Configuration

2501 is configured defaults-first. Every default (registry, ports, resources, Swarm and health settings) is embedded in the CLI binary, so you only specify what differs from those defaults.

​

Configuration files

​

The 2501-infra.yml overlay

2501-infra.yml is optional and deep-merged on top of the embedded defaults, so it only needs to hold the values you actually want to change. The CLI writes one for you when your deployment is non-default, such as a Kubernetes target, managed PostgreSQL, a stored registry key, or a pinned image tag. To see exactly what the CLI will apply, run 2501 infra config for the effective merged configuration, or 2501 infra config --defaults for just the embedded defaults. This is the quickest way to confirm a value before deploying.

​

Environment files

env.engine and env.command-center hold the environment variables for the Engine and the Command Center. The CLI generates, defaults, and copies everything it can, prompting for values it cannot supply, such as the external DATABASE_URL when you use your own PostgreSQL instance. Configure LLM providers and their credentials in Command Center.

​

Outbound proxy

Both the Engine and the Command Center honor HTTP_PROXY, HTTPS_PROXY and NO_PROXY for their outbound calls: the Engine for LLM providers and ticketing systems, the Command Center for the identity provider behind single sign-on. The Engine also sends MCP servers, OAuth providers and the requests of HTTP APIs that run on Main executor through it; an HTTP API that runs on a cluster connects directly from the cluster. Without these variables both dial out directly. The Command Center always reaches the Engine directly, so NO_PROXY does not need to list it.

• On Kubernetes, set proxy.http_url, proxy.https_url and proxy.no_proxy in 2501-infra.yml. The CLI writes them into both services on every generate.
• On Docker Swarm, set the three variables yourself in env.engine and env.command-center.

Each proxy URL needs an explicit http:// or https:// scheme and no path. NO_PROXY matches exact hostnames, .suffix domains, or literal IPs; CIDR ranges are ignored. The proxy must be a plain CONNECT tunnel: a proxy that re-signs TLS fails certificate verification.

​

Applying configuration

2501 infra deploy syncs your environment files to the current version’s spec on every run, generating and defaulting what it can and prompting only for human-required values. There is no separate apply step.