compute-runtime | string

Default: none

GPU compute runtime to enable: 'none', 'cuda', or 'rocm'.

'none': No GPU support (default)
'cuda': Enable NVIDIA CUDA GPU support
'rocm': Enable AMD ROCm GPU support When enabled, automatically installs container toolkit and configures GPU passthrough. Worker will be tagged with GPU capabilities for job targeting. Default: none

container-placement-strategy | string

Default: volume-locality

Container placement strategy (volume-locality, random, fewest-build-containers). Default: volume-locality

containerd-dns-proxy-enable | boolean

Enable containerd DNS proxy for container name resolution. Set to false to use external DNS servers directly. Default: false

containerd-dns-server | string

Default: 1.1.1.1,8.8.8.8

DNS servers for containerd containers (comma-separated). Used when containerd-dns-proxy-enable is false. Default: 1.1.1.1,8.8.8.8

default-build-logs-to-retain | int

Default number of build logs to retain per job. 0 means unlimited. Maps to CONCOURSE_DEFAULT_BUILD_LOGS_TO_RETAIN.

default-days-to-retain-build-logs | int

Default number of days to retain build logs. 0 means unlimited. Maps to CONCOURSE_DEFAULT_DAYS_TO_RETAIN_BUILD_LOGS.

enable-metrics | boolean

Enable Prometheus metrics endpoint on port 9391 and per-job status exporter on port 9358. When enabled, installs and runs concourse-exporter service that exposes job-level metrics. Default: false

encryption-key | string

Encryption key for Concourse database at-rest encryption. Required when migrating from an existing encrypted deployment. Maps to CONCOURSE_ENCRYPTION_KEY.

external-url | string

External URL for Concourse web UI (used for redirects and webhooks). If not set, automatically detects and uses http://<unit-ip>:<web-port> Important: Set this to your actual external URL if behind a proxy/NAT.

extra-local-users | string

Additional local users beyond the admin user, as comma-separated user:password-hash pairs. These are appended to CONCOURSE_ADD_LOCAL_USER alongside the admin user. Example: "oem:{BCRYPT_HASH},ci-bot:{BCRYPT_HASH}"

extra-web-flags | string

Extra CLI flags for 'concourse web', space-separated. Appended to the ExecStart command in the systemd service. Example: "--enable-across-step --enable-resource-causality"

gc-failed-grace-period | string

Grace period before cleaning up failed containers and volumes. Example: "1h", "30m". Empty means Concourse default. Maps to CONCOURSE_GC_FAILED_GRACE_PERIOD.

github-token | string

GitHub API token used to authenticate requests to the GitHub API, preventing rate limits when checking or downloading the latest version.

gpu-device-ids | string

Default: all

GPU device IDs to expose to worker (comma-separated). Use "all" to expose all GPUs, or specify devices like "0,1". Only used when compute-runtime is set to 'cuda' or 'rocm'. Default: all

http-proxy | string

HTTP proxy for Concourse web and worker processes. Written as http_proxy in both config.env and worker-config.env. Does not fall back to Juju model proxy settings. Example: "http://proxy.example.com:3128"

https-proxy | string

HTTPS proxy for Concourse web and worker processes. Written as https_proxy in both config.env and worker-config.env. Does not fall back to Juju model proxy settings. Example: "http://proxy.example.com:3128"

initial-admin-username | string

Default: admin

Initial admin user for Concourse authentication. Default: admin

ldap-bind-dn | string

LDAP bind DN for authentication (e.g., cn=admin,dc=example,dc=com). Maps to CONCOURSE_LDAP_BIND_DN.

ldap-bind-pw | string

LDAP bind password. Maps to CONCOURSE_LDAP_BIND_PW.

ldap-display-name | string

Display name for LDAP authentication provider. Maps to CONCOURSE_LDAP_DISPLAY_NAME.

