Self-hosting configuration

Cysmiq self-hosted deployments are configured through the Replicated Admin Console. This page documents the available configuration options.

Configuration

Basic settings for your deployment.

Option	Description
Organization Name	Your organization’s display name
Application Domain Name	The domain where Cysmiq will be accessible (required)

Expose Services

Choose how to make Cysmiq accessible from outside the cluster.

Mode	Description
DIY	Manual configuration for custom setups
Ingress	Standard Kubernetes Ingress (default)
Contour HTTPProxy	For clusters using Contour
NodePort	Direct NodePort access

Ingress options

When using Ingress mode:

Option	Description
Ingress Class Name	The IngressClass cluster resource name
Admin Console Hostname	Hostname for the Admin Console (leave blank to disable)
Cysmiq Hostname	Hostname for the main application
Use TLS with Ingress	Enable TLS termination (default: enabled)
Annotations	Custom annotations for your ingress controller

HTTPProxy options

When using Contour HTTPProxy mode:

Option	Description
HTTPProxy Hostname	The fully qualified domain name
Use TLS with HTTPProxy	Enable TLS termination (default: enabled). Use BYO TLS to have Cysmiq create the TLS secret from your certificate and key, or leave BYO TLS disabled to provision the secret externally
Annotations	Custom annotations (e.g., cert-manager settings)

NodePort options

When using NodePort mode:

Option	Description
Admin Console NodePort	Port for Admin Console (30000-32767)
Cysmiq HTTP NodePort	Port for HTTP access (30000-32767)
Cysmiq HTTPS NodePort	Port for HTTPS access (when BYO TLS enabled)
Caddy Service Custom Labels	Custom labels for the Caddy Service (YAML key value pairs)

Database

Choose between embedded or external MySQL.

Type	Description
Embedded MySQL	Managed MySQL instance within the cluster (default)
External Database	Connect to your own MySQL-compatible database

Embedded database options

Advanced MySQL fields appear after enabling Configure MySQL.

Option	Description	Default
Configure MySQL	Show advanced embedded MySQL configuration fields	Disabled
InnoDB Buffer Pool Size	Size of the InnoDB buffer pool for embedded MySQL. For dedicated database nodes, set this to 50% to 70% of available RAM	128M
Enable MySQL Slow Query Log	Log queries that exceed the configured slow query threshold	Enabled
MySQL Slow Query Long Query Time (seconds)	Slow query threshold in seconds. Fractional values are supported. Appears when Enable MySQL Slow Query Log is enabled	5
InnoDB Flush Log at Transaction Commit	Controls InnoDB durability and write throughput. Options are `1`, `2`, or `0`	1
Max Connections	Maximum simultaneous MySQL client connections	151
Max Allowed Packet	Maximum packet or generated string size. Accepts MySQL size notation such as `16M`, `64M`, or `1G`	16M
InnoDB Log File Size	Size of each InnoDB redo log file. Accepts MySQL size notation	48M
InnoDB Log Buffer Size	Memory buffer for InnoDB redo log data. Larger values can reduce disk writes for transactions that modify many rows. Accepts MySQL size notation	16M
InnoDB Flush Method	Method used to flush InnoDB data and log files. Options are `fsync`, `O_DIRECT`, or `O_DIRECT_NO_FSYNC`	fsync

External database options

Option	Description
Database Connection	Connection type (default: mysql)
Database Host	Hostname or IP of your database server
Database Port	Connection port (default: 3306)
Database Name	Database name (default: guardrails)
Database Username	Database user
Database Password	Database password

Storage

Customize persistent storage settings. Storage fields appear after enabling Configure Storage Settings.

Option	Description	Default
Configure Storage Settings	Show storage configuration fields	Disabled
Storage Class Name	Custom storage class for all PVCs	(cluster default)
MinIO Storage Size	Storage for object storage	10Gi
RabbitMQ Storage Size	Storage for message queue	8Gi
Redis KVDB Storage Size	Storage for key-value store	8Gi
MySQL Storage Size	Storage for embedded database	8Gi

Analysis service storage

Each analysis service can use either temporary (EmptyDir) or persistent storage. Choose the volume type first, then size.

Service	Volume Type Options	Default Size
Source Manager	EmptyDir / PVC	10Gi
Code Analysis	EmptyDir / PVC	10Gi
SBOM Analysis	EmptyDir / PVC	10Gi

RabbitMQ

Choose between embedded or external RabbitMQ.

Type	Description
Embedded RabbitMQ	Managed RabbitMQ within the cluster (default)
External RabbitMQ	Connect to your own RabbitMQ instance

Embedded RabbitMQ options

Option	Description	Default
Max Message Size (bytes)	Maximum RabbitMQ message size in bytes for embedded RabbitMQ. RabbitMQ’s hard ceiling is 536870912 bytes	16777216
Consumer Timeout (milliseconds)	Maximum time a consumer can take to acknowledge a delivery before RabbitMQ closes its channel	10800000 (3 hours)

External RabbitMQ options

Option	Description	Default
RabbitMQ Host	Hostname or IP	-
RabbitMQ Port	Connection port	5672
RabbitMQ User	Username	-
RabbitMQ Password	Password	-
RabbitMQ Virtual Host	Virtual host path	-

Mail

Configure SMTP for email notifications. Mail fields appear after enabling Configure Mail.

