Variables
Configuration precedence
Components can retrieve configuration parameters from several sources. The following order defines the precedence (from highest to lowest):
- Command-line argument (
--var=1) - Configuration file passed through command line (
--config-file) - Environment variable: uppercase the flag name, replace dashes with underscores, and prefix it.
- Agent and server:
GOAULD_(both share the same namespace, e.g.GOAULD_AGE_PUBLIC_KEY=...,GOAULD_HTTP_DOMAIN=...) - Client:
TEALC_(e.g.TEALC_ACCESS_TOKEN=...)
- Agent and server:
- Default configuration file (see Configuration file)
- The flag’s default value, as set in source, optionally overridden at build time via
-ldflagsortealc compile --env(see Compilation)
Variables of the form AGENT__AGE_PUBLIC_KEY, SERVER__HTTP_DOMAIN, CLIENT__..., etc. are a separate, compile-time-only mechanism: they are read from an env file (via tealc compile --env) and baked into the binary as build-time defaults (tier 5), not read from the process environment at runtime. Setting one of these as a shell environment variable before running the compiled binary has no effect.
The client’s -P/--password flag is an exception to the order above: its environment variable (TEALC_PASSWORD, tier 3) takes precedence over an explicit --config-file value (tier 2), the reverse of every other flag. This is required for tealc ssh (and the other commands that authenticate against an agent) to work correctly: tealc re-invokes itself as SSH_ASKPASS using TEALC_PASSWORD to carry a freshly prompted or otherwise runtime-resolved password, and that value must not be overridden by a stale --config-file entry.