ldap-group-search-base-dn | string

Base DN for LDAP group searches. Maps to CONCOURSE_LDAP_GROUP_SEARCH_BASE_DN.

ldap-group-search-filter | string

LDAP search filter for groups (e.g., '(objectClass=group)'). Maps to CONCOURSE_LDAP_GROUP_SEARCH_FILTER.

ldap-group-search-group-attr | string

LDAP attribute on group entries for member matching. Maps to CONCOURSE_LDAP_GROUP_SEARCH_GROUP_ATTR.

ldap-group-search-name-attr | string

LDAP attribute for group name. Maps to CONCOURSE_LDAP_GROUP_SEARCH_NAME_ATTR.

ldap-group-search-user-attr | string

LDAP attribute on user entries for group matching. Maps to CONCOURSE_LDAP_GROUP_SEARCH_USER_ATTR.

ldap-host | string

LDAP server hostname (e.g., ldap.example.com). Maps to CONCOURSE_LDAP_HOST.

ldap-user-search-base-dn | string

Base DN for LDAP user searches. Maps to CONCOURSE_LDAP_USER_SEARCH_BASE_DN.

ldap-user-search-email-attr | string

LDAP attribute for user email. Maps to CONCOURSE_LDAP_USER_SEARCH_EMAIL_ATTR.

ldap-user-search-filter | string

LDAP search filter for users (e.g., '(objectClass=person)'). Maps to CONCOURSE_LDAP_USER_SEARCH_FILTER.

ldap-user-search-id-attr | string

LDAP attribute used as the user ID. Maps to CONCOURSE_LDAP_USER_SEARCH_ID_ATTR.

ldap-user-search-name-attr | string

LDAP attribute for user display name. Maps to CONCOURSE_LDAP_USER_SEARCH_NAME_ATTR.

ldap-user-search-username | string

LDAP attribute to match against the username. Maps to CONCOURSE_LDAP_USER_SEARCH_USERNAME.

log-level | string

Default: info

Logging level for Concourse components (debug, info, warn, error). Default: info

main-team-ldap-group | string

Comma-separated list of LDAP groups for the main team. Example: "group-a,group-b" Maps to CONCOURSE_MAIN_TEAM_LDAP_GROUP.

main-team-local-user | string

Comma-separated list of local users for main team authorization. These users are granted owner-level access to the main team. Example: "admin,oem" Maps to CONCOURSE_MAIN_TEAM_LOCAL_USER. Defaults to initial-admin-username when not set. Note: users listed here must also exist in extra-local-users (or via LDAP) to be able to log in; granting team access to a non-existent user has no effect but will not cause an error.

main-team-oauth-group | string

Comma-separated list of Generic OAuth groups for the main team. Example: "ci-admins,developers" Maps to CONCOURSE_MAIN_TEAM_OAUTH_GROUP.

main-team-oauth-user | string

Comma-separated list of Generic OAuth users for the main team. Example: "alice,bob" Maps to CONCOURSE_MAIN_TEAM_OAUTH_USER.

main-team-oidc-group | string

Comma-separated list of OIDC groups for the main team. Example: "ci-admins,developers" Maps to CONCOURSE_MAIN_TEAM_OIDC_GROUP.

main-team-oidc-user | string

Comma-separated list of OIDC users for the main team. Example: "alice,bob" Maps to CONCOURSE_MAIN_TEAM_OIDC_USER.

max-build-logs-to-retain | int

Maximum number of build logs to retain per job (overrides pipeline settings). 0 means unlimited. Maps to CONCOURSE_MAX_BUILD_LOGS_TO_RETAIN.

max-concurrent-downloads | int

Default: 10

Maximum number of concurrent resource downloads. Default: 10

max-days-to-retain-build-logs | int

Maximum days to retain build logs (overrides pipeline settings). 0 means unlimited. Maps to CONCOURSE_MAX_DAYS_TO_RETAIN_BUILD_LOGS.

mode | string

Default: auto

Deployment mode for this unit:

