Configuration
The settings of the CLI and the worker: flags, environment variables, files in the repository and worker.toml.
The CLI
| Flag | Meaning |
|---|---|
--json | Exactly one JSON document on stdout; progress still goes to stderr unless --quiet. |
--api-url <url> | The API origin; the default is https://ci.eu.ciresk.com, or CIRESK_CI_API_URL. |
--org <slug> | The organization whose stored token to use, when the keychain holds several. |
--timeout <dur> | Network timeout per request, default 30s. |
--quiet | No stderr progress. |
The full list is in CLI reference.
| Variable | Meaning |
|---|---|
CIRESK_TOKEN, CIRESK_CI_TOKEN | A csk_ key or an exchanged cix_ token, for machines and sandboxes. The OS keychain (from auth login) is read first. Never printed; ciresk ci passes it on only with --pass-token. |
CIRESK_CI_API_URL, CIRESK_API_URL | The API origin; ciresk ci config set server <url> stores one instead. |
CIRESK_JOB | The default for every [job] argument. run without --wait prints export CIRESK_JOB=job_... on stderr. |
CIRESK_ACTOR | Overrides the detected actor (user, agent:claude-code, agent:codex, ...). |
CIRESK_SESSION | Attributes a session to the job. |
CIRESK_CI_SKIP | 1 makes the push hooks skip the check once. |
CIRESK_CI_BIN | The binary the push hooks call; by default the CI plugin binary on PATH. |
CIRESK_REQUESTED_SCOPES | The scopes the GitHub Action asks for on exchange. |
NO_COLOR | Disables color, as do a non-tty stdout and --json. |
Files in the repository
| File | Content |
|---|---|
.ciresk/ci.yaml | The manifest: tasks, inputs, outputs, toolchains, workspace. See Manifest. |
.ciresk/ignore | gitignore syntax, anchored at the root: files that never travel to the cell, on top of .gitignore and the built-in list (.git, .hg/, .svn/, .jj/, target/, node_modules/). |
.ciresk/repo | The slug of a folder without a git remote, written on the first run; edit it to rename. |
.ciresk/<job>/ | Where ciresk ci artifacts <job> --download <name> puts a file unless --out <dir> says otherwise. |
.ciresk/out/<task>/ | On the worker: a task's output directory ($CIRESK_OUT). |
The worker: /etc/ciresk-ci/worker.toml
Precedence: command-line flag, then CIRESK_CI_* environment, then the file, then the default. ciresk-ci-worker join writes the file.
| Key | Env | Default | Meaning |
|---|---|---|---|
api_url | CIRESK_CI_API_URL | https://ci.eu.ciresk.com | The cell |
name | CIRESK_CI_WORKER_NAME | hostname | Unique per organization and factory |
factory_id | CIRESK_CI_FACTORY_ID | static | static or the pool id (aws:eu1-pool-a) |
labels | CIRESK_CI_LABELS | detected | Extra key=value pairs |
data_dir | CIRESK_CI_DATA_DIR | /var/lib/ciresk-ci | Mirrors, workspaces, mise, local cache, spool |
slots | CIRESK_CI_SLOTS | 1 | Concurrent tasks; one repository's warm workspace never runs two at once |
warm_workspaces | CIRESK_CI_WARM_WORKSPACES | true | Advertise workspace:warm |
run_user | CIRESK_CI_RUN_USER | ciresk-run | The unprivileged account tasks run as |
cpu_quota_pct, memory_per_slot_bytes | CIRESK_CI_CPU_QUOTA_PCT, CIRESK_CI_MEMORY_PER_SLOT_BYTES | all cores minus one, 90% of RAM, each divided by slots | What one slot stands for: the per-task cgroup caps; memory_max_bytes is still read as the same key |
egress_proxy | CIRESK_CI_EGRESS_PROXY | builtin | builtin, off (development only), or an external proxy URL |
idle_stop_secs | CIRESK_CI_IDLE_STOP_SECS | 0 | After this long without a lease the worker runs shutdown -h now; 0 never stops |
disk_quota_bytes | CIRESK_CI_DISK_QUOTA_BYTES | 80% of the data volume | The worker's local caches are evicted, least recently used first, to stay under it |
health_addr | CIRESK_CI_HEALTH_ADDR | 127.0.0.1:9471 | /healthz and /metrics, localhost only |
secrets_backend | CIRESK_CI_SECRETS | env | env, file:<dir>, aws-sm:<prefix>; where pass_env values come from (never a git credential: CIRESK_GIT_CREDENTIAL is refused, the cell holds git credentials) |
auto_update | CIRESK_CI_AUTO_UPDATE | true | Self-update between jobs; false to disable |
log_level | CIRESK_CI_LOG_LEVEL | info | The worker's own log |
The worker's health endpoint
http://127.0.0.1:9471/healthz answers {"state": "online", ...} (503 while the worker is not online) and /metrics exports Prometheus metrics; both bind localhost unless health_addr says otherwise. Do not expose it publicly.