Configuration

Reference for the server config grammar. Source: command/server/config.go and the block parsers in internalshared/configutil/.

File format

HCL or JSON. Conventionally /etc/vault.d/vault.hcl. Vault loads either a single file (-config=file) or a directory (-config=dir/, all .hcl/.json files merged).

Top-level keys

Key	Type	Notes
storage	block	Required. Selects the physical storage backend.
ha_storage	block	Optional separate HA backend if storage isn't HA-capable.
listener	block (multi)	At least one. The HTTP/HTTPS listeners clients talk to.
seal	block (multi)	Auto-unseal config; multiple allowed for redundancy (Enterprise).
cluster_addr	string	URL Vault advertises for cluster traffic (default port 8201).
api_addr	string	URL Vault advertises for client traffic.
cluster_name	string	Human-readable cluster identifier.
cluster_cipher_suites	string	Allowed cipher suites for cluster TLS.
disable_mlock	bool	Default false. Skip memory locking.
disable_cache	bool	Default false. Disable physical-backend read cache.
disable_clustering	bool	Don't bind the cluster listener.
disable_printable_check	bool	Diagnostic.
disable_sealwrap	bool	Don't seal-wrap critical paths.
disable_indexing	bool	Skip request-index header.
enable_ui / ui	bool	Enable serving /ui.
default_lease_ttl	duration	System-wide default lease TTL.
max_lease_ttl	duration	System-wide cap.
default_max_request_duration	duration	Cap on a single request.
raw_storage_endpoint	bool	Enable sys/raw (dev only).
pid_file	string	Path to write the PID file.
log_level, log_format, log_file, log_rotate_*	various	Logging knobs.
experiments	list	Enable opt-in experimental features.
entropy	block	Augment entropy from an HSM.
service_registration	block	Service discovery (Consul or Kubernetes).
telemetry	block	Metrics sink configuration.
replication	block (Enterprise)	Replication knobs (ignored in CE).
license_path	string (Enterprise)	License file path.
administrative_namespace_path	string (Enterprise)	Default namespace for admin tokens.
plugin_directory	string	Filesystem dir Vault scans for plugins.
plugin_file_uid, plugin_file_permissions	int	Constraints on plugin binary ownership/perms.

storage block

Selects one of the registered physical backends. The simplest:

storage "raft" {
  path    = "/vault/data"
  node_id = "node-1"
}

Backends and their parameters live under physical/<name>/. Common ones:

• raft — path, node_id, retry_join, performance_multiplier, max_entry_size, …
• consul — address, path, scheme, token, service, tls_*.
• postgresql — connection_url, table, ha_table, ha_enabled.
• mysql — similar to postgresql.
• dynamodb — region, table, endpoint, read_capacity, write_capacity.
• s3 — bucket, region, kms_key_id, etc.
• azure / gcs — cloud-specific.
• inmem — for tests only.

listener block

listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/etc/vault/tls/cert.pem"
  tls_key_file  = "/etc/vault/tls/key.pem"
  tls_min_version = "tls12"
}

Common fields:

• address, cluster_address
• tls_cert_file, tls_key_file, tls_client_ca_file, tls_min_version, tls_max_version, tls_cipher_suites, tls_disable, tls_require_and_verify_client_cert
• cors_enabled, cors_allowed_origins, cors_allowed_headers
• x_forwarded_for_authorized_addrs, x_forwarded_for_hop_skips
• proxy_protocol_behavior, proxy_protocol_authorized_addrs
• max_request_size, max_request_duration
• disable_request_limiter, request_priority (http/priority/)
• unauthenticated_metrics_access, unauthenticated_in_flight_request_access
• agent_api, proxy_api (for agent/proxy listener flavors)
• chroot_namespace (Enterprise)

seal block

seal "awskms" {
  region     = "us-east-1"
  kms_key_id = "alias/vault-seal"
}

Types: awskms, gcpckms, azurekeyvault, ocikms, transit, pkcs11 (Enterprise), aead (test).

Each delegates to the matching wrapper in github.com/hashicorp/go-kms-wrapping/v2/wrappers/<name>/. See Auto-unseal.

telemetry block

telemetry {
  prometheus_retention_time = "30s"
  disable_hostname          = true
}

Fields cover Prometheus, StatsD, statsite, Circonus, Datadog, Stackdriver. helper/metricsutil/ is where metrics are minted.

service_registration block

service_registration "consul" {
  address = "127.0.0.1:8500"
}

Or:

service_registration "kubernetes" { }

See serviceregistration/ for the implementations.

entropy block

entropy "seal" {
  mode = "augmentation"
}

Augment Go's crypto/rand with an HSM's RNG for paranoid environments.

replication block (Enterprise)

replication {
  resolver_discover_servers = true
  best_effort_wal_wait_duration = "10ms"
}

CE silently ignores the contents.

Reload behavior

SIGHUP reloads:

• Listener TLS certs (tls_cert_file, tls_key_file).
• Audit destinations (re-opens file device file paths).
• Telemetry sinks.
• License file (Enterprise).

Other fields require a restart.

Validation

vault operator diagnose -config=<file> runs a battery of checks on a config file before the server starts. See command/operator_diagnose.go.

Per-listener priority configuration

http/priority/ exposes optional per-tier request prioritization. Configured via request_priority on a listener block. Allows, for example, separating auth and login traffic from sensitive read operations.