Configuration

Settings the scanner reads at start, and where to put them on each platform.

Settings are read once when the service starts. After changing one, restart the service.

Setting	Default	What it does
`SURFACE_SCAN_INTERVAL`	`15m`	Time between scans
`SURFACE_FULL_PUSH_INTERVAL`	`24h`	How often a full report is sent. In between, only changes are sent. `0` turns full reports off
`SURFACE_LOG_LEVEL`	`info`	`debug`, `info`, `warn`, or `error`
`SURFACE_UPDATE_DISABLED`	`false`	Turn off self-update, for air-gapped laptops
`SURFACE_DRY_RUN`	`false`	Log what Block would do without doing it
`SURFACE_GATEWAY_URL`	SuperAlign gateway	The live channel for decisions. Set to `off` to disable. Decisions then arrive at the next scan
`SURFACE_MCP_PROBE`	`on`	Check remote connectors over the network. Connectors that run as local programs are never started
`SURFACE_PKG_SCAN`	`on`	Read the code of installed AI packages, without running it
`SURFACE_ENROLLMENT_TOKEN`	unset	The enrollment token, when delivered as an environment variable
`SURFACE_USER_EMAIL`, `SURFACE_USER_FULL_NAME`	unset	The person shown next to the hostname in the console

Where to set them

The EnvironmentVariables block in /Library/LaunchDaemons/com.superalign.surface.plist, then:

sudo launchctl bootout system/com.superalign.surface
sudo launchctl bootstrap system /Library/LaunchDaemons/com.superalign.surface.plist

An Environment= line in /lib/systemd/system/surface.service, or the managed file /etc/surface/managed.conf, then:

sudo systemctl daemon-reload && sudo systemctl restart surface.service

Machine-level environment variables, then restart the SurfaceScanner service.

Managed configuration

The enrollment token and user attribution can also come from your MDM. Environment variables win over the MDM setting. See MDM deployment for the keys on each platform.