Environment Variables

Configure a Private Location with environment variables. The agent reads them when it starts, so restart or redeploy it after changing a value.

Authentication and Connection¶

Variable	Default	Description
`ESCAPE_API_KEY`	Required unless `ESCAPE_AUTHORIZATION` is set	API key used to register the location and call the Escape API. The Helm chart can read it from `existingSecret` instead.
`ESCAPE_AUTHORIZATION`	Unset	Advanced authentication override. Its value is sent unchanged as the `Authorization` header and takes precedence over `ESCAPE_API_KEY`.
`ESCAPE_API_URL`	`https://public.escape.tech`	Escape API base URL. Use this only when Escape provides a different API endpoint.
`ESCAPE_PRIVATE_LOCATION_URL`	`private-location.escape.tech:2222`	SSH tunnel destination. Use this only when Escape provides a different tunnel endpoint.

Variable	Default	Description
`ESCAPE_CLI_RESTART_INTERVAL`	Unset. Helm: `24h`.	Schedules a clean process exit after a Go duration such as `24h`. The delay has a random jitter of plus or minus 10%, followed by 30 seconds before exit. With a restart policy, Kubernetes or Docker Compose then starts a new container. Invalid, zero, negative, and unset values disable the scheduled restart. This setting doesn't detect a disconnection: the agent retries its SSH connection independently.
`HEALTH_CHECK_PORT`	Unset. Helm: `8080`.	Starts the health server on this port. `GET /health` returns `200 OK` when the tunnel is connected and `503 Not connected` otherwise. No health server starts when the value is empty. Use a port of `1024` or higher because the image runs as a non-root user.
`ESCAPE_ENABLE_LOGS_ENDPOINT`	`false`	Set to `true` to add `POST /log` to the health server for a local log-forwarding proxy. It requires `HEALTH_CHECK_PORT`.
`ESCAPE_K8S_INTEGRATION`	`true`	Set to `false` to disable the Kubernetes API proxy and Kubernetes integration registration. Any other value enables it.
`KUBECONFIG`	In-cluster configuration	Path to the kubeconfig used by Kubernetes integration. It is used only when Kubernetes integration is enabled.

Variable	Default	Description
`ESCAPE_FRONTEND_PROXY_URL`	Unset	HTTP, HTTPS, or SOCKS5 proxy between the Private Location and Escape.
`ESCAPE_REPEATER_PROXY_URL`	Unset	Legacy name for the frontend proxy. If set, it takes precedence over `ESCAPE_FRONTEND_PROXY_URL`. Use `ESCAPE_FRONTEND_PROXY_URL` for new deployments.
`ESCAPE_BACKEND_PROXY_URL`	Unset	HTTP, HTTPS, or SOCKS5 proxy between the Private Location and the target API.
`ESCAPE_SSL_INSECURE`	Secure TLS verification	Set to `true` to skip TLS certificate verification. Use this only for troubleshooting or when you understand the risk.
`ESCAPE_SSL_CERT_PATH`	System trust store	Path to a PEM file containing one or more custom root CA certificates.

The Private Location doesn't use HTTP_PROXY, HTTPS_PROXY, or NO_PROXY. Use ESCAPE_FRONTEND_PROXY_URL and ESCAPE_BACKEND_PROXY_URL instead.

Variable	Default	Description
`ESCAPE_VERBOSITY`	`0`	Logging level: `0` for essential output, `1` for debug logs, `2` for trace logs, and `3` for trace logs with raw HTTP request and response details. Invalid values use `0`.
`ESCAPE_COLOR_DISABLED`	`false`	Set to `true` to disable ANSI color output.

The following are Helm values, not environment variables in the running container.

Helm value	Default	Description
`ESCAPE_PRIVATE_LOCATION`	Helm release name	Private Location name passed to `escape-cli locations start`.
`ESCAPE_API_KEY`	`00000000-0000-0000-0000-000000000000`	Placeholder API key. Replace it or configure `existingSecret`.
`existingSecret.name` and `existingSecret.key`	Empty	Existing Kubernetes Secret and key that supply `ESCAPE_API_KEY`. This takes precedence over the chart value.
`container.env`	`[]`	Additional environment variables to inject into the Private Location container.