Environment Variables
Environment variable reference
zwallctl
Scroll sideways to see the full table. Use the arrow keys when focused.
| Variable | Purpose | Secret | Edition |
|---|---|---|---|
ZWALL_MANAGER_URL | Manager API URL | no | Shared |
ZWALL_AUTH_TOKEN | JWT | yes | Shared |
ZWALL_PIN_DIR | eBPF pin dir | no | Shared |
ZWALL_OUTPUT_MODE | table/json/quiet | no | Shared |
ZWALL_VERBOSE | true enables verbose | no | Shared |
Source: zwallctl environment merge (ZWALL_* as listed).
Community Manager JWT
Community Manager requires JWT_SECRET in the process environment (it exits if missing). That is not the Enterprise systemd-credential contract.
Enterprise Manager secrets (env, `*_FILE`, or `$CREDENTIALS_DIRECTORY`)
Verified names include JWT_SECRET / jwt_secret, DB_PASSWORD / database_password, ADMIN_INITIAL_PASSWORD / admin_initial_password, plus optional SMTP, Cloudflare, MaxMind, captcha, ModSecurity webhook, ACME DNS JSON, cluster, and AI key slots. In ZWALL_REQUIRE_SYSTEMD_CREDENTIALS=true production custody, YAML/env fallbacks are rejected.
Non-secret overrides exist as ZCS_* / DB_* / LOG_LEVEL (see applyEnvironmentOverrides in Manager config). Prefer the admitted unit EnvironmentFile (/etc/zwall-manager/manager-nonsecret.env) over inventing a public env encyclopedia.
Scroll sideways to see the full table. Use the arrow keys when focused.
| Variable | Purpose | Secret | Edition |
|---|---|---|---|
ZWALL_REQUIRE_SYSTEMD_CREDENTIALS | Reject YAML secret fallbacks | no | ENTERPRISE |
CREDENTIALS_DIRECTORY | systemd credential dir | yes (directory) | ENTERPRISE |
JWT_SECRET / jwt_secret | Admin JWT HMAC | yes | SHARED/ENTERPRISE |
DB_PASSWORD / database_password | PostgreSQL password | yes | SHARED/ENTERPRISE |
ADMIN_INITIAL_PASSWORD / admin_initial_password | First-install admin | yes | SHARED/ENTERPRISE |
Enterprise database installer
Scroll sideways to see the full table. Use the arrow keys when focused.
| Variable | Purpose |
|---|---|
DB_PASSWORD | scoped installer password; not inherited by the Manager service |
Hosting Agent unit
Scroll sideways to see the full table. Use the arrow keys when focused.
| Variable | Purpose | Secret |
|---|---|---|
ZWALL_AGENT_INSTANCE_LOCK | /run/zwall-hosting-agent/agent.lock | no |
ZWALL_AGENT_STATE_DIR | /var/lib/zwall-hosting | no |
HOME | /var/lib/zwall-hosting | no |
ZWALL_AGENT_CREDENTIAL_PATH | /var/lib/zwall-hosting/agent.identity | yes (path to identity) |
ZWALL_HOSTING_EBPF_SHA256 | loader object digest (hosting-ebpf.env) | no |
ZWALL_HOSTING_INTERFACES | loader attach list | no |
Agent bootstrap
Scroll sideways to see the full table. Use the arrow keys when focused.
| Variable | Purpose | Secret |
|---|---|---|
AGENT_TOKEN | one-time bootstrap JWT (preferred over YAML server.token) | yes |