Runefile (server config)

runed is configured via a YAML or TOML file (often called a "runefile"). The default location is /etc/rune/runefile.{yaml,toml} — runed auto-discovers either format. Override with runed --config <path>.

The two formats are equivalent; pick whichever your tooling prefers. TOML is recommended for new deployments because it's stricter about typos and easier to comment.

Minimal example

server:
  grpc-addr: ":7863"
  http-addr: ":7861"
  data-dir: /var/lib/rune
 
auth:
  enabled: true

Full example

server:
  grpc-addr: ":7863"
  http-addr: ":7861"
  data-dir: /var/lib/rune
  log-level: info
  log-format: json
 
auth:
  enabled: true
  allow_remote_admin: false
  tls:
    enabled: true
    cert-file: /etc/rune/tls/server.crt
    key-file:  /etc/rune/tls/server.key
 
crypto:
  kek:
    source: file              # file | env | generated
    file-path: /var/lib/rune/kek
    env-var: RUNE_MASTER_KEY
    generate-if-missing: true
 
storage:
  secret-limits:
    max-keys-per-secret: 64
    max-value-size: 65536
 
runner:
  docker:
    enabled: true
    socket: /var/run/docker.sock
  process:
    enabled: true
 
docker:
    registries:
      - name: ghcr-private
        registry: ghcr.io
        auth:
          type: basic
          username: ${GHCR_USER}
          password: ${GHCR_PAT}
      - name: ecr
        registry: "*.dkr.ecr.us-east-1.amazonaws.com"
        auth:
          type: ecr
          region: us-east-1

Sections

server

auth

ui

The embedded web dashboard, served on server.http-addr.

crypto.kek

How runed loads the Key Encryption Key for secrets.

The KEK is 32 bytes, base64-encoded when stored on disk or passed via env.

storage.secret-limits

storage (volumes)

Controls the persistent-storage subsystem. See the storage concept and storage resources reference.

[storage]
defaultStorageClass = "local"
localVolumeRoot = "/var/lib/rune/volumes"
hostPathAllowlist = ["/mnt/rune", "/var/lib/rune-volumes"]
allowCreateMissing = false
 
[storage.local]
preserveOnDelete = false

storage.drivers

Per-driver configuration is keyed by registered driver name. Reserved for non-credential, non-per-class driver knobs only — credentials and per-class settings live on StorageClass.parameters so they can be rotated and varied per class. The do-volume driver currently takes no runefile knobs (its API token is sourced from StorageClass.parameters.apiToken, see Storage resources).

# Example placeholder — no driver currently requires any of these.
# [storage.drivers.<driver-name>]
# someKnob = "value"

runner

docker.registries[]

docker:
  registries:
    - name: ghcr-private
      registry: ghcr.io
      auth:
        type: basic
        username: ${GHCR_USER}     # env-expanded at runed start
        password: ${GHCR_PAT}
 
    - name: ecr
      registry: "*.dkr.ecr.us-east-1.amazonaws.com"
      auth:
        type: ecr
        region: us-east-1
        # AWS credentials inferred from environment / IAM role.

Credentials from a Rune Secret (fromSecret)

Instead of inlining credentials, an entry can resolve them from an encrypted Rune Secret at runtime — the recommended pattern for production:

docker:
  registries:
    - name: ghcr-private
      registry: ghcr.io
      auth:
        fromSecret: ghcr-credentials   # Secret name; runed infers auth type from its keys

runed infers the auth type from the secret's keys: username+password → basic, token → bearer, .dockerconfigjson → docker config JSON, awsAccessKeyId+awsSecretAccessKey (+ optional awsRegion) → ecr. When fromSecret is set, do not also set type or inline username/password/token — they are ignored.

For first-boot bootstrapping (e.g. from the Terraform module), the entry can also seed the secret on startup:

Manage credentials at runtime with rune admin registry — no restart required. See the GHCR guide for a private-image walkthrough.

networking

The cluster networking layer. See Concepts: Networking for what these knobs do.

telemetry

node

ingress

Only consulted on edge nodes (node.role: edge).

acme

Only consulted on edge nodes.

Issued certificates are persisted in the encrypted state store (one Secret per host under the system namespace), so runed restarts reuse them rather than re-issuing — important because Let's Encrypt rate-limits to 5 issuances per identifier set per 168 h.

TOML equivalent

data_dir = "/var/lib/rune"
 
[server]
grpc_address = ":7863"
http_address = ":7861"
 
[networking]
cluster_cidr = "10.96.0.0/16"
 
[telemetry]
metrics_addr = "127.0.0.1:9100"
 
[node]
role = "edge"
 
[ingress]
http_addr  = ":80"
https_addr = ":443"
 
[acme]
email = "[email protected]"

CLI flag overrides

Anything in the runefile can be overridden via runed flags:

Every key also has a corresponding RUNE_* environment variable (e.g. RUNE_NETWORKING_CLUSTER_CIDR, RUNE_TELEMETRY_METRICS_ADDR, RUNE_ACME_EMAIL). Precedence, highest to lowest: flag > env var > config file > built-in default.

Reload behavior

Most fields require a runed restart to take effect. Registry credentials managed via rune admin registry are hot.

See also

• Running runed
• Configuration ops guide
• Security hardening