'auto': Leader runs web, non-leaders run workers (recommended for multi-unit)
'web': Only run web server
'worker': Only run worker Default: auto

no-proxy | string

Comma-separated list of hosts to bypass proxy for Concourse web and worker processes. Written as no_proxy in both config.env and worker-config.env. Does not fall back to Juju model proxy settings. Example: "localhost,127.0.0.1,10.0.0.0/8"

oauth-auth-url | string

Generic OAuth authorization URL. Maps to CONCOURSE_OAUTH_AUTH_URL.

oauth-ca-cert | string

Path to a CA certificate for the Generic OAuth provider. Maps to CONCOURSE_OAUTH_CA_CERT.

oauth-client-id | string

Generic OAuth client ID. Maps to CONCOURSE_OAUTH_CLIENT_ID.

oauth-client-secret | string

Generic OAuth client secret. Maps to CONCOURSE_OAUTH_CLIENT_SECRET.

oauth-display-name | string

Display name for a Generic OAuth authentication provider. Maps to CONCOURSE_OAUTH_DISPLAY_NAME.

oauth-groups-key | string

Generic OAuth claim/key containing group names. Maps to CONCOURSE_OAUTH_GROUPS_KEY.

oauth-scope | string

Additional Generic OAuth scopes. Maps to CONCOURSE_OAUTH_SCOPE.

oauth-skip-ssl-validation | boolean

Skip TLS certificate validation for the Generic OAuth provider. Maps to CONCOURSE_OAUTH_SKIP_SSL_VALIDATION.

oauth-token-url | string

Generic OAuth token URL. Maps to CONCOURSE_OAUTH_TOKEN_URL.

oauth-user-id-key | string

Generic OAuth claim/key used as the user ID. Maps to CONCOURSE_OAUTH_USER_ID_KEY.

oauth-user-name-key | string

Generic OAuth claim/key used as the username. Maps to CONCOURSE_OAUTH_USER_NAME_KEY.

oauth-userinfo-url | string

Generic OAuth userinfo URL. Maps to CONCOURSE_OAUTH_USERINFO_URL.

oidc-ca-cert | string

Path to a CA certificate for the OIDC provider. Maps to CONCOURSE_OIDC_CA_CERT.

oidc-client-id | string

OIDC client ID. Maps to CONCOURSE_OIDC_CLIENT_ID.

oidc-client-secret | string

OIDC client secret. Maps to CONCOURSE_OIDC_CLIENT_SECRET.

oidc-display-name | string

Display name for a Generic OIDC authentication provider. Maps to CONCOURSE_OIDC_DISPLAY_NAME.

oidc-groups-key | string

OIDC claim/key containing group names. Maps to CONCOURSE_OIDC_GROUPS_KEY.

oidc-issuer | string

OIDC issuer URL; used for discovery of auth/token/userinfo/jwks endpoints. Maps to CONCOURSE_OIDC_ISSUER.

oidc-scope | string

Additional OIDC scopes. Maps to CONCOURSE_OIDC_SCOPE.

oidc-skip-ssl-validation | boolean

Skip TLS certificate validation for the OIDC provider. Maps to CONCOURSE_OIDC_SKIP_SSL_VALIDATION.

oidc-user-name-key | string

OIDC claim/key used as the username. Maps to CONCOURSE_OIDC_USER_NAME_KEY.

secret-cache-duration | string

Default: 5m

How long to cache a successfully fetched credential. Increase to further reduce load on the credential server. If the credential manager returns a shorter lease duration, the shorter value is used. Only effective when secret-cache-enabled=true. Maps to CONCOURSE_SECRET_CACHE_DURATION. Example values: "1m", "5m", "1h"

secret-cache-duration-notfound | string

Default: 1m

How long to cache the absence of a credential (lookup returned not-found). Prevents Concourse from repeatedly querying for misconfigured or missing secrets. Only effective when secret-cache-enabled=true. Maps to CONCOURSE_SECRET_CACHE_DURATION_NOTFOUND. Example values: "10s", "30s"

secret-cache-enabled | boolean

Default: True

Enable caching of credentials fetched from the credential manager (e.g. Vault). Caching reduces the number of requests to the credential server by reusing previously fetched secrets for subsequent pipeline runs. Maps to CONCOURSE_SECRET_CACHE_ENABLED.

