.. environment-variables.rst


.. _environment-variables:

=========================
Environment Variables
=========================

The following describes common FIDO Connector settings available to the deployment or runtime environment as environment variables. If needed, you can customize some of these settings in the Azure Container. For information on how to obtain the status of current deployment components, see :ref:`check-deploy-status`.

.. note:: A manual restart of the Azure Container might be needed for the updates to the environment variables to be recognized.


.. table:: 

   +-------------------------------------+--------------------------------+------------------------------------+
   || Variable                           || Default value (if not changed || Comment                           |
   ||                                    || by Environment Variable)      ||                                   |
   +=====================================+================================+====================================+
   || CRON_PROCESS_SHIPMENT_SCHEDULE     || 0 0 * * * *                   || The cron expression for the       |
   ||                                    ||                               || schedule that checks ongoing      |
   ||                                    ||                               || shipments and processes           |
   ||                                    ||                               || them (v1 API).                    |
   ||                                    ||                               ||                                   |
   ||                                    ||                               || The default setting is to run     |
   ||                                    ||                               || every hour at the top of the hour.|
   ||                                    ||                               ||                                   |
   ||                                    ||                               || It can be changed to any valid    |
   ||                                    ||                               || cron expression, for example to   |
   ||                                    ||                               || run every 30 minutes:             |
   ||                                    ||                               || 0  \*\/30 * * * *                 |
   +-------------------------------------+--------------------------------+------------------------------------+
   || CRON_PROCESS_CREDENTIAL_REQUESTS   || 0 0 * * * *                   || The cron expression for the       |
   || _SCHEDULE                          ||                               || schedule that checks ongoing      |
   ||                                    ||                               || credential/shipment  requests     |
   ||                                    ||                               || and processes them (v2 API).      |
   ||                                    ||                               ||                                   |
   ||                                    ||                               || The default setting is to run     |
   ||                                    ||                               || every hour at the top of the hour.|
   ||                                    ||                               ||                                   |
   ||                                    ||                               || It can be changed to any valid    |
   ||                                    ||                               || cron expression, for example to   |
   ||                                    ||                               || run every 30 minutes:             |
   ||                                    ||                               || 0  \*\/30 * * * *                 |
   +-------------------------------------+--------------------------------+------------------------------------+
   || LOGGING_LEVEL_COM_YUBICO           || INFO                          || Controls the level of information |
   ||                                    ||                               || that is logged by the application.|
   ||                                    ||                               || Can be increased to DEBUG if      |
   ||                                    ||                               || trying to solve a configuration   |
   ||                                    ||                               || issue. For normal usage, it is    |
   ||                                    ||                               || highly recommended to leave it    |
   ||                                    ||                               || as INFO.                          |
   +-------------------------------------+--------------------------------+------------------------------------+
   || ENTRA_FIDO_API_CHALLENGE_TIMEOUT_MI|| 20160                         || Numeric value representing time in|
   || NUTES                              ||                               || minutes that the Entra FIDO       |
   ||                                    ||                               || challenge is valid for.           |
   +-------------------------------------+--------------------------------+------------------------------------+
   || CRON_DATA_CLEANUP_COMPLETED_DAYS   || 0                             || The below cron schedule will purge|
   ||                                    ||                               || ‘complete‘ shipment records that  |
   ||                                    ||                               || are older than this value.        |
   ||                                    ||                               ||                                   |
   ||                                    ||                               || 0 = do nothing, no records will be|
   ||                                    ||                               || deleted, the schedule is          |
   ||                                    ||                               || effectively disabled.             |
   ||                                    ||                               ||                                   |
   ||                                    ||                               || n = integer value means delete    |
   ||                                    ||                               || ‘complete‘ shipment items older   |
   ||                                    ||                               || than today - n days.              |
   +-------------------------------------+--------------------------------+------------------------------------+
   || CRON_DATA_CLEANUP_PENDING_DAYS     || -1                            || The cron schedule will purge      |
   ||                                    ||                               || records in non-complete states    |
   ||                                    ||                               || (ongoing, pending_pin_sending,    |
   ||                                    ||                               || error), with Timestamp older than |
   ||                                    ||                               || “today - pending-days”.           |
   ||                                    ||                               ||                                   |
   ||                                    ||                               || CRON_DATA_CLEANUP_COMPLETED_DAYS  |
   ||                                    ||                               || and CRON_DATA_CLEANUP_PENDING_DAYS|
   ||                                    ||                               || must be configured together.      |
   ||                                    ||                               || -1 values for both means the cron |
   ||                                    ||                               || job is *disabled*. Positive       |
   ||                                    ||                               || values for both means the cron    |
   ||                                    ||                               || job is *enabled*.                 |
   +-------------------------------------+--------------------------------+------------------------------------+
   || CRON_DATA_CLEANUP_SCHEDULE         || 0 30 * * * *                  || The cron expression for the       |
   ||                                    ||                               || cleanup schedule that purges      |
   ||                                    ||                               || ‘complete’ shipments and their    |
   ||                                    ||                               || secrets from the Azure table      |
   ||                                    ||                               || and vault.                        |
   ||                                    ||                               ||                                   |
   ||                                    ||                               || The default setting is to run     |
   ||                                    ||                               || at every 30 minutes past the hour.|
   +-------------------------------------+--------------------------------+------------------------------------+
   || CRON_PROCESS_CREDENTIAL_REQUES     || 14                            || Numeric value representing how    |
   || TS_RETRY_NUMBER_DAYS               ||                               || many days a credential request    |
   ||                                    ||                               || will keep retrying after an       |
   ||                                    ||                               || initial failure.                  |
   +-------------------------------------+--------------------------------+------------------------------------+
   || AZURE_KEY_VAULT_SECRET             || 64800                         || Controls the Key Vault secret     |
   || _EXPIRATION_MINUTES                ||                               || expiration time. Default value    |
   ||                                    ||                               || is 64800 minutes                  |
   +-------------------------------------+--------------------------------+------------------------------------+

.. note:: The encrypted credential response including the PIN, is automatically purged after 90 days. Data associated with the shipment request itself, for example recipient name and address, email address, and telephone number, is kept by Yubico for 7 years, in order to comply with export control and financial legal requirements.