Environment Variables

Complete reference for all Synapse environment variables. Variables use the AX_ prefix for the canonical form; many also accept a shorter alias without the prefix (e.g. MODE = AX_MODE).

---

Application

Variable	Description	Default
MODE / AX_MODE	Deployment mode: proxy or agent	agent

---

Network & Firewall

Variable	Description	Default
NETWORK_IFACE / AX_NETWORK_IFACE	Primary network interface for XDP	eth0
NETWORK_IFACES / AX_NETWORK_IFACES	Additional interfaces, comma-separated	—
NETWORK_IP_VERSION	IP version filter: ipv4, ipv6, both	both
FIREWALL_MODE	Firewall backend: auto, xdp, nftables, iptables, none	auto

---

Gen0Sec Platform

Variable	Description	Default
API_KEY / AX_ARXIGNIS_API_KEY	Gen0Sec API key	—
BASE_URL / AX_ARXIGNIS_BASE_URL	Gen0Sec API base URL	https://api.gen0sec.com/v1
LOG_SENDING_ENABLED / AX_ARXIGNIS_LOG_SENDING_ENABLED	Send logs/events to API	true
AX_ARXIGNIS_INCLUDE_RESPONSE_BODY	Include response body in access logs	true
AX_ARXIGNIS_MAX_BODY_SIZE	Max body size to capture (bytes)	1048576

---

Threat Intelligence

Variable	Description	Default
THREAT_MMDB_URL / AX_ARXIGNIS_THREAT_MMDB_URL	Threat MMDB download URL	https://download.gen0sec.com/v1
THREAT_MMDB_PATH / AX_ARXIGNIS_THREAT_MMDB_PATH	Local path to store MMDB	/var/lib/synapse
AX_ARXIGNIS_THREAT_MMDB_REFRESH_SECS	Refresh interval (0 = disable auto-refresh)	300

---

GeoIP

Variable	Description	Default
GEOIP_COUNTRY_URL	Country MMDB download URL	—
GEOIP_COUNTRY_PATH	Local path	/var/lib/synapse
GEOIP_ASN_URL	ASN MMDB download URL	—
GEOIP_ASN_PATH	Local path	/var/lib/synapse
GEOIP_CITY_URL	City MMDB download URL	—
GEOIP_CITY_PATH	Local path	/var/lib/synapse
GEOIP_REFRESH_SECS	Refresh interval (seconds)	28800

---

Redis

Variable	Description	Default
REDIS_URL / AX_REDIS_URL	Redis connection URL	redis://127.0.0.1/0
REDIS_PREFIX / AX_REDIS_PREFIX	Redis key namespace prefix	ax:synapse

---

CAPTCHA

Variable	Description	Default
CAPTCHA_SITE_KEY / AX_CAPTCHA_SITE_KEY	CAPTCHA site key	—
CAPTCHA_SECRET_KEY / AX_CAPTCHA_SECRET_KEY	CAPTCHA secret key	—
CAPTCHA_JWT_SECRET / AX_CAPTCHA_JWT_SECRET	JWT secret for token signing	—
CAPTCHA_PROVIDER / AX_CAPTCHA_PROVIDER	hcaptcha, recaptcha, or turnstile	—
CAPTCHA_TOKEN_TTL / AX_CAPTCHA_TOKEN_TTL	Token validity (seconds)	7200
CAPTCHA_CACHE_TTL / AX_CAPTCHA_CACHE_TTL	Verification cache TTL (seconds)	300

---

Content Scanning

Variable	Description	Default
CONTENT_SCANNING_ENABLED / AX_CONTENT_SCANNING_ENABLED	Enable ClamAV scanning	false
CLAMAV_SERVER / AX_CLAMAV_SERVER	ClamAV TCP address	localhost:3310
CONTENT_MAX_FILE_SIZE / AX_CONTENT_MAX_FILE_SIZE	Max body size to scan (bytes)	10485760
CONTENT_SCAN_CONTENT_TYPES / AX_CONTENT_SCAN_CONTENT_TYPES	MIME types to scan (comma-separated)	—
CONTENT_SKIP_EXTENSIONS / AX_CONTENT_SKIP_EXTENSIONS	Extensions to skip (comma-separated)	—
CONTENT_SCAN_EXPRESSION / AX_CONTENT_SCAN_EXPRESSION	Wirefilter expression for scan trigger	—