Option	Description
Configure Mail	Show SMTP configuration fields
Mailer	Mail transport type (default: smtp)
Mail Host	SMTP server hostname
Mail Port	SMTP port (default: 1025)
Mail From Address	Sender email address
Mail From Name	Sender display name
Mail Username	SMTP authentication username
Mail Password	SMTP authentication password
Mail Encryption	Encryption method (e.g., tls)

Resource Requests and Limits

Customize CPU and memory allocation for each service. CPU and memory request and limit fields appear after enabling Configure resource requests and limits.

Service	CPU Request	CPU Limit	Memory Request	Memory Limit
Cysmiq	100m	500m	128Mi	1Gi
Cysmiq Horizon	500m	2000m	4Gi	8Gi
Cysmiq WS	50m	200m	64Mi	512Mi
Cysmiq Scheduler	50m	200m	32Mi	256Mi
Code Analysis	50m	1000m	32Mi	1Gi
SBOM Analysis	50m	200m	32Mi	1Gi
Source Manager	50m	200m	64Mi	1Gi
Embedded Database	200m	1000m	512Mi	2Gi
RabbitMQ	256m	1000m	1Gi	2Gi
Redis KVDB	50m	200m	64Mi	1Gi
Redis Cache	50m	200m	64Mi	1500Mi
MinIO	200m	1000m	512Mi	1Gi

Additional options:

Redis Cache Max Memory
MinIO Ephemeral Storage Requests
MinIO Ephemeral Storage Limits
PHP Memory Limit: PHP memory_limit for the Cysmiq application. Default: 256M

Scaling

Configure replica counts for horizontal scaling. Fields appear after enabling Configure internal service scaling.

Service	Default Replicas
Cysmiq	1
Cysmiq Horizon	1
Cysmiq WS	1
Cysmiq Scheduler	1
Code Analysis	1
SBOM Analysis	1
Source Manager	1
Cysmiq Caddy	1

Networking

Option	Description	Default
IP Stack Mode	Dual Stack (IPv4+IPv6) or IPv6 Only	Dual Stack

Proxy

Configure HTTP proxy for outbound connections. Fields appear after enabling Configure HTTP Proxy.

Option	Description
HTTP_PROXY	HTTP proxy URL
HTTPS_PROXY	HTTPS proxy URL
NO_PROXY	Comma-separated hosts to exclude from proxying

Security

Option	Description	Default
Enforce SSL	Require HTTPS connections	Enabled
Enable Network Policies	Deploy NetworkPolicy resources	Disabled
Create Role and RoleBinding for Cysmiq	Grant the Cysmiq service account permission to get, list, and watch resources in the namespace. Disable this if RBAC is managed externally	Enabled
Use custom service account for Cysmiq	ServiceAccount name for Cysmiq pods when you manage service accounts outside the default deployment	-
Egress CIDRs	Allowed egress CIDR blocks for analysis services	10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7

BYO TLS Certificate

For Contour HTTPProxy, DIY, or NodePort exposure modes:

Option	Description
Use your own TLS certificate and key	Create the TLS secret from a PEM-encoded certificate and private key. Ignored for Ingress mode
TLS Certificate	PEM-encoded certificate (with chain)
TLS Private Key	PEM-encoded private key

For Contour HTTPProxy, the certificate creates the tls-<hostname> secret used by HTTPProxy. For DIY or NodePort, the certificate creates the guardrails-ai-tls secret used by Caddy and enables HTTPS on port 443.

Telemetry

Option	Description
Telemetry Mode	Send error telemetry to Cysmiq or disable collection

Scanning Configuration

Option	Description	Default
Enable Code-Analysis Memory Sampling	Memory profiling for analysis	Disabled
Code Analysis Process Pool Workers	Number of process workers	1
Code Analysis Thread Pool Workers	Number of thread workers	1
Enable GitHub Checks	Post check results to GitHub	Enabled
Enable GitHub PR Comments	Post PR comments	Enabled
Scan Concurrency Limit	Maximum concurrent scans	(unlimited)
Repository Max Concurrency Share	Maximum share of finite scan concurrency that one repository can use	0.65
Dependency Timeout	Timeout in seconds for source manager and object storage connections used by code analysis and SBOM analysis	300
Queue Timeout	Timeout in seconds for queue jobs in code analysis and SBOM analysis	600
App Custom Environment Variables	YAML key/value pairs appended to the Cysmiq application ConfigMap. Content must use `KEY: "value"` format	-

Overview

Core concepts

Assets

Scanning

Integrations

Vulnerability management

Policies

Views & Filters

Insights

Security & access

Self-hosting

Reference

Self-hosting configuration

Configuration

Expose Services

Ingress options

HTTPProxy options

NodePort options

Database

Embedded database options

External database options

Storage

Analysis service storage

RabbitMQ

Embedded RabbitMQ options

External RabbitMQ options

Mail

Resource Requests and Limits

Scaling

Networking

Proxy

Security

BYO TLS Certificate

Telemetry

Scanning Configuration

​Configuration

​Expose Services

​Ingress options

​HTTPProxy options

​NodePort options

​Database

​Embedded database options

​External database options

​Storage

​Analysis service storage

​RabbitMQ

​Embedded RabbitMQ options

​External RabbitMQ options

​Mail

​Resource Requests and Limits

​Scaling

​Networking

​Proxy

​Security

​BYO TLS Certificate

​Telemetry

​Scanning Configuration

Configuration

Expose Services

Ingress options

HTTPProxy options

NodePort options

Database

Embedded database options

External database options

Storage

Analysis service storage

RabbitMQ

Embedded RabbitMQ options

External RabbitMQ options

Mail

Resource Requests and Limits

Scaling

Networking

Proxy

Security

BYO TLS Certificate

Telemetry

Scanning Configuration