shared-storage | string

Default: none

Shared storage mode for LXC testing:

'none': Disable shared storage, each unit downloads independently (default)
'lxc': Enable LXC-mounted shared storage (requires .lxc_shared_storage marker) When set to 'lxc', units will wait for the marker file before proceeding. Default: none

tag | string

Comma-separated list of tags to assign to this worker. These are added to CONCOURSE_TAG and merged with any GPU-generated tags. Example: "gpu,high-mem,ssd"

tls-enabled | boolean

Enable TLS/HTTPS for Concourse web UI. Requires TLS certificate relation (future enhancement). Default: false

vault-auth-backend | string

Vault authentication backend (e.g., 'approle', 'token').

vault-auth-backend-max-ttl | string

Maximum TTL for the Vault authentication backend token. Example: '1h'

vault-auth-param | string

Comma-separated key-value pairs for the selected auth backend. Example: 'role_id:...,secret_id:...'

vault-ca-cert | string

Path to a PEM-encoded CA cert file to use for TLS to Vault.

vault-client-cert | string

Path to a PEM-encoded client certificate for TLS authentication to Vault.

vault-client-key | string

Path to an unencrypted, PEM-encoded private key for TLS authentication to Vault.

vault-client-token | string

Vault client token.

vault-enable-kv-mount-cache | boolean

Default: True

Enable caching of KV mount version detection to reduce preflight requests to Vault. When enabled, Concourse caches whether a Vault mount is KV v1 or KV v2, avoiding redundant /v1/sys/internal/ui/mounts preflight calls on every secret lookup. Maps to CONCOURSE_VAULT_ENABLE_KV_MOUNT_CACHE.

vault-lookup-templates | string

Vault lookup templates.

vault-namespace | string

Vault namespace.

vault-path-prefix | string

Prefix for all secret paths in Vault (e.g., '/concourse/my-team' or '/secrets'). Concourse looks up ((secret-name)) at: <vault-path-prefix>/<team>/<pipeline>/<secret-name> <vault-path-prefix>/<team>/<secret-name> When the vault-kv relation is active, this overrides the KV mount path that Vault provisioned automatically (default: '/charm-<app>-concourse'). Useful when you have existing secrets stored under a different path. Concourse only reads from this path; no data in Vault is written or deleted when this value changes. Note: the AppRole provisioned by the vault charm only covers the auto-provisioned mount by default — you may need to grant additional Vault policies for a pre-existing path. Maps to CONCOURSE_VAULT_PATH_PREFIX.

vault-shared-path | string

Shared path for Vault.

vault-url | string

URL of the Vault server. If set, enables Vault credential management. Example: https://vault.example.com:8200

version | string

Concourse CI version to deploy (e.g., 8.2.5). Leave empty to use the latest stable version.

web-port | int

Default: 8080

Port for Concourse web UI and API server. Supports dynamic changes with automatic service restart. Privileged ports (< 1024) are supported via CAP_NET_BIND_SERVICE. Default: 8080

worker-procs | int

Default: 1

Number of worker processes to spawn on this unit. Controls parallelism for job execution. Default: 1

Channel	Revision	Published	Runs on
latest/stable	65	21 Aug 2026	Ubuntu 24.04
latest/candidate	65	21 Aug 2026	Ubuntu 24.04
latest/beta	65	21 Aug 2026	Ubuntu 24.04
latest/edge	65	20 Aug 2026	Ubuntu 24.04

Concourse CI Machine