---

Internal Services

Variable	Description	Default
INTERNAL_SERVICES_ENABLED	Enable internal HTTP server	true
INTERNAL_SERVICES_PORT	Internal server port	9180
INTERNAL_SERVICES_BIND_IP	Bind address	127.0.0.1

---

PROXY Protocol

Variable	Description	Default
PROXY_PROTOCOL_ENABLED	Enable PROXY protocol	false
PROXY_PROTOCOL_TIMEOUT	Timeout in milliseconds	1000

---

ACME / TLS

Variable	Description	Default
ACME_ENABLED	Enable automatic certificate provisioning	false
ACME_EMAIL	Contact email for Let's Encrypt	—
ACME_STORAGE_TYPE	redis or file	redis
ACME_PORT	ACME challenge server port	9180

---

BPF Statistics

Variable	Description	Default
BPF_STATS_ENABLED / AX_BPF_STATS_ENABLED	Enable BPF statistics collection	true
BPF_STATS_LOG_INTERVAL / AX_BPF_STATS_LOG_INTERVAL	Stats log interval (seconds)	60
AX_BPF_STATS_ENABLE_DROPPED_IP_EVENTS	Enable per-IP drop events	true
AX_BPF_STATS_DROPPED_IP_EVENTS_INTERVAL	Drop events interval (seconds)	30

---

TCP Fingerprinting

Variable	Description	Default
TCP_FINGERPRINT_ENABLED / AX_TCP_FINGERPRINT_ENABLED	Enable TCP fingerprinting	true
TCP_FINGERPRINT_LOG_INTERVAL / AX_TCP_FINGERPRINT_LOG_INTERVAL	Log interval (seconds)	60
AX_TCP_FINGERPRINT_ENABLE_FINGERPRINT_EVENTS	Enable fingerprint event sending	true
AX_TCP_FINGERPRINT_EVENTS_INTERVAL	Event interval (seconds)	30
AX_TCP_FINGERPRINT_MIN_PACKET_COUNT	Min packets before fingerprint is recorded	3
AX_TCP_FINGERPRINT_MIN_CONNECTION_DURATION	Min connection duration (seconds)	1

---

Daemon mode

Variable	Description	Default
DAEMON_ENABLED / AX_DAEMON_ENABLED	Run as background daemon	false
DAEMON_PID_FILE / AX_DAEMON_PID_FILE	PID file path	/var/run/synapse.pid
DAEMON_WORKING_DIRECTORY / AX_DAEMON_WORKING_DIRECTORY	Working directory	/
AX_DAEMON_ACCESS_LOG	Access log path	/var/log/synapse/access.log
AX_DAEMON_ERROR_LOG	Error log path	/var/log/synapse/error.log
DAEMON_USER / AX_DAEMON_USER	Drop privileges to this user	—
DAEMON_GROUP / AX_DAEMON_GROUP	Drop privileges to this group	—
AX_DAEMON_CHOWN_PID_FILE	Change PID file ownership to daemon user/group	true

---

Logging

Variable	Description	Default
LOGGING_LEVEL / AX_LOGGING_LEVEL	Log level: error, warn, info, debug, trace	info
LOGGING_FILE_ENABLED	Enable file logging	false
LOGGING_DIRECTORY	Log directory	/var/log/synapse
LOGGING_MAX_FILE_SIZE	Max log file size (bytes)	104857600
LOGGING_FILE_COUNT	Number of rotated log files to keep	10
LOGGING_SYSLOG_ENABLED	Enable syslog (Linux only)	false
LOGGING_SYSLOG_FACILITY	Syslog facility	daemon
LOGGING_SYSLOG_IDENTIFIER	Syslog identifier	synapse
LOGGING_ETW_ENABLED	Enable ETW (Windows only)	false

---

Runtime

Variable	Description	Default
TOKIO_WORKER_THREADS	Tokio async runtime thread count	CPU core count