docs: remove nonexistent TALOS_ prefix from Talos config env vars

docs/talos/operate/configure.md

@@ -3,10 +3,10 @@ title: Configure
 description: Configuration reference for Ory Talos
 ---
 
-Configure Ory Talos through a YAML file passed with the `--config` flag. Override any setting with `TALOS_`-prefixed environment
-variables (for example, `TALOS_DB_DSN` overrides `db.dsn`). The `--config` flag is the only configuration-related CLI flag;
-per-key flags don't exist. See the [configuration reference](../reference/config.mdx) for every key, type, default, environment
-variable mapping, and the precedence rules.
+Configure Ory Talos through a YAML file passed with the `--config` flag. Override any setting with environment variables (for
+example, `DB_DSN` overrides `db.dsn`). The `--config` flag is the only configuration-related CLI flag; per-key flags don't exist.
+See the [configuration reference](../reference/config.mdx) for every key, type, default, environment variable mapping, and the
+precedence rules.
 
 ## Hot-reload
 

docs/talos/operate/database/cockroachdb.md

@@ -23,7 +23,7 @@ db:
 Or use an environment variable:
 
 ```shell
-export TALOS_DB_DSN="cockroach://talos@crdb:26257/talos?sslmode=verify-full&max_conns=50"
+export DB_DSN="cockroach://talos@crdb:26257/talos?sslmode=verify-full&max_conns=50"
 ```
 
 ## DSN format

docs/talos/operate/database/mysql.md

@@ -21,7 +21,7 @@ db:
 Or set it through an environment variable:
 
 ```shell
-export TALOS_DB_DSN="mysql://talos:secret@tcp(db:3306)/talos?tls=true&parseTime=true"
+export DB_DSN="mysql://talos:secret@tcp(db:3306)/talos?tls=true&parseTime=true"
 ```
 
 ## DSN format

docs/talos/operate/database/postgresql.md

@@ -23,7 +23,7 @@ db:
 Or use an environment variable:
 
 ```shell
-export TALOS_DB_DSN="postgres://talos:secret@db:5432/talos?sslmode=require&max_conns=25&max_conn_lifetime=5m"
+export DB_DSN="postgres://talos:secret@db:5432/talos?sslmode=require&max_conns=25&max_conn_lifetime=5m"
 ```
 
 ## DSN format

docs/talos/operate/deploy/docker.md

@@ -17,9 +17,9 @@ can't silently change behavior, break your configuration, or run migrations on t
 docker run -d \
   -p 4420:4420 \
   -p 4422:4422 \
-  -e TALOS_SECRETS_HMAC_CURRENT="my-secret-must-be-at-least-32-characters-long" \
-  -e TALOS_CREDENTIALS_ISSUER="http://localhost:4420" \
-  -e TALOS_DB_DSN="sqlite:///var/lib/talos/talos.db" \
+  -e SECRETS_HMAC_CURRENT="my-secret-must-be-at-least-32-characters-long" \
+  -e CREDENTIALS_ISSUER="http://localhost:4420" \
+  -e DB_DSN="sqlite:///var/lib/talos/talos.db" \
   -v talos-data:/var/lib/talos \
   oryd/talos:<version-you-want> serve
 ```

docs/talos/operate/monitoring/tracing.md

@@ -43,10 +43,10 @@ Talos has no `tracing.tls` configuration block today. Rely on transport-layer co
 ## Environment variables
 
 ```shell
-export TALOS_TRACING_ENABLED=true
-export TALOS_TRACING_EXPORTER=otlp
-export TALOS_TRACING_ENDPOINT=otel-collector:4317
-export TALOS_TRACING_SAMPLE_RATE=0.01
+export TRACING_ENABLED=true
+export TRACING_EXPORTER=otlp
+export TRACING_ENDPOINT=otel-collector:4317
+export TRACING_SAMPLE_RATE=0.01
 ```
 
 The default `sample_rate` is `0.001` (0.1%). For a new deployment, set `0.1` (10%) or `1.0` (100%) until you have an SLO baseline,

docs/talos/operate/secrets.md

@@ -97,10 +97,10 @@ always stays well above the 32-char minimum.
 ## Environment variables
 
 ```shell
-export TALOS_SECRETS_HMAC_CURRENT="64-char-hmac-secret-required-for-key-operations"
-export TALOS_SECRETS_HMAC_RETIRED="previous-hmac-secret-1,previous-hmac-secret-2"
+export SECRETS_HMAC_CURRENT="64-char-hmac-secret-required-for-key-operations"
+export SECRETS_HMAC_RETIRED="previous-hmac-secret-1,previous-hmac-secret-2"
 ```
 
 Inject these from a secrets manager (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, or Kubernetes `Secret`). Never
 check secrets into version control. See the [Configuration reference](../reference/config.mdx) for the complete env-var mapping
-rules (`TALOS_`-prefix precedence, underscore-to-dot conversion, and list parsing).
+rules (precedence, underscore-to-dot conversion, and list parsing).

docs/talos/operate/security-hardening.md

@@ -58,8 +58,8 @@ Talos exits with `project has no HMAC key configured` if it's unset.
 openssl rand -base64 48 | tr -d '\n+/=' | cut -c1-64
 ```
 
-Inject as `TALOS_SECRETS_HMAC_CURRENT`. Don't use `talos jwk generate hmac` for this field: it produces a JWK JSON object, not a
-raw string.
+Inject as `SECRETS_HMAC_CURRENT`. Don't use `talos jwk generate hmac` for this field: it produces a JWK JSON object, not a raw
+string.
 
 ### Pagination cursor key (derived automatically)
 

docs/talos/operate/troubleshooting.md

@@ -86,7 +86,7 @@ log:
 Or via environment variable:
 
 ```shell
-export TALOS_LOG_LEVEL=debug
+export LOG_LEVEL=debug
 ```
 
 Ory Talos uses Go's `log/slog` and writes logs to stderr as JSON by default. There is no pretty-print mode. Redirect stderr to

docs/talos/reference/cli/talos-jwk-generate-ecdsa.md

@@ -51,7 +51,7 @@ talos jwk generate ecdsa [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-jwk-generate-eddsa.md

@@ -52,7 +52,7 @@ talos jwk generate eddