Documentation / Reference
Project configuration and environment variables
Configure rippflow.yaml projects, local handler manifests, connection profiles and environment overrides.
Application project (rippflow.yaml)
rippflow.yaml binds your workflow definition, local handlers.json manifest, target runtime catalog, and build artifacts under apiVersion: rippflow.bookcicle.com/v1alpha1.
yaml
apiVersion: rippflow.bookcicle.com/v1alpha1
name: finance-reconciliation
workflow: workflows/reconcile.yaml
handlers: handlers.json
catalog: catalog/installed-groups.json
artifacts:
ingest:
runtimeGroup: python-light
entry: handlers/ingest.py
sha256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"Local handler manifest (handlers.json)
Maps logical phase service names (and optional byEnv tier overrides) to local command arrays for rippflow dev, rippflow test, and rippflow deploy --local:
json
{
"services": {
"ingest": {
"command": ["python3", "handlers/ingest.py"],
"timeout_secs": 30
}
}
}Browser login and environment variables
Browser OAuth PKCE sessions (rippflow login --installation-url <https-url>) are stored in your OS credential store and inspected with rippflow auth status and rippflow config show. Explicit CLI flags override environment variables, which override stored keyring sessions.
| Variable | Purpose |
|---|---|
RIPPFLOW_CONTROLLER_URL | Target HTTPS Controller endpoint (ControllerEndpointUrl on 1.10.0+ or legacy JwtApiUrl/MachineApiUrl on 1.0.x–1.9.x). |
RIPPFLOW_DEPLOYMENT_URL | Execution-plane AWS IAM endpoint for scoped-deployments-v1 publishing. |
RIPPFLOW_INSTALLATION_VERSION | Pins the target installation SemVer contract (for example, 1.0.4, 1.8.1, 1.9.0, or 1.10.0). |
RIPPFLOW_TOKEN / RIPPFLOW_MACHINE_TOKEN | Bearer or machine token sent via X-Rippflow-Machine-Token (and Authorization: Bearer; also accepts RIPPFLOW_ACCESS_TOKEN). |
RIPPFLOW_ENV | Runtime tier injected into child handlers (local, device, edge, or cloud; overridable via --rippflow-env). |
RIPPFLOW_LOCAL_CA_CERT | Path to the generated localhost TLS certificate automatically injected (alongside NODE_EXTRA_CA_CERTS) into local child handlers during rippflow deploy --local HTTPS runs. |
RIPPFLOW_CALLBACK_SIGNING_KEY | Optional local HMAC signing key seed for scoped_token_hmac callback tokens (scrubbed from child handler environments and redacted in logs). |
AWS_PROFILE | AWS credential profile used for SigV4-signed deployment and execution-plane requests. |
Verified sources
Checked 2026-11-05.
- Application project schema and catalog 7f5ea32 · main
- Handler manifest schema 7f5ea32 · main
- Profiles and environment resolution 7f5ea32 · main