Skip to content

Configuration

Settings resolve in this order (first match wins): environment variable → config.toml → built-in default. The TOML path is CLOUDALONE_CONFIG (default /home/cloudalone/config.toml); cloudalone init writes one.

Settings

Setting Env var TOML key Default
Bearer token CLOUDALONE_TOKEN token dev-token
Backend CLOUDALONE_BACKEND backend stub (libvirt on a host)
Routed IPv6 prefix for VMs CLOUDALONE_IPV6_SLICE ipv6_slice 2001:bc8:1200:19:c10d::/80 (dev placeholder)
Host bridge CLOUDALONE_BRIDGE bridge br-cloud
libvirt URI CLOUDALONE_LIBVIRT_URI libvirt_uri qemu:///system
Domain type CLOUDALONE_DOMAIN_TYPE domain_type kvm (auto qemu without /dev/kvm)
Base directory CLOUDALONE_HOME home /home/cloudalone
SQLite path CLOUDALONE_DB db cloudalone.sqlite
Bind host CLOUDALONE_HOST host ::1
Bind port CLOUDALONE_PORT port 8000
Config file path CLOUDALONE_CONFIG — /home/cloudalone/config.toml

Notes:

  • ipv6_slice is the IPv6 prefix routed to the host that VMs draw addresses from; the default is only a dev placeholder; the deploy sets the real one. See IPv6 networking.
  • domain_type falls back to qemu (TCG emulation) automatically when there's no /dev/kvm (macOS, containers); same images, just slower.
  • The deploy's systemd unit injects CLOUDALONE_IPV6_SLICE / CLOUDALONE_HOME / CLOUDALONE_BACKEND so the running service can't be pinned to a stale config.toml.

Example config.toml

token = "CHANGE-ME-run-cloudalone-token"
# The IPv6 prefix ROUTED to this host; VMs draw addresses from it.
ipv6_slice = "2001:db8:abcd:100::/64"
home = "/home/cloudalone"
db = "/home/cloudalone/cloudalone.sqlite"
backend = "libvirt"               # "stub" for dev without VMs
libvirt_uri = "qemu:///system"
bridge = "br-cloud"
host = "::"
port = 8000

Generate one with cloudalone init; rotate the token with cloudalone token.

Security

  • serve refuses to start when the token is empty or dev-token unless you pass --dev (which forces a loopback bind).
  • The token is checked with a constant-time comparison on every route.
  • Behind Caddy, cloudalone binds 127.0.0.1; IPv6 is for the guests, not the control API.