Configuration Reference
This page describes how a Manifest Self-Hosted deployment is configured: the setup wizard, the configuration file it writes, and how to change values after the platform is running. For the install workflow itself, see the Installation Guide.
The Setup Wizard
manifest-installer setup interactively prompts for deployment-specific values such as the base domain, the administrator email, and (optionally) SMTP, OIDC, and CA certificate settings. On re-runs, the prompts default to your previous answers, so you can hit Enter to accept or type a new value to change it.
If the wizard renders incorrectlyOver a serial console, a limited SSH client, or a screen reader, the full-screen interface can render garbled. Run
TERM=dumb manifest-installer setupto get the same questions as a plain line-by-line prompt flow with no screen redrawing.
Where Configuration Is Stored
Every answer — plus a set of workload credentials the installer generates for you (database passwords and similar) — is written to a single file, ~/.config/manifest/config.yaml (file mode 0600, inside a 0700 directory). That includes the sensitive values: the SMTP password, the OIDC client secret, the license key, and the generated workload passwords. config.yaml is the single durable copy of these values — it is the artifact to back up and protect. The wizard asks you to make an encryption choice before it writes anything; see Encryption & Key Management for the choices and the consequences of key loss.
Changing Configuration After Install
Change values by re-running the wizard (prompts default to your previous answers) or by editing the file directly with deploy-config edit, then re-run deploy to apply the changes to the running platform:
manifest-installer setup # or: manifest-installer deploy-config edit
manifest-installer deployRe-running deploy at the same version applies only what changed and does not restart healthy workloads.
Maintaining config.yaml
config.yamlThe deploy-config command groups the maintenance operations over config.yaml:
manifest-installer deploy-config validate # check completeness; offers to fill defaults and newly required values
manifest-installer deploy-config edit # decrypt into your editor, re-encrypt on save
manifest-installer deploy-config rekey --age <age1...> # add a recipient (second operator or escrow key)
manifest-installer deploy-config encrypt --age <age1...> # encrypt a plaintext config.yaml after the fact
manifest-installer deploy-config decrypt # print the decrypted config to stdout (reveals secrets)If your ops team prepares config.yaml on another machine, copy it into ~/.config/manifest/ (together with its key file, if setup generated a password-protected key), then run manifest-installer deploy-config validate to confirm it is complete for the version you're deploying.
Host Configuration
Storage Configuration
The following volume layout is recommended for production deployments:
| Volume | Size | Mount Point | Purpose |
|---|---|---|---|
| Root | 50-100 GB | / | Operating system, /etc, /usr, /bin |
| Persistent Data | 600 GB+ | /var/lib/rancher/k3s/storage/ | Kubernetes persistent volumes |
For larger deployments or environments with high data retention requirements, consider the following expanded layout:
| Volume | Size | Mount Point | Purpose |
|---|---|---|---|
| Root | 30-50 GB | / | Operating system, /etc, /usr, /bin |
| Runtime | 100-200 GB | /var/lib/rancher/k3s/, /var/lib/kubelet/, /var/log/ | k3s data, kubelet runtime, logs |
| Persistent Data | 600 GB+ | /var/lib/rancher/k3s/storage/ | Kubernetes persistent volumes |
Storage needs will increase over time with use. The kubelet manages garbage collection of container images using k3s defaults.
STIG Compliance
Manifest Self-Hosted supports deployment on STIG-hardened systems. The setup wizard includes a STIG-hardened option; when enabled, deploy applies the SELinux, nftables, and fapolicyd host components appropriate for the hardened host.
- SELinux: Supported on RHEL 9, including enforcing mode
- AppArmor: Supported on Ubuntu 24.04 and Debian 12
If you have additional questions about STIG-hardened deployments, FIPS 140-3 cryptography, or other compliance requirements, contact Manifest Cyber at [email protected].
OIDC Configuration
Manifest Self-Hosted natively supports Microsoft, Keycloak, and Google OIDC providers. Other providers are supported but require providing a base64-encoded mapper configuration for Kratos. All providers require the following information.
| Name | Description | Example |
|---|---|---|
| Provider | Name of OIDC provider (must be one of microsoft, keycloak, or google; otherwise a custom mapper url is required) | microsoft |
| Provider ID | Unique name of OIDC provider | microsoft |
| Friendly Name | Name that's displayed for users at sign-in (e.g. "Login with Microsoft") | Microsoft |
| Client ID | Client ID for OIDC application (may be called "application id") | abcd-1234-efgh-5678 |
| Client Secret | Secret value for OIDC application | xyz-098-qrs-765 |
| Issuer URL | Unique URL that identifies the OIDC provider (you can find this from your applications .well-known/openid-configuration endpoint) | https://login.microsoftonline.com/tenant-id/v2.0 |
| Mapper URL | Base64-encoded JSON snippet for mapping provider details to Kratos (leave blank for default providers) | base64://bG9jYWwgY2... |
| Requested Scopes | OIDC scopes that may be requested from the provider (leave blank for default providers) | openid,email,profile,offline_access (optional) |
Configuring the Redirect URI
To finish configuring your OIDC provider, you must add a redirect URI (callback URI) to your OIDC application. For the Manifest platform, the redirect URI is:
https://auth.<domain>/self-service/methods/oidc/callback/<provider-id>Replace <domain> with your Manifest deployment domain and <provider-id> with the Provider ID you configured.
Related Documentation
- Encryption & Key Management - How secrets in
config.yamlare encrypted - Post-Install - First login and certificate configuration
- Troubleshooting - Common configuration issues and solutions
Updated 3 days ago