One TLS port, an optional path prefix, and a route that passes TLS through.
All settings are environment variables, read when the relay starts; restart after a change. Environment variables override the optional settings file your on-premise setup describes, which overrides the defaults. In the file, put lowercase names without the VAAS_ prefix under a vaas block, for example idle_timeout: 600.
| Variable | Default | Effect |
|---|---|---|
VAAS_PORT | 8443 (9443 in the container image) | TLS port for the WebSocket relay, the HTTPS API and health |
VAAS_BIND_ADDRESS | 0.0.0.0 | Address of the metrics listener |
VAAS_PATH_PREFIX | empty | Prefix for every public route, for example /vaas behind a router that keeps the path; health then answers at /vaas/health |
The relay terminates TLS itself and checks each client's credential, so a proxy in front must pass TLS through unchanged. On Kubernetes the chart's TCP route uses Traefik with ingressRoute.tcp.hostSni; without Traefik set ingressRoute.tcp.enabled: false and expose Service port 8443 with a TCP load balancer. When you set a path prefix, add it to the health probes, to every client address and to the address you give your applications.
How long applications wait, how many may wait, how large a frame may be.
| Variable | Default | Effect |
|---|---|---|
VAAS_HALF_OPEN_TIMEOUT | 30 | Seconds the first application waits for its partner |
VAAS_IDLE_TIMEOUT | 300 | Seconds without traffic in one direction before the relay ends; each direction is timed separately |
VAAS_MAX_SESSIONS_PER_CN | 100 | Waiting sessions allowed per account |
VAAS_MAX_TOTAL_SESSIONS | 10000 | Waiting sessions allowed across all accounts |
VAAS_MAX_FRAME_SIZE | 1048576 | Largest WebSocket frame and message, in bytes |
Raising the limits raises memory use. Lowering the timeouts frees idle capacity sooner but ends quiet sessions earlier. The join message must always arrive within 10 seconds of connecting; that limit is fixed. Sessions never resume.
Where data lives and what is kept.
| Variable | Default | Effect |
|---|---|---|
VAAS_DATABASE_URL | a file under /var/lib/vaas | Session record and daily totals. Leave the default; the directory must be writable by the service user of the image |
VAAS_RETENTION_DAYS | 7 | Days of detailed session record to keep; keep it above 2 |
VAAS_METRICS_ENABLED | true | Starts the metrics listener |
VAAS_METRICS_PORT | 9090 | Port for the metrics |
MAIT_CHANNEL | unset | Release channel of this relay: stable, beta or edge. For this relay it only labels metrics and daily totals. Without a value the label is unknown. Any other value stops the relay at start. Keep one value per database |
MAIT_LOG_FORMAT | unset | json for one JSON object per log line |
Keep the metrics listener on a private network and never expose it to peers. An invalid value, such as text where a number is expected or an unsupported MAIT_CHANNEL, stops the relay at start with failed to load vaas-server config.
How long members stay attached and whether relays share presence.
These apply when AIDCX containers join networks through the relay.
| Variable | Default | Effect |
|---|---|---|
VAAS_MESH_LEASE_SECS | 90 | Seconds a member stays attached without a heartbeat |
VAAS_MESH_SWEEP_INTERVAL_SECS | 15 | How often expired members are removed |
VAAS_MESH_FEDERATION_PEERS | empty | Comma-separated base addresses of other relays that receive this relay's mesh presence changes; empty turns it off |
VAAS_MESH_FEDERATION_CLIENT_CERT | empty | Path of a credentials file with the vaas:mesh feature that this relay presents to those relays |
What the Helm chart exposes.
| Value | Effect |
|---|---|
image.tag | The relay version to run |
channel | The release channel label, as for MAIT_CHANNEL |
liveAccess.url | The account-access address from your on-premise setup |
persistence.storageClass, persistence.size | The volume for /var/lib/vaas; the default is 2 GiB |
ingressRoute.tcp.enabled, ingressRoute.tcp.hostSni | The Traefik route that passes TLS through for your hostname |
replicaCount | Must stay 1; the chart refuses higher values |
env | Relay settings, including the four mesh settings with their defaults; supply the complete list, because a Helm list replaces the chart's entries |
Default resources are requests of 100m CPU and 64 MiB memory and limits of 500m CPU and 256 MiB. On a cluster that enforces network policies, add a policy that allows inbound traffic on 8443 from your ingress controller, on 9090 from your monitoring namespace if you scrape metrics, and outbound traffic from the relay to the account-access address. Start from helm show values ./vaas-server-chart.
Each application picks its own token and credential.
The relay does not push settings to applications. Each application is given the relay address, the server trust file and its own credential; applications that pair choose their own token, which must be fresh and unpredictable. The separate VaaS client command-line tool always uses the relay MAIT hosts for your channel and has no option for another address, so use the HTTP endpoints to list or end sessions on your own relay.