threshold/README.md

Threshold

Threshold provides simple and secure access to hosts and services. It is a community-maintained fork of HashiCorp Boundary Community Edition (CE).

About this fork

Threshold is a community fork of HashiCorp Boundary Community Edition. HashiCorp (an IBM company) archived the upstream Boundary CE repository on 2026-10-09 and announced that no further CE releases, maintenance updates, bug fixes or security patches are planned. Threshold continues maintenance of the Community Edition code base so that existing self-managed deployments can keep receiving fixes.

• Threshold is licensed under the Business Source License 1.1, the same license as the upstream code. The original license text and all copyright headers are preserved. See NOTICE for attribution.
• Threshold is not affiliated with, endorsed by, or sponsored by HashiCorp or IBM. "Boundary", "HashiCorp" and "HCP Boundary" are trademarks of their respective owners and are used here only to describe the origin of this project.
• Upstream project: https://github.com/hashicorp/boundary
• This repository: https://repo.anhonesthost.net/CyberCoveLLC/threshold

Compatibility with Boundary CE

This is the first phase of the rebrand and is designed to keep existing Boundary CE deployments working:

• The command-line binary is now threshold (built from cmd/threshold).
• The wire protocol, HTTP API paths (/v1), database schema, plugin protocol and configuration file format are unchanged.
• The Go module path is repo.anhonesthost.net/CyberCoveLLC/threshold (with /api and /sdk submodules); protobuf code has been regenerated for it.
• Release versions are still reported on the wire with the upstream Boundary v prefix so mixed clusters keep working. Threshold v is also accepted when parsing.

Environment variable and path fallbacks

Threshold prefers THRESHOLD_* environment variables, and transparently falls back to the legacy BOUNDARY_* name when the THRESHOLD_* variable is not set. For example THRESHOLD_ADDR, THRESHOLD_TOKEN, THRESHOLD_SCOPE_ID, THRESHOLD_KEYRING_TYPE, THRESHOLD_TOKEN_NAME, THRESHOLD_CONNECT_*, THRESHOLD_SKIP_CACHE_DAEMON and the other CLI and server variables are read first, then BOUNDARY_ADDR, BOUNDARY_TOKEN, and so on. A THRESHOLD_* variable that is set to a non-empty value always wins. Existing scripts and deployments that only set BOUNDARY_* variables do not need to change.

Notes:

• env://VAR references inside configuration files and flags (for example url = "env://BOUNDARY_POSTGRES_URL" or url = "env://THRESHOLD_POSTGRES_URL" as used by the bundled container config) name an environment variable literally and are not rewritten; keep using whichever variable name you export.
• threshold connect -exec exports both THRESHOLD_PROXIED_{PORT,IP,ADDR} and the legacy BOUNDARY_PROXIED_{PORT,IP,ADDR} variables to the child process.
• The container image entrypoint mirrors any BOUNDARY_* variables to the matching THRESHOLD_* variable when it is unset.

Other fallbacks:

Item	New	Legacy fallback
Client cache directory	~/.threshold	~/.boundary is used if it exists and ~/.threshold does not
Keyring entry (macOS Keychain / Windows Credential Manager)	Threshold Auth Token	HashiCorp Boundary Auth Token is read if the new entry is not found, and removed on threshold logout
Keyring prefix (pass, libsecret)	Threshold	HashiCorp_Boundary is read if the new entry is not found, and removed on threshold logout

Tokens are always written using the new names.

Building

make build        # builds bin/threshold (requires the embedded UI, see Makefile)
make build-no-ui  # builds bin/threshold without the embedded admin UI

The embedded admin UI is built from the upstream boundary-ui project and is not part of this repository.

Contributing

See CONTRIBUTING.md.