Surface Environment Configuration
Status
This configuration surface is active for Scanner host/Compose/Offline Kit deployment. Kubernetes-specific settings are retired from active Stella Ops deployment support.
Core Keys
| Variable | Description | Notes |
|---|---|---|
SCANNER_SURFACE_TENANT | Tenant override for surface resolution. | Defaults to request tenant when available. |
SCANNER_SURFACE_FS_ROOT | Root for file-backed surface inputs. | Required for file-backed scans. |
SCANNER_SURFACE_TLS_CERT_PATH | Path to PEM/PKCS#12 file for client auth. | Optional. |
SCANNER_SURFACE_TLS_KEY_PATH | Optional private-key path when cert/key are stored separately. | Optional. |
Secrets Provider Keys
| Variable | Description | Notes |
|---|---|---|
SCANNER_SURFACE_SECRETS_PROVIDER | Provider id: file, inline, or future approved back-end. | Defaults to file; validators reject unknown values via SURFACE_SECRET_PROVIDER_UNKNOWN. |
SCANNER_SURFACE_SECRETS_ROOT | Root directory for the file provider. | Example: /etc/stellaops/secrets. |
SCANNER_SURFACE_SECRETS_FALLBACK_PROVIDER | Optional secondary provider id. | Development/test only unless explicitly approved. |
SCANNER_SURFACE_SECRETS_ALLOW_INLINE | Allows returning inline secrets. | Defaults to false; production-like deployments must keep disabled. |
SCANNER_SURFACE_SECRETS_TENANT | Tenant override for secret lookups. | Defaults to SCANNER_SURFACE_TENANT or the tenant resolver result. |
Component Prefixes
SurfaceEnvironmentOptions.Prefixes controls the order in which suffixes are probed. Configure prefixes per host so local overrides win but global scanner defaults remain available.
Kubernetes namespace/provider settings are retired. Any remaining source code using those settings is tracked by docs/implplan/SPRINT_20260501_058_Scanner_kubernetes_surface_retirement.md.