/pasted for reuse as a functioning config file.

API#

To view your application configuration in the API, run:

GET /api/v1/config

Configuration file#

After initializing Fides, a default configuration file will be generated and placed within the .fides directory:

[database]
server = "fides-db"
user = "postgres"
password = "fides"
port = "5432"
db = "fides"

[logging]
level = "INFO"

[cli]
server_host = "localhost"
server_port = 8080
analytics_id = ""

[user]
analytics_opt_out = false

[redis]
host = "redis"
password = "testpassword"
port = 6379
charset = "utf8"
default_ttl_seconds = 604800
db_index = 0
enabled = true
ssl = false
ssl_cert_reqs = "required"

[security]
app_encryption_key = ""
cors_origins = [ "http://localhost", "http://localhost:8080", "http://localhost:3000", "http://localhost:3001",]
encoding = "UTF-8"
oauth_root_client_id = "adminid"
oauth_root_client_secret = "adminsecret"
drp_jwt_secret = "secret"
root_username = "root_user"
root_password = "Testpassword1!"

[execution]
masking_strict = true
require_manual_request_approval = false
task_retry_backoff = 1
subject_identity_verification_required = false
task_retry_count = 0
task_retry_delay = 1

[admin_ui]
enabled = true

Configuration variable reference#

The fides.toml file should specify the following variables:

Postgres database#

Redis cache#

Logging#

CLI#

Security#

Execution#

User#

Credentials#

The credentials section uses custom keys which can be referenced in certain commands.

Admin UI#

Notifications#

Set environment variables#

To configure environment variables for Fides, the following pattern is used:

FIDES__<SECTION>__<VAR_NAME>

For example, to set the server_url on a Linux machine:

export FIDES__CLI__SERVER_HOST="localhost"
export FIDES__CLI__SERVER_PORT="8080"
export FIDES__CLI__SERVER_PROTOCOL="http"

Additional environment variables#

The following environment variables are not included in the default fides.toml configuration, but may be set in your environment:

Celery configuration#

Fides uses Celery for asynchronous task management.

The celery.toml file provided contains a brief configuration reference for managing Celery variables. By default, Fides will look for this file in the root directory of your application, but this location can be optionally overridden by specifying an alternate celery_config_path in your fides.toml.

For a full list of possible variable overrides, see the Celery configuration documentation.

default_queue_name = "fides"
broker_url = "redis://:testpassword@redis:6379/1"
result_backend = "redis://:testpassword@redis:6379/1"