Configuration

Config File Location

Clonit keeps all of its state — config.yaml, the SQLite metadata database (clonit.db), and the login session (credentials.json) — in a single config directory. The default location follows your operating system’s convention:

OS	Config directory
macOS	~/Library/Application Support/clonit
Linux	$XDG_CONFIG_HOME/clonit (usually ~/.config/clonit)
Windows	%AppData%\clonit

Run clonit config path to print the exact directory your installation uses. Throughout these docs, <config-dir> refers to this directory.

Use the --config flag to specify an alternative config file path, or set CLONIT_CONFIG_DIR to relocate the entire state directory — config.yaml, clonit.db, and credentials.json all follow it:

CLONIT_CONFIG_DIR=~/Library/Application\ Support/clonit-dev clonit targets list

Separate development and production state

Clonit loads an optional .env.local file from the current directory (or the file named by CLONIT_ENV_FILE) before reading any configuration. Combined with CLONIT_CONFIG_DIR, this cleanly splits dev from prod: put a .env.local containing CLONIT_CONFIG_DIR=<dev state dir> in your development checkout, and every clonit invocation from that directory uses the dev config, database, and login session — while the installed binary run anywhere else uses the default location untouched.

Config File Example

A complete configuration file with all available options:

secret_key: <auto-generated-hex-key>
working_directory: ~/.clonit
env: production
log:
  level: info    # debug, info, warn, error
  format: text   # text, json
docker:
  images:
    postgres: postgres:latest
    mysql: mysql:8.0-oracle
defaults:
  dump_jobs: 4
  restore_jobs: 4
  auto_push: true

# Cloud integration (optional)
cloud:
  url: "https://cloud.clonit.ai"
  api_key: "clt_your_api_key_here"
  agent_id: ""   # auto-set after registration

# AWS identity (optional)
aws:
  profile: ""    # shared AWS profile for keyless database/storage access

# Sanitization analysis (optional)
analysis:
  api_key: "sk-ant-..."               # Anthropic API key
  model: "claude-sonnet-4-20250514"    # LLM model to use
  max_tokens: 8192                     # Max response tokens

Configuration Defaults

The following built-in defaults apply when no explicit value is provided in the config file, environment, or flags:

Key	Default	Description
secret_key	(empty)	AES encryption key for sensitive fields
working_directory	~/.clonit	Directory for snapshot files
log.level	info	Log level: debug, info, warn, error
log.format	text	Log format: text, json
env	production	Environment name
docker.images.postgres	postgres:latest	PostgreSQL Docker image
docker.images.mysql	mysql:8.0-oracle	MySQL Docker image
defaults.dump_jobs	4	Default parallel dump jobs
defaults.restore_jobs	4	Default parallel restore jobs
defaults.verify_urls	true	Verify URL connectivity on target add/update
defaults.auto_push	true	Automatically push snapshots produced by build, sanitize, and ephemeral (CLI and web UI) to the storage profile matching the snapshot type – originals to the target’s storage profile, sanitized snapshots to its sanitized storage profile, no fallback (snapshot stays local when unset). Push failures never fail the producing command. Override per run with --no-push.
rds_ca_bundle_path	(empty)	Path to the AWS RDS CA bundle. Required for targets with db_auth_mode=rds_iam — the agent refuses to send an IAM token over unverified TLS, so a keyless RDS connection fails closed when this is unset. When empty, clonit uses <config dir>/rds-global-bundle.pem — the keyless setup wizard can download the bundle there for you (no restart needed). Auto-located in AWS; must be provisioned out-of-AWS. See Keyless credentials.

Cloud Configuration

Key	Default	Description
cloud.url	(empty)	Clonit Cloud API URL
cloud.api_key	(empty)	API key for cloud authentication
cloud.agent_id	(empty)	Agent ID (set automatically after registration)

Analysis Configuration

Key	Default	Description
analysis.api_key	(empty)	Anthropic API key for sanitization analysis
analysis.model	claude-sonnet-4-20250514	LLM model for analysis
analysis.max_tokens	8192	Maximum response tokens

AWS Configuration

Key	Default	Description
aws.profile	(empty)	Name of a shared AWS profile (~/.aws) the agent uses for keyless database access and keyless storage when nothing more specific is set — a target’s own AWS Profile or a storage profile’s stored keys / AWS CLI profile still win. Empty means the ambient credential chain (environment variables, shared default profile, instance/task role). Also editable from the web UI at Settings → AWS (saved to this file, effective immediately). See Keyless credentials.

Environment Variables

All configuration keys can be set through environment variables. Use the prefix CLONIT_ and separate nested keys with _ (single underscore):

CLONIT_SECRET_KEY=mykey
CLONIT_LOG_LEVEL=debug
CLONIT_DEFAULTS_DUMP_JOBS=8
CLONIT_CLOUD_URL=https://cloud.clonit.ai
CLONIT_CLOUD_API_KEY=clt_your_key
CLONIT_ANALYSIS_API_KEY=sk-ant-...
CLONIT_AWS_PROFILE=my-sso-profile

The legacy double-underscore spelling (e.g. CLONIT_LOG__LEVEL) from before the 2026-07 separator standardization still works; if both spellings are set, the single-underscore variable wins.

Two special bootstrap variables are read directly from the environment (not via the config system): CLONIT_CONFIG_DIR (relocates the state directory) and CLONIT_ENV_FILE (names the dotenv override file, default .env.local).

Global Flags

These flags are available on every command:

Flag	Type	Default	Description
--config	string	<config-dir>/config.yaml	Path to config file (see Config File Location)
--debug	bool	false	Enable debug logging
--quiet	bool	false	Suppress non-essential output

Database

Clonit stores metadata (targets, snapshots, storage profiles, analyses, sanitization queries) in a SQLite database at:

<config-dir>/clonit.db

The database is created automatically on first run and kept up to date by migrations embedded in the binary. No manual migration steps are required.

Configuration Precedence

Configuration values are resolved in the following order, from highest to lowest priority:

1. Flags – command-line flags (--debug, --config, etc.)
2. Environment variables – CLONIT_* prefixed variables
3. Config file – values from config.yaml
4. Defaults – built-in defaults