> For the complete documentation index, see [llms.txt](https://docs.caf.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.caf.io/caf-api/all-id/configuration.md).

# Configuration

Environment variables and service configuration for All ID.

## Peer Service environment variables

### Database configuration

| Variable         | Description                      | Example                                            | Required |
| ---------------- | -------------------------------- | -------------------------------------------------- | -------- |
| `MYSQL_DATABASE` | Database name for this peer      | `peer-default`                                     | Yes      |
| `MYSQL_IP`       | Database hostname or IP          | `database.cluster-xxx.us-east-1.rds.amazonaws.com` | Yes      |
| `MYSQL_PORT`     | Database port                    | `3306`                                             | Yes      |
| `MYSQL_USER`     | Database username (from secrets) | `admin`                                            | Yes      |
| `MYSQL_PSWD`     | Database password (from secrets) | `***`                                              | Yes      |

{% hint style="info" %}
**Multi-tenant setup**: Each peer instance should use its own database. Database names follow the pattern `peer-{name}` (e.g., `peer-default`, `peer-client-a`, `peer-client-b`).
{% endhint %}

{% hint style="warning" %}
`MYSQL_USER` and `MYSQL_PSWD` should be loaded from a secrets management system (AWS Secrets Manager, HashiCorp Vault, Kubernetes Secrets, etc.) and never hardcoded.
{% endhint %}

### REST API configuration

| Variable          | Description                | Example | Required |
| ----------------- | -------------------------- | ------- | -------- |
| `REST_PORT`       | HTTP port for Peer API     | `8080`  | Yes      |
| `COMMAND_TIMEOUT` | Request timeout in seconds | `10`    | Yes      |

### Facematch Service configuration

| Variable              | Description                               | Example           | Required |
| --------------------- | ----------------------------------------- | ----------------- | -------- |
| `FACEMATCH_IP`        | Facematch service hostname                | `facematch.allid` | Yes      |
| `FACEMATCH_PORT`      | Facematch service port                    | `8080`            | Yes      |
| `FACEMATCH_THRESHOLD` | Matching threshold for facial recognition | `1.2`             | Yes      |

{% hint style="info" %}
The `FACEMATCH_IP` uses DNS-based service discovery. Configure your DNS or service discovery system to resolve this hostname to available Facematch instances.
{% endhint %}

### Batch anonymization configuration

| Variable                                | Description                       | Example                                    | Required |
| --------------------------------------- | --------------------------------- | ------------------------------------------ | -------- |
| `BATCH_ANONYMIZATION_ENGINE_IMAGE_HASH` | Image processing engine hash      | `ca10aef257b96ad49fd46c5df95856486530a08f` | Yes      |
| `BATCH_ANONYMIZATION_ENGINE_MODEL_HASH` | ML model hash for anonymization   | `adf712b1b839cc6d72f1059afb2c2b8fb68d995c` | Yes      |
| `MAX_TASKS_ENABLED_PER_PEER`            | Maximum concurrent tasks per peer | `10000`                                    | Yes      |

{% hint style="warning" %}
The hash values ensure integrity of the ML models. Do not modify these values unless provided by Certta with updated models.
{% endhint %}

### RabbitMQ configuration (optional)

| Variable                                    | Description                 | Example                 | Required   |
| ------------------------------------------- | --------------------------- | ----------------------- | ---------- |
| `ENABLE_RABBITMQ`                           | Enable RabbitMQ integration | `false`                 | Yes        |
| `RABBITMQ_ANONYMIZATION_ERRORS_QUEUE_NAME`  | Error queue name            | `anonymization-errors`  | If enabled |
| `RABBITMQ_ANONYMIZED_ASSETS_QUEUE_NAME`     | Anonymized assets queue     | `anonymized-assets`     | If enabled |
| `RABBITMQ_NON_ANONYMIZED_ASSETS_QUEUE_NAME` | Non-anonymized assets queue | `non-anonymized-assets` | If enabled |

{% hint style="info" %}
RabbitMQ is disabled by default. Enable only if you need asynchronous message processing for batch operations.
{% endhint %}

### Redis cache configuration (optional)

| Variable                  | Description               | Example              | Required   |
| ------------------------- | ------------------------- | -------------------- | ---------- |
| `ENABLE_REDIS_CACHE`      | Enable Redis caching      | `false`              | Yes        |
| `ANONYMIZATION_CACHE_TTL` | Cache TTL in milliseconds | `300000` (5 minutes) | If enabled |

{% hint style="info" %}
Redis cache is disabled by default. Enable for improved performance in high-throughput scenarios.
{% endhint %}

### Router Service configuration (required)

| Variable                      | Description                      | Example                                                      | Required |
| ----------------------------- | -------------------------------- | ------------------------------------------------------------ | -------- |
| `ENABLE_ROUTER_COMMUNICATION` | Enable Certta Router integration | `true`                                                       | Yes      |
| `ROUTER_REST_URL`             | Certta Router endpoint URL       | `https://mtls.us.prd.caf.io/v1/biometrics/facial-validation` | Yes      |
| `ROUTER_PRIVATE_KEY`          | mTLS private key (from secrets)  | `-----BEGIN PRIVATE KEY-----\n...`                           | Yes      |
| `ROUTER_CERTIFICATE`          | mTLS certificate (from secrets)  | `-----BEGIN CERTIFICATE-----\n...`                           | Yes      |

{% hint style="danger" %}
**mTLS Authentication**: The Router communication requires mutual TLS (mTLS). The private key and certificate must be loaded from a secrets management system and never hardcoded.

Contact your Certta technical account manager to obtain the mTLS certificates for your environment.
{% endhint %}

## Facematch Service environment variables

The Facematch Service requires minimal configuration.

| Variable    | Description   | Default |
| ----------- | ------------- | ------- |
| `PORT`      | HTTP port     | `8080`  |
| `LOG_LEVEL` | Logging level | `INFO`  |

{% hint style="success" %}
The Facematch Service is designed to run with minimal configuration. It automatically loads ML models from the container image and listens on port 8080.
{% endhint %}

## Service discovery

Services discover each other using DNS-based service discovery.

### DNS names

Configure your service discovery system (e.g., AWS Cloud Map, Kubernetes DNS, Consul) to provide these DNS names:

```
facematch.biometrics → Resolves to Facematch Service IPs
peer-default.biometrics → Resolves to peer-default IPs
peer-client-a.biometrics → Resolves to peer-client-a IPs
peer-client-b.biometrics → Resolves to peer-client-b IPs
```

**Recommended DNS configuration**:

* DNS record type: A (IPv4)
* TTL: 15 seconds (for fast failover)

## Multi-tenant configuration

For multi-tenant deployments, each peer instance requires:

* Unique `MYSQL_DATABASE`: e.g., `peer-default`, `peer-client-a`, `peer-client-b`
* Unique Router mTLS certificate (loaded from separate secrets)
* Unique DNS name in service discovery
* Independent database with initialized schema

## Next steps

* Review [Technical Requirements](/caf-api/all-id/technical-requirements.md) for resource specifications
* Review [Production Guidance](/caf-api/all-id/production-guidance.md) for deployment instructions
* Review [Security Best Practices](/caf-api/all-id/security-best-practices.md) for secrets management
* Review [Facematch AI Documentation](/caf-api/all-id/ai-facematch-documentation.md) for more information about the engine AI model


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.caf.io/caf-api/all-id/configuration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.