Configuration
Every CLI flag, environment variable, and auth setting Tachyon supports.
Tachyon has no config file — every setting is a CLI flag, or the equivalent environment variable.
Flags and environment variables
| Flag | Env var | Default | Description |
|---|---|---|---|
--listen | TACHYON_LISTEN | 0.0.0.0:8108 | Address to listen on |
--data-dir | TACHYON_DATA_DIR | ./data | Directory for collections, segments, and the WAL |
--sync-interval-ms | TACHYON_SYNC_INTERVAL_MS | 0 | WAL fsync interval — 0 fsyncs before acknowledging every write |
--max-memtable-docs | TACHYON_MAX_MEMTABLE_DOCS | 100000 | Documents held in memory before a flush to a new segment |
--merge-trigger-segments | TACHYON_MERGE_TRIGGER_SEGMENTS | 8 | Segment count that triggers a background merge |
--merge-fan-in | TACHYON_MERGE_FAN_IN | 4 | Segments folded together per merge |
--admin-key | TACHYON_ADMIN_KEY | unset | API key with full read/write access |
--search-key | TACHYON_SEARCH_KEY | unset | API key with read-only access |
--log | TACHYON_LOG | info | Log filter, tracing-subscriber EnvFilter syntax |
--healthcheck | — | — | Check a locally running instance is healthy, then exit (used as the Docker HEALTHCHECK) |
See Persistence for what the memtable/segment/merge settings actually control.
Authentication
If neither --admin-key nor --search-key is set, Tachyon runs fully
open — anyone who can reach the port has full read/write access. That's
fine on localhost during development, and not fine on a network anyone
else can reach.
Once either key is set, requests must present it in the
x-tachyon-api-key header:
curl localhost:8108/collections \
-H 'x-tachyon-api-key: your-admin-key'- Admin key — full read and write access to every route.
- Search key — read-only: any request whose HTTP method isn't
GET/HEAD/OPTIONSis rejected with403 forbidden, even with a valid search key. Safe to embed in a client application. - A missing key on a route that requires one returns
401 unauthorized. /health, and the built-in/docsand/api-docs/openapi.jsonSwagger routes, are always public regardless of auth configuration.
For a production deployment, set --admin-key for your own tooling and
--search-key for anything client-facing.