Configuration Reference

Concourse is configured through a YAML file mounted at /etc/concourse/config.yaml. All values can also be set via environment variables or CLI arguments.

Config layering

Configuration values are resolved in this order (highest priority first):

1. CLI arguments
2. Environment variables
3. YAML config file
4. Built-in defaults

Environment variable interpolation

The config file supports environment variable substitution:

• ${VAR} — substitutes the value of VAR. Fails if unset.
• ${VAR:-default} — substitutes the value of VAR, or default if unset.

Full config.yaml

server:
  host: 0.0.0.0                        # Bind address
  port: 8080                            # Listen port
  jwt_secret: ${CONCOURSE_JWT_SECRET}   # Required. Min 32 bytes.
  public_url: ${CONCOURSE_PUBLIC_URL:-} # For client autodiscovery
  name: ${CONCOURSE_NAME:-My Company}   # Organization display name
  extensions_url: ${CONCOURSE_EXTENSIONS_URL:-} # Extension registry URL

database:
  url: ${DATABASE_URL:-sqlite:///data/concourse.db}

auth:
  password_enabled: true
  oidc:
    enabled: false
    issuer: https://accounts.google.com
    client_id: ${OIDC_CLIENT_ID}
    client_secret: ${OIDC_CLIENT_SECRET}
    redirect_uri: ${OIDC_REDIRECT_URI:-http://localhost:8080/api/v1/auth/oidc/callback}
  saml:
    enabled: false
    metadata_url: ${SAML_METADATA_URL}
    entity_id: ${SAML_ENTITY_ID:-https://concourse.example.com}
    acs_url: ${SAML_ACS_URL:-http://localhost:8080/api/v1/auth/saml/acs}

bootstrap:
  admin_email: ${CONCOURSE_ADMIN_EMAIL}
  admin_password: ${CONCOURSE_ADMIN_PASSWORD}
  admin_name: ${CONCOURSE_ADMIN_NAME:-}

audit:
  enabled: true
  database:
    url: ${AUDIT_DATABASE_URL:-file:///data/audit.db}
  webhook:
    enabled: false
    url: ${AUDIT_WEBHOOK_URL:-}
    headers:
      Authorization: Bearer ${AUDIT_WEBHOOK_TOKEN:-}
    batch_size: 100
    flush_interval_secs: 5
    timeout_secs: 30

Field reference

server

Field	Type	Default	Description
server.host	string	0.0.0.0	Bind address for the HTTP server.
server.port	integer	8080	Listen port for HTTP and WebSocket.
server.jwt_secret	string	—	Required. Secret used to sign JWT tokens. Must be at least 32 bytes.
server.public_url	string	—	Public URL of this Concourse instance. Used for client autodiscovery and SSO callback URLs.
server.name	string	My Company	Organization name displayed in the inboard app.
server.extensions_url	string	—	URL of the extension registry. Defaults to the inboard-hosted registry if unset.

database

Field	Type	Default	Description
database.url	string	sqlite:///data/concourse.db	Primary database URL. Supports sqlite://, file://, libsql://, and :memory:.

auth

Field	Type	Default	Description
auth.password_enabled	boolean	true	Enable email/password authentication.
auth.oidc.enabled	boolean	false	Enable OpenID Connect authentication.
auth.oidc.issuer	string	—	OIDC issuer URL (e.g., https://accounts.google.com).
auth.oidc.client_id	string	—	OIDC client ID from your identity provider.
auth.oidc.client_secret	string	—	OIDC client secret.
auth.oidc.redirect_uri	string	http://localhost:8080/api/v1/auth/oidc/callback	OIDC callback URL. Must match your IdP configuration.
auth.saml.enabled	boolean	false	Enable SAML 2.0 authentication.
auth.saml.metadata_url	string	—	URL to your IdP’s SAML metadata XML.
auth.saml.entity_id	string	https://concourse.example.com	SAML Service Provider entity ID.
auth.saml.acs_url	string	http://localhost:8080/api/v1/auth/saml/acs	SAML Assertion Consumer Service URL.

bootstrap

Field	Type	Default	Description
bootstrap.admin_email	string	—	Email for the initial admin user. Used only on first startup.
bootstrap.admin_password	string	—	Password for the initial admin user.
bootstrap.admin_name	string	—	Display name for the initial admin user.

audit

Field	Type	Default	Description
audit.enabled	boolean	true	Enable audit logging.
audit.database.url	string	file:///data/audit.db	Audit database URL. Separate from the primary database for tamper resistance.
audit.webhook.enabled	boolean	false	Enable webhook forwarding of audit events.
audit.webhook.url	string	—	SIEM or log collector webhook URL.
audit.webhook.headers	map	—	HTTP headers to include in webhook requests.
audit.webhook.batch_size	integer	100	Number of events to batch before sending.
audit.webhook.flush_interval_secs	integer	5	Maximum seconds between webhook flushes.
audit.webhook.timeout_secs	integer	30	HTTP timeout for webhook requests.