Production checklist

myriarchd serve (and the Helm chart deploy/helm/myriarch, which renders the same configuration) checks its configuration at startup and refuses unsafe values. This page lists what is refused, the settings you must decide for a real installation, and how to check a configuration before you roll it out. The reasoning behind the controls is in the security model; how people sign in is in Authentication. A complete, validated example is deploy/examples/production/myriarchd.yaml.

Refused at startup

In production mode the server does not start when one of these holds. Each message names the setting.

Settings to decide

The defaults are restrictive on purpose: WebSocket compression off, opamp.maxMessageSize 4 MiB, download tokens valid for 24 hours, checksum and Sigstore verification on. Secret files should be readable by the server account only (mode 0400 or 0440); the server logs a warning at start for every secret file that others can read (see Authentication).

At start myriarchd logs a warning for every setting that weakens a control: a non-empty auth.oidc.defaultRole, provider-specific OIDC hints (see Authentication), the bootstrap admin as the only login path or next to OIDC, expired declarative enrollment tokens, enabled compression, empty server.trustedProxies, disabled artifact verification, plain http:// entries in artifacts.agentBaseUrls, and mirror credentials combined with the public GitHub URL, the installation from the server with the release tracker off, a metrics endpoint on the main listener, a database connection to a remote host without certificate verification, the default cache and clone directories, secrets set as literal values in the configuration file, credentials in artifacts.proxyUrl and an unlimited auth.apiTokenMaxTtl. myriarchd config validate prints the same warnings.

Check a configuration without starting the server

myriarchd config validate --config myriarchd.yaml                 # also reads the files it refers to (secrets, CA, certificates)
myriarchd config validate --config myriarchd.yaml --skip-files    # without files: for CI and `helm template`, where secrets are absent
myriarchd config print    --config myriarchd.yaml --skip-files    # the effective configuration, secrets redacted

The command loads the configuration exactly like myriarchd serve: defaults, the YAML file (unknown keys are errors), ${VAR} expansion and MYRIARCH_* environment overrides. It runs every check that serve makes before it touches the database or the network. Nothing is started and no connection is made. On success it prints OK: <file> is valid and one WARNING: <text> line per warning on standard output; each problem is a line ERROR: <path>: <message> on standard error. config print shows the effective configuration as YAML, with the DSN, client secrets, webhook secrets, notification URLs and development passwords replaced by <redacted>; it validates first. The server configuration reference lists every key with its type, default and effect.

Exit codes: 0 valid (warnings are allowed), 1 invalid (YAML syntax, an unknown key, a failed check), 2 wrong usage (no --config, a file that cannot be read, an unknown option). An example:

$ myriarchd config validate --config deploy/examples/production/myriarchd.yaml --skip-files
OK: deploy/examples/production/myriarchd.yaml is valid
$ myriarchd config validate --config broken.yaml --skip-files
ERROR: auth: no login path is configured for serve mode: enable auth.oidc (single sign-on) or auth.bootstrapAdmin with passwordHashFile or tokenFile (break-glass administrator); the dev login exists only in "myriarchd dev"

Without --skip-files, file and certificate problems appear as errors; they disappear when the secrets are mounted. Use --skip-files in CI. The options are in the myriarchd config validate reference; the other commands are in the myriarchd reference and the server start in the myriarchd serve reference.

For Kubernetes, the settings above are values of the Helm chart; see deploy/helm/myriarch/README.md and the troubleshooting page for symptoms: Troubleshooting.