threshold/README.md

# Threshold

Threshold provides simple and secure access to hosts and services. It is a
community-maintained fork of HashiCorp Boundary Community Edition (CE).

## About this fork

Threshold is a community fork of [HashiCorp Boundary Community Edition](https://github.com/hashicorp/boundary).
HashiCorp (an IBM company) archived the upstream Boundary CE repository on
2026-10-09 and announced that no further CE releases, maintenance updates, bug
fixes or security patches are planned. Threshold continues maintenance of the
Community Edition code base so that existing self-managed deployments can keep
receiving fixes.

- Threshold is licensed under the [Business Source License 1.1](LICENSE), the
  same license as the upstream code. The original license text and all
  copyright headers are preserved. See [NOTICE](NOTICE) for attribution.
- **Threshold is not affiliated with, endorsed by, or sponsored by HashiCorp or
  IBM.** "Boundary", "HashiCorp" and "HCP Boundary" are trademarks of their
  respective owners and are used here only to describe the origin of this
  project.
- Upstream project: <https://github.com/hashicorp/boundary>
- This repository: <https://repo.anhonesthost.net/CyberCoveLLC/threshold>

### Compatibility with Boundary CE

This is the first phase of the rebrand and is designed to keep existing
Boundary CE deployments working:

- The command-line binary is now `threshold` (built from `cmd/threshold`).
- The wire protocol, HTTP API paths (`/v1`), database schema, plugin protocol
  and configuration file format are unchanged.
- The Go module path is still `github.com/hashicorp/boundary` for now; it will
  change in a later phase together with regenerated protobuf code.
- Release versions are still reported on the wire with the upstream
  `Boundary v` prefix so mixed clusters keep working. `Threshold v` is also
  accepted when parsing.

### Environment variable and path fallbacks

Threshold prefers `THRESHOLD_*` environment variables, and transparently falls
back to the legacy `BOUNDARY_*` name when the `THRESHOLD_*` variable is not set.
For example `THRESHOLD_ADDR`, `THRESHOLD_TOKEN`, `THRESHOLD_SCOPE_ID`,
`THRESHOLD_KEYRING_TYPE`, `THRESHOLD_TOKEN_NAME`, `THRESHOLD_CONNECT_*`,
`THRESHOLD_SKIP_CACHE_DAEMON` and the other CLI and server variables are read
first, then `BOUNDARY_ADDR`, `BOUNDARY_TOKEN`, and so on. A `THRESHOLD_*` variable that is
set to a non-empty value always wins. Existing scripts and deployments that
only set `BOUNDARY_*` variables do not need to change.

Notes:

- `env://VAR` references inside configuration files and flags (for example
  `url = "env://BOUNDARY_POSTGRES_URL"` or `url = "env://THRESHOLD_POSTGRES_URL"`
  as used by the bundled container config) name an environment variable
  literally and are not rewritten; keep using whichever variable name you export.
- `threshold connect -exec` exports both `THRESHOLD_PROXIED_{PORT,IP,ADDR}` and
  the legacy `BOUNDARY_PROXIED_{PORT,IP,ADDR}` variables to the child process.
- The container image entrypoint mirrors any `BOUNDARY_*` variables to the
  matching `THRESHOLD_*` variable when it is unset.

Other fallbacks:

| Item | New | Legacy fallback |
|------|-----|-----------------|
| Client cache directory | `~/.threshold` | `~/.boundary` is used if it exists and `~/.threshold` does not |
| Keyring entry (macOS Keychain / Windows Credential Manager) | `Threshold Auth Token` | `HashiCorp Boundary Auth Token` is read if the new entry is not found, and removed on `threshold logout` |
| Keyring prefix (`pass`, libsecret) | `Threshold` | `HashiCorp_Boundary` is read if the new entry is not found, and removed on `threshold logout` |

Tokens are always written using the new names.

## Building

```
make build        # builds bin/threshold (requires the embedded UI, see Makefile)
make build-no-ui  # builds bin/threshold without the embedded admin UI
```

The embedded admin UI is built from the upstream `boundary-ui` project and is
not part of this repository.

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md).