Environment variables

Authentication and API

Variable	Purpose
`NR_API_TOKEN`	Service account JWT (highest token priority)
`NR_ORGANIZATION_ID`	Organization UUID sent as `X-Organization-ID` (same as `--org-id`; required for `nr cluster register`)
`NODERINGS_API_TOKEN`	Alternate token env
`NR_TOKEN` / `NODERINGS_TOKEN`	Additional token fallbacks
`NR_API_URL`	Override API base URL
`API_BASE_URL` / `NODERINGS_API_URL`	Alternate API URL envs
`NR_FRONTEND_URL`	Override frontend base URL (OAuth browser flows)
`NODERINGS_FRONTEND_URL` / `FRONTEND_BASE_URL`	Alternate frontend URL envs
`NR_API_TLS_INSECURE` / `API_TLS_INSECURE`	Skip TLS verify (development only)

Proxmox operator (register)

Variable	Purpose
`PROXMOX_URL`	Proxmox API URL (`https://` required)
`PROXMOX_USERNAME`	API user (for example `nrings-operator@pve`)
`PROXMOX_TOKEN_ID`	Token ID
`PROXMOX_TOKEN_SECRET`	Token secret
`PROXMOX_INSTANCE_ID`	Optional. Same name as the platform in the NodeRings UI (default `proxmox-1`)
`PROXMOX_INSTANCES_FILE`	Path to multi-instance YAML (same as `--proxmox-instances-file`)

VirtFusion operator (register)

Variable	Purpose
`VIRTFUSION_URL`	Control origin only (`https://cp.example.com` — no `/api/v1`)
`VIRTFUSION_TOKEN`	Global API bearer token
`VIRTFUSION_INSTANCES_FILE`	Path to multi-instance YAML (same as `--virtfusion-instances-file`)

Use with --hypervisor-driver virtfusion. Full path: Get started (VirtFusion).

SolusVM 2 operator (register)

Variable	Purpose
`SOLUSVM_URL`	Management-node origin only (`https://mn.example.com` — no `/api/v1`, not `:5656`)
`SOLUSVM_TOKEN`	Admin API bearer token
`SOLUSVM_INSTANCES_FILE`	Path to multi-instance YAML (same as `--solusvm-instances-file`)

Use with --hypervisor-driver solusvm. Full path: Get started (SolusVM 2).

Pterodactyl operator (register)

Variable	Purpose
`PTERODACTYL_PANEL_URL`	Panel origin (`http://` or `https://`, no path)
`PTERODACTYL_APPLICATION_KEY`	Application API key (`ptla_`). The value is the key.
`PTERODACTYL_CLIENT_KEY`	Client API key (`ptlc_`). The value is the key.
`PTERODACTYL_PANEL_USER_ID`	Numeric panel user id that owns NodeRings servers
`PTERODACTYL_OPERATOR_CHART`	Optional chart path or OCI reference

nr cluster register --pterodactyl and nr cluster install-pterodactyl ask for any of these that are unset. The prompt shows the keys as you type. --yes does not prompt, so export the key itself. Full path: Get started (Pterodactyl). Replacing a wrong URL or key is in Resume, recover, and roll back.

Operator / monitoring

Variable	Purpose
`MIMIR_BEARER_TOKEN`	Optional override for Alloy remote_write. If unset, register issues or rotates a metrics write credential via the API
`MIMIR_SERVICE_ENDPOINT`	Optional metrics endpoint host[:port] (production default is the platform metrics host)
`MIMIR_TLS_ENABLED`	Toggle TLS for the metrics endpoint (`1`/`0`); defaults to secure (TLS on)
`HELM_NAMESPACE` / `HELM_RELEASE`	Optional Helm namespace/release overrides
`VNC_GATEWAY_NAMESPACE`	Optional VNC gateway namespace override

Legacy MIMIR_USERNAME, MIMIR_PASSWORD, and MIMIR_PROVIDER_ORG_ID are not used. Tenant isolation is enforced server-side; the CLI does not set a client org header for writes.

Networking edge cases

Variable	Purpose
`NR_DNS_CHECK_IMAGE`	Container image used for DNS checks (air-gapped registries)
`NR_LIQO_GW_CLIENT_ADDRESS`	Optional Liqo gateway client address override
`NR_LIQO_GW_CLIENT_PORT`	Optional Liqo gateway client port override

Never commit tokens or hypervisor secrets. Pass them through your secret manager or a chmod 600 instances file on the agent host. Do not paste plaintext MIMIR_BEARER_TOKEN values into tickets or docs — leave it unset so the CLI manages rotation, or store it only in your secret manager.