Configuration

Setting Configuration Values

Fides can be configured in two different ways: either via a toml file or via environment variables. Both methods can be used simultaneously, with environment variables taking precedence over the toml file values.

Using a Configuration File

Fides will use the first config file it can read from the following locations. Listed in order of precedence they are:

1. At the path specified using the config file argument passed through the CLI, i.e. fides -f <config_path>
2. At the path specified by the FIDES__CONFIG_PATH environment variable
3. In the current working directory it will check for a subdir .fides and a file within named fides.toml, i.e. ./.fides/fides.toml

Generating a Config File

If you'd like to generate a new config file automatically using default values, run fides init. This will create the file at the default location of ./.fides/fides.toml

Setting Values Via Environment Variables

Fides follows a set pattern for configuration via environment variables. It looks for environment variables that start with FIDES followed by the config subsection name, followed by the key name, all separated with double underscores. In practice this would look like FIDES__<SUBSECTION>__<KEY>

As a toml configuration value:

[database]
host = config_example

As an environment variable:

EXPORT FIDES__DATABASE__HOST=config_example

Viewing your configuration

You can view the current configuration of your application via either the CLI or API.

CLI

To view your application configuration via the CLI, run:

fides view config

This will show all configuration variables, including sensitive ones. It is printed to the console as valid toml, so this can be copy/pasted as needed.

API

To view your application configuration in the API, run:

GET /api/v1/config

For security reasons, sensitive configuration values will not be shown here.

Configuration File Example as of v2.6.6

[admin_ui]
enabled = true
 
[cli]
local_mode = false
analytics_id = "internal"
server_protocol = "http"
server_host = "localhost"
server_port = "8080"
server_url = "http://localhost:8080"
 
[celery]
event_queue_prefix = "fides_worker"
task_default_queue = "fides"
task_always_eager = true
 
[credentials]
app_postgres = {connection_string="postgresql+psycopg2://postgres:fides@fides-db:5432/fides"}
 
[database]
user = "defaultuser"
password = "defaultpassword"
server = "default-db"
port = "5432"
db = "default_db"
test_db = "default_test_db"
api_engine_pool_size = 50
api_engine_max_overflow = 50
task_engine_pool_size = 50
task_engine_max_overflow = 50
 
[execution]
privacy_request_delay_timeout = 3600
task_retry_count = 0
task_retry_delay = 1
task_retry_backoff = 1
subject_identity_verification_required = false
require_manual_request_approval = false
masking_strict = true
 
[logging]
destination = ""
level = "INFO"
serialization = ""
log_pii = false
 
[notifications]
send_request_completion_notification = false
send_request_receipt_notification = false
send_request_review_notification = false
notification_service_type = "mailgun"
 
[redis]
host = "redis"
port = 6379
password = "testpassword"
charset = "utf8"
decode_responses = true
default_ttl_seconds = 604800
identity_verification_code_ttl_seconds = 600
enabled = false
ssl = false
ssl_cert_reqs = "required"
connection_url = "redis://:testpassword@redis:6379/"
 
[security]
subject_request_download_link_ttl_seconds = 432000
request_rate_limit = "1000/minute"
rate_limit_prefix = "fides-"
aes_encryption_key_length = 16
aes_gcm_nonce_length = 12
identity_verification_attempt_limit = 3
encoding = "UTF-8"
env = "dev"
cors_origins = [ "http://localhost", "http://localhost:8080", "http://localhost:3000", "http://localhost:3001",]
cors_origin_regex = "http://localhost:[0-9][0-9][0-9][0-9]"
oauth_access_token_expire_minutes = 11520
oauth_client_id_length_bytes = 16
oauth_client_secret_length_bytes = 16
 
[user]
analytics_opt_out = true
encryption_key = "test_encryption_key"

Configuration Variable Reference

Application Database

Environment variable prefix: FIDES__DATABASE__

Redis cache

Environment variable prefix: FIDES__REDIS__

Logging

Environment variable prefix: FIDES__LOGGING__

CLI

Environment variable prefix: FIDES__CLI__

Security

Environment variable prefix: FIDES__SECURITY__

Execution

Environment variable prefix: FIDES__EXECUTION__

User

Environment variable prefix: FIDES__USER__

Credentials

Environment variable prefix: FIDES__CREDENTIALS__

The credentials section uses custom keys which can be referenced in specific commands that take the --credentials-id option. For example, a command that uses a credential might look like fides scan dataset db --credentials-id app_postgres. The credential object itself will be validated at the time of use depending on what type of credential is required. For instance if fides scan system okta is used, it will expect the object to contain orgUrl and token key/value pairs. In the case of a typical database like postgres, it will only expect a connection_string. The following is an example of what a credentials section might look like in a given deployment with various applications:

Admin UI

Environment variable prefix: FIDES__ADMIN_UI__

Notifications

Environment variable prefix: FIDES__NOTIFICATIONS__

Additional environment variables

The following environment variables are not included in the default fides.toml configuration, but may be set in your environment:

Celery Configuration

Fides uses Celery (opens in a new tab) for asynchronous task management.

To simplify deployments and remove the need for two different toml configuration files, it is possible to configure celery via the Fides configuration file. Any valid configuration key/value pair for celery can instead be added to the Fides toml configuration file and will automatically be passed through to the celery deployment. Note that Fides will not validate any of these key/value pairs. See the above configuration file reference for an example of using celery configuration pass-through.

For a full list of possible variable overrides, see the Celery configuration (opens in a new tab) documentation.