Environment Variables
mac env
mac env lists settings that differ from the defaults; --all also shows the defaults,
including variables not listed on this page. Secrets are masked; do not share unmasked output. After a change,
restart the role and check mac status -v.
mac env
mac env --all
mac env set KEY=VALUE
mac env unset KEY
sudo mac env set --global KEY=VALUE
sudo mac env unset --global KEY
User settings in ~/.mac/env (mac env set) override node-wide settings in
/etc/mango/mac/env (--global), which override the package defaults. Keep the master
address, node name and token node-wide. To ignore user settings, prefix the command
with sudo env MAC_IGNORE_USER_ENV=1. If commands warn permission denied for ~/.mac,
fix its ownership with sudo chown.
Env files have no quoting, so mac env set refuses a value that starts with #, has #
after a space or tab, or has leading or trailing blanks.
Variable Reference
Common
| Variable | Purpose |
|---|---|
MASTER_IP | Master address; required on agents |
NODE_NAME | Node name; defaults to the hostname |
MAC_NODE_IP_PREFIX | Prefix selecting the host address on multi-address hosts |
MAC_REGISTRY | Image registry prefix |
SDK_AGENT_IMAGE | SDK agent image, for private mirrors or RHEL-family nodes |
MAC_VERSION | Image tag override; unset uses the installed version |
MAC_OFFLINE | true disables registry pulls; set by the offline installer |
MAC_LOG_LEVEL | debug, info (default), warn or error |
MAC_ADMIN_PASSWORD | Initial admin password, used only when no users exist |
MASTER_API_PORT, MASTER_WEB_PORT | API and dashboard ports; default 28080 and 23000 |
If mac status -v shows older images than mac version, unset MAC_VERSION. See
Installation for the ports
to open between hosts.
Node Authentication
MAC_NODE_TOKEN is shared by the master and agents.
- The first
sudo mac start mastercreates/etc/mango/mac/node_tokenif no token is set. - Copy it securely into each agent's node-wide
MAC_NODE_TOKEN; a mismatch prevents enrollment. - When enabling or rotating the token, restart the master first, then the agents.
TLS (HTTPS)
| Variable | Purpose |
|---|---|
MAC_TLS_ENABLED | true enables API and dashboard HTTPS |
MAC_TLS_CERT_DIR | Host directory containing server.crt and server.key |
MAC_TLS_CERT_FILE, MAC_TLS_KEY_FILE | Other file names in that directory, as /etc/mac/certs/<name> |
MAC_TLS_PORT, MAC_WEB_TLS_PORT | API and dashboard HTTPS ports; default 28443 and 23443 |
Without both files, the master does not start. HTTP ports stay open; restrict them with the host firewall if needed.
Switch Access
| Variable | Purpose |
|---|---|
SWITCH_USER | SSH user; default admin |
SWITCH_PASSWD_LIST | Comma-separated SSH password candidates |
SNMP_COMMUNITY | SNMP community; default public |
SWITCH_MGMT_CIDRS | Switch management CIDRs/IPs that may receive credentials |
gNMI Streaming Telemetry
SONiC switches with gNMI use it; others use SNMP. Set GNMI_USERNAME and
GNMI_PASSWORD; GNMI_ENABLED=false forces SNMP and GNMI_PORT defaults to 8080.
LLMBoost
| Variable | Purpose |
|---|---|
LLMBOOST_HOST_PORTS | Agent ports to probe for models; unset disables probing |
LLMBOOST_ENGINE_ENDPOINTS | Additional OpenAI-compatible engine URLs |
LLMBOOST_ENABLED | false disables LLMBoost integration |
LLMBOOST_DASHBOARD_URL | Grafana link |
K8S_API_ENDPOINT, K8S_API_TOKEN, K8S_NAMESPACES | Kubernetes discovery; see LLMBoost |
MASS and BMC
| Variable | Purpose |
|---|---|
MASS_API_ENDPOINT | MASS Manager API URL; unset disables integration |
MASS_DASHBOARD_URL | MASS dashboard link |
MASS_USERNAME, MASS_PASSWORD | MASS service account; set node-wide |
MAC_BMC_USER, MAC_BMC_PASSWORD | Default BMC credentials for nodes without their own |