Security variables

Tokens, encryption, outbound REST hosts, masking and HashiCorp Vault

---

Variable	Choices/Defaults	Comments
VAULT_ADDR string		HashiCorp Vault address a valid HashiCorp Vault URL Base URL of a HashiCorp Vault server (e.g. https://vault.example.com:8200). When set together with VAULT_TOKEN, AnsibleForms can resolve credentials from Vault. A credential row in the local database can specify a vault_path; when present, the user/password are fetched from Vault at runtime instead of being read from the local encrypted columns.
VAULT_TOKEN string		HashiCorp Vault token a valid Vault token Authentication token used by AnsibleForms to read secrets from Vault. Required when VAULT_ADDR is set. Use a token with read-only access to the relevant secret paths.
VAULT_NAMESPACE string		HashiCorp Vault namespace Optional Vault Enterprise namespace. Sent as the X-Vault-Namespace header on every request.
VAULT_KV_VERSION number	Default: 2	Vault KV secret engine version 1, 2 Version of the Vault KV secret engine. Defaults to 2 (recommended). For KV v2, the client automatically inserts the /data/ segment in the API path if it is missing.
VAULT_DEFAULT_MOUNT string	Default: secret	Default Vault KV mount Default KV mount used when a credential’s vault_path is provided as a bare key (no slash). For example, with the default secret mount, vault_path = "myapp" resolves to secret/data/myapp (KV v2).
VAULT_CACHE_TTL_MS number	Default: 60000	Vault read cache TTL (ms) Time-to-live in milliseconds of the in-memory cache used by AnsibleForms when reading secrets from Vault. Lower this if you rotate secrets aggressively; raise it to reduce load on Vault.
VAULT_SKIP_VERIFY string	Default: false	Skip Vault TLS verification true, false Disable TLS certificate verification when calling Vault. For development/testing only — never enable this in production.
AZURE_GRAPH_URI string added in version 4.0.3	Default: https://graph.microsoft.com	The Azure Graph API base URI a valid base URI without slash on the end The Microsoft Graph endpoint the server calls at an Azure AD login to read the user’s group membership (/v1.0/me/transitiveMemberOf). Since 6.5.3 that call is made by the AnsibleForms server, not by the browser, so the server needs a route to it - behind an egress proxy set HTTPS_PROXY and NODE_USE_ENV_PROXY=1. Change it for a national cloud, e.g. https://graph.microsoft.us.
REST_ALLOWED_HOSTS string added in version 6.0.0	Default:	Whitelist of hosts/CIDRs reachable from REST expressions Comma-separated list of hostnames and/or CIDR ranges that REST helper functions (fn.fnRestBasic, fn.fnRestAdvanced, fn.fnRestJwt, fn.fnRestNtlm) are allowed to call. When set, only these destinations are allowed; everything else is blocked. When unset, no allow-list is applied (default behaviour, all hosts allowed). Hostnames are matched case-insensitively against the URL host; CIDRs are matched against the IPs that the host resolves to (so an entry like 10.0.0.0/8 blocks all private targets in that range regardless of which DNS name was used). Example: REST_ALLOWED_HOSTS=api.example.com,partner.api.com,10.20.0.0/16 Caveat: this only protects the AnsibleForms Node.js process. Ansible playbooks run on the host directly and bypass this guard.
REST_DENIED_HOSTS string added in version 6.0.0	Default:	Blacklist of hosts/CIDRs unreachable from REST expressions Comma-separated list of hostnames and/or CIDR ranges that REST helper functions (fn.fnRestBasic, fn.fnRestAdvanced, fn.fnRestJwt, fn.fnRestNtlm) must never call. Wins over REST_ALLOWED_HOSTS. Useful to lock down dangerous targets like cloud metadata services or your internal admin UIs: REST_DENIED_HOSTS=169.254.169.254,127.0.0.0/8,internal-secret.example Hostnames are matched case-insensitively against the URL host; CIDRs are matched against the IPs that the host resolves to. Caveat: this only protects the AnsibleForms Node.js process. Ansible playbooks run on the host directly and bypass this guard.
EXPRESSION_SANITIZER string added in version 6.3.0	Choices: off paranoid strict (default) legacy	Strictness of the server-side expression sanitizer off, paranoid, strict Server expressions (fields of type expression without runLocal) are evaluated on the server by any authenticated user. The sanitizer refuses anything that is not a call to an fn. or fnc. function. off : every server expression is refused, use runLocal instead. paranoid : only direct fn./fnc. calls. fn.fnTime().format('YYYY') is refused. strict (default) : fn./fnc. calls, and methods on their result. legacy : the rules of 6.2.1 and earlier, where anything is allowed once the expression starts with fn.. This allows remote code execution for every authenticated user. It exists only as a temporary escape hatch after an upgrade, can only be set in the real environment (docker-compose, kubernetes), shows as a warning on the status page, and logs every expression the strict rules would refuse. An unknown value falls back to strict.
ACCESS_TOKEN_SECRET string	Default: *** NOT REVEALED ***	Secret to encrypt access tokens a hard secret string AnsibleForm uses Basic Authentication as authentication mechanism. Once authenticated, the client uses a JWT (Json Web Token) for authorization (Bearer authorization header). This token is stored on the client side (i.e. browser cookie) and is signed with a secret key. To keep the communication between client and server safe, we strongly recommend you to set this secret.
ACCESS_TOKEN_EXPIRATION string	Default: 30m	Access token expiration a valid time indication A JWT (Json Web Token) is only valid for a certain amount of time. If someone would be able to intercept a communication packet and see the token, it would only be valid for a short time. After this short time, the client must refresh his access token using his refresh token.
ACCESS_TOKEN_REFRESH_EXPIRATION string	Default: 24h	Refresh token expiration a valid time indication Once the access token is expired, and the client tries to connect to the server, the client hits a 401 error (unauthorized). The client application captures this error, and calls the refresh API with its refresh token. If the refresh token is valid, the client gets a new set of access and refresh tokens and retries the last unauthorized api call with the renew access token. With this mechanism, the client can keep the user-connection open for a long time and avoid a sudden logout during a save action. If the client has not connected back to the server during the expiration time of the refresh token, the client is logged of and authentication is required again.
ACCESS_TOKEN_ISSUER string added in version 5.0.8	Default: ansibleforms	Issuer of the access token a valid issuer string The issuer of the access token is the name of the application that issues the token. This is used to verify the token on the server side. Also reverse proxies can be picky about the issuer being present.
ENCRYPTION_SECRET string	Default: *** NOT REVEALED ***	Database encryption secret a strong encryption string Ansible Forms encrypts passwords in the database using this secret. We strongly advise you to set a custom entryption secret to uniquely protect your passwords. The secret must be 32 character long, however, we extend or cut the secret if this is not the case.
REGEX_FILTER_JOB_OUTPUT string	Default: \[low\]	Filter out job output tasks an escaped regular expression Sometime, the job output is flooded with meaningless output, such as ‘Gathering Facts’, or ‘Includes’. You filter out these by add a piece of string in the taskname, i.e. [low] and then used regex \\[low\\] to hide this information. The output has a button Apply filter for the filtering to take effect.
MASK_EXTRAVARS_REGEX string	Default: password|secret|token	Regex to mask extravars values an escaped regular expression When you have sensitive extravars, such as passwords, tokens, keys, credentials, you do not want these to be shown in clear text in the extravars section of a job. By setting this regex, any extravar key matching this regex will have its value masked with ********. Note the regex will be case insensitive. Since 6.4.1 the value of every password field of the form is masked as well, whatever its key or model path - in list rows and yaml subforms too. The regex is for the other secrets, the ones that are not password fields.
EXTRAVARS_USER_FIELDS string	Default:	Which keys of the user go into the extravars empty, all, none, or a comma separated list of keys Every job carries the launching user as ansibleforms_user in its extravars. With an LDAP or Entra ID login that is the user’s full group membership plus every resolved role option, which for a directory user in a hundred groups is a hundred lines of extravars the playbook never reads - stored in the AWX job and in jobs.extravars, readable by anyone with access to the job. Leave it empty (the default) and the whole object is sent, exactly as in every release before this one. Set it to a comma separated list of top level keys, for example username,email,type, and only those are sent. Set it to none and ansibleforms_user is not sent at all. all is the default said out loud, useful for a form that must override a trimmed global setting. A single form can override this with its userExtravars property. The frontend __user__ object comes from the login token and is not affected, and neither are role checks or the form’s own roles list. Note : docs/faq.md suggests asserting on ansibleforms_user.groups inside a playbook as a defence in depth check. If you do that, keep groups in the list.