Environment variables

Authentication and API

Variable	Purpose
`NR_API_TOKEN`	Service account JWT (highest token priority)
`NR_ORGANIZATION_ID`	Organization UUID sent as `X-Organization-ID` (same as `--org-id`; required for `nr cluster register`)
`NODERINGS_API_TOKEN`	Alternate token env
`NR_TOKEN` / `NODERINGS_TOKEN`	Additional token fallbacks
`NR_API_URL`	Override API base URL
`API_BASE_URL` / `NODERINGS_API_URL`	Alternate API URL envs
`NR_FRONTEND_URL`	Override frontend base URL (OAuth browser flows)
`NODERINGS_FRONTEND_URL` / `FRONTEND_BASE_URL`	Alternate frontend URL envs
`NR_API_TLS_INSECURE` / `API_TLS_INSECURE`	Skip TLS verify (development only)

Proxmox operator (register)

Variable	Purpose
`PROXMOX_URL`	Proxmox API URL (`https://` required)
`PROXMOX_USERNAME`	API user (for example `nrings-operator@pve`)
`PROXMOX_TOKEN_ID`	Token ID
`PROXMOX_TOKEN_SECRET`	Token secret
`PROXMOX_INSTANCE_ID`	Optional instance id (default `proxmox-1`)
`PROXMOX_INSTANCES_FILE`	Path to multi-instance YAML (same as `--proxmox-instances-file`)

VirtFusion operator (register)

Variable	Purpose
`VIRTFUSION_URL`	Control origin only (`https://cp.example.com` — no `/api/v1`)
`VIRTFUSION_TOKEN`	Global API bearer token
`VIRTFUSION_INSTANCES_FILE`	Path to multi-instance YAML (same as `--virtfusion-instances-file`)

Use with --hypervisor-driver virtfusion. Full path: Get started (VirtFusion).

SolusVM 2 operator (register)

Variable	Purpose
`SOLUSVM_URL`	Management-node origin only (`https://mn.example.com` — no `/api/v1`, not `:5656`)
`SOLUSVM_TOKEN`	Admin API bearer token
`SOLUSVM_INSTANCES_FILE`	Path to multi-instance YAML (same as `--solusvm-instances-file`)

Use with --hypervisor-driver solusvm. Full path: Get started (SolusVM 2).

Operator / monitoring

Variable	Purpose
`MIMIR_BEARER_TOKEN`	Optional override for Alloy remote_write. If unset, register issues or rotates a metrics write credential via the API
`MIMIR_SERVICE_ENDPOINT`	Optional metrics endpoint host[:port] (production default is the platform metrics host)
`MIMIR_TLS_ENABLED`	Toggle TLS for the metrics endpoint (`1`/`0`); defaults to secure (TLS on)
`HELM_NAMESPACE` / `HELM_RELEASE`	Optional Helm namespace/release overrides
`VNC_GATEWAY_NAMESPACE`	Optional VNC gateway namespace override

Legacy MIMIR_USERNAME, MIMIR_PASSWORD, and MIMIR_PROVIDER_ORG_ID are not used. Tenant isolation is enforced server-side; the CLI does not set a client org header for writes.

Networking edge cases

Variable	Purpose
`NR_DNS_CHECK_IMAGE`	Container image used for DNS checks (air-gapped registries)
`NR_LIQO_GW_CLIENT_ADDRESS`	Optional Liqo gateway client address override
`NR_LIQO_GW_CLIENT_PORT`	Optional Liqo gateway client port override

Never commit tokens or hypervisor secrets. Pass them through your secret manager or a chmod 600 instances file on the agent host. Do not paste plaintext MIMIR_BEARER_TOKEN values into tickets or docs — leave it unset so the CLI manages rotation, or store it only in your secret manager.