EEM environment variables

Overview

See Config Files for the YAML companion to this reference.

Prefix Split: EEM_* vs EREBINE_*

The EEM agent uses the EEM_* prefix for every variable it reads through EEMAgentConfig.load. The only exception is EREBINE_EEM_METRICS_PORT, which is read directly in EEMAgentCLI before the config layer is materialised.

Do not set EREBINE_EEM_* for any other knob: those names are not read by the agent. The EIM inference agent uses a different prefix (EREBINE_AGENT_*); see EIM Agent Variables below.

Connection

Where the agent dials the router.

Name	Default	Purpose
`EEM_ROUTER_URL` required #	unset	HTTPS endpoint of the router used for enrollment and the data plane.
`EEM_JOIN_KEY` required #	unset	One-shot enrollment token issued by the router. Consumed on first boot.

Identity

How the agent advertises itself to the router.

Name	Default	Purpose
`EEM_REGISTRATION_NAME` required #	unset	Stable display name the router uses to track this agent across restarts.

Runtime

Concurrency, lease, and lifecycle tuning.

Name	Default	Purpose
`EEM_LEASE_RENEWAL_INTERVAL_MS` #	`10000`	Cadence (milliseconds) for lease renewal messages to the router.
`EEM_SHUTDOWN_GRACE_SECONDS` #	`30`	Time the agent waits for in-flight executions to finish on SIGTERM before forcing exit.
`EEM_MAX_CONCURRENT_EXECUTIONS` #	`20`	Ceiling on simultaneous tool executions handled by the agent.
`EEM_LOG_LEVEL` #	`info`	Log verbosity. One of `trace`, `debug`, `info`, `notice`, `warning`, `error`.

Filesystem Paths

Where the agent stores keys, queue state, and tool bundles.

Name	Default	Purpose
`EEM_TOOLS_DIR` #	`/var/lib/erebine/tools`	Directory of tool bundles the agent loads at startup.
`EEM_CREDENTIALS_DIR` #	`/var/lib/erebine/credentials`	Directory of per-workspace credential files referenced by `credentials_ref` in tool manifests.
`EEM_SIGNING_KEY_PATH` #	`/var/lib/erebine/agent-signing-key.hex`	Persisted Ed25519 signing-key file used to sign messages to the router.
`EEM_CURVE_KEY_PATH` #	`/var/lib/erebine/agent-curve-key.hex`	Persisted CURVE key-agreement private-key file.
`EEM_QUEUE_DB_PATH` #	`/var/lib/erebine/state/queue.sqlite`	SQLite file backing the outbound dispatch queue.

Router Callback

Credentials that let callback-dependent tools (for example, DeepThinkEemTool) dial back into the router. When the auth token is absent the agent leaves the callback nil and affected tools surface router_callback_missing rather than dispatching unauthenticated.

Name	Default	Purpose
`EEM_ROUTER_AUTH_TOKEN` optional #	unset	Bearer token used on router-callback requests.
`EEM_PROJECT_EXTERNAL_ID` optional #	unset	External project id (`ws_<hex>`) attached to callbacks for project-scoped routing.

Observability

Name	Default	Purpose
`EREBINE_EEM_METRICS_PORT` #	`9095`	TCP port for the Prometheus metrics HTTP server.
`EREBINE_OTEL_ENABLED` #	`false`	Enables distributed tracing emission. Set to `true` or `1`.
`EREBINE_OTEL_ENDPOINT` #	unset	OTLP collector endpoint URL for trace export.
`EREBINE_OTEL_SERVICE_NAME` #	service-supplied	Service name attribute attached to emitted spans.
`EREBINE_OTEL_SAMPLE_RATE` #	`1.0`	Trace sample rate between `0.0` and `1.0`.

EIM Agent Variables (Cross-Reference)

The EIM inference agent (erebine-eim-agent) is a separate binary that hosts vLLM and uses the EREBINE_AGENT_* prefix. Subset listed here; the full set lives in the inventory linked under Further Reading.

Name	Default	Purpose
`EREBINE_AGENT_JOIN_KEY` #	unset	Enrollment join key for the EIM agent. Alternative to `--join-key`.
`EREBINE_AGENT_ALLOW_INSECURE` #	unset	Set to `1` or `true` to allow non-HTTPS enrollment URLs (development only).
`EREBINE_AGENT_LOG_LEVEL` #	`info`	Log verbosity for the EIM agent process.
`EREBINE_AGENT_MAX_CONCURRENT` #	auto	Optional ceiling on concurrent inference requests.
`EREBINE_AGENT_METRICS_PORT` #	`9094`	Prometheus metrics port for the EIM agent.
`EREBINE_AGENT_VLLM_PATH` #	PATH lookup	Absolute path to the vLLM binary.
`EREBINE_AGENT_VLLM_SOCKET_PATH` #	`/tmp/erebine-engine.sock`	Unix socket path used to dial vLLM.
`EREBINE_AGENT_VLLM_SALT_SECRET` #	unset	Server secret for tenant-isolated cache keys.

Precedence

Configuration layers for the EEM agent resolve in this order (later wins):

// 1 defaults Built-in constants compiled into the agent.
// 2 eem.yaml File values from /etc/erebine/eem.yaml.
// 3 EEM_* env Process environment variables.
// 4 CLI flags erebine-eem-agent command-line flags.

Secrets such as EEM_JOIN_KEY and EEM_ROUTER_AUTH_TOKEN should flow through environment variables or a secrets manager, not committed YAML.