Environment Variables
Environment variables used by the rstream CLI and SDKs.
The rstream CLI and SDK helpers can be configured with environment variables. This is useful in stateless environments where a configuration file is not present or should not be written, such as CI jobs and ephemeral containers.
When both a CLI flag and an environment variable are provided for the same CLI setting, the flag takes precedence. For runtime resolution, explicit flags are read first, then environment variables, then the selected context and default context stored in the configuration file.
Shared runtime variables
| Variable | Meaning |
|---|---|
RSTREAM_CONFIG | Path to the CLI configuration file. |
RSTREAM_CONTEXT | Name of the context to select. |
RSTREAM_API_URL | Control plane API URL. |
RSTREAM_ENGINE | Engine endpoint used for Engine API operations. |
RSTREAM_REGION | Authorized managed project region to select. |
RSTREAM_AUTHENTICATION_TOKEN | Authentication token used by the CLI and SDKs. |
RSTREAM_MTLS_CERT_FILE | Client certificate file for mTLS agent authentication. |
RSTREAM_MTLS_KEY_FILE | Client private key file for mTLS agent authentication. |
RSTREAM_CONTROL_PLANE_HEADERS | Additional Control plane headers encoded as a JSON object. |
HTTPS_PROXY, HTTP_PROXY, ALL_PROXY, NO_PROXY | Process proxy variables used only when the selected config enables transport.proxy.fromEnvironment. |
RSTREAM_AUTHENTICATION_TOKEN and the mTLS certificate/key pair are mutually exclusive for the agent control-channel connection. When both mTLS variables are set, the CLI and SDK helpers authenticate that connection with the client certificate and do not use a stored token from the selected context. If RSTREAM_AUTHENTICATION_TOKEN is also set, resolution fails before connecting. Engine HTTP API requests use token authentication.
RSTREAM_REGION requires a context linked to a managed project and cannot be combined with RSTREAM_ENGINE. The selected region is resolved against the endpoints returned for that project; an unknown or ambiguous region is rejected before the engine connection is opened.
RSTREAM_CONTROL_PLANE_HEADERS is intended for deployments whose Control plane sits behind an additional access gateway. Values are applied only to Control plane requests. Authorization, cookie, forwarding, host, and hop-by-hop headers are reserved, malformed values and case-insensitive duplicates are rejected, and the headers are not forwarded across redirects.
export RSTREAM_CONTROL_PLANE_HEADERS='{"X-Deployment-Access":"<value>"}'Tunnel transport
| Variable | Meaning |
|---|---|
RSTREAM_TUNNEL_TRANSPORT | Select auto, tls, or quic. The Go CLI and SDK default to auto. |
RSTREAM_QUIC_TRANSPORT | Legacy selector. 1 requests strict QUIC; prefer the canonical variable. |
The setting changes only the client-to-edge session. It does not create a published QUIC tunnel; published tunnel protocol is still selected through tunnel properties such as protocol: quic or CLI protocol flags.
SDK package behavior
The JavaScript API packages use the shared variables above. @rstreamlabs/rstream reads RSTREAM_AUTHENTICATION_TOKEN. @rstreamlabs/tunnels reads RSTREAM_ENGINE and RSTREAM_AUTHENTICATION_TOKEN.
@rstreamlabs/runtime is the Node.js tunnel runtime package. It follows the runtime resolution model used by the native SDKs: explicit SDK options first, then environment variables, then the selected context from RSTREAM_CONFIG or the default ~/.rstream/config.yaml file. It reads the shared variables above, including RSTREAM_TUNNEL_TRANSPORT. QUIC transport is not supported by the JavaScript runtime package, so auto uses TLS and explicit quic fails during configuration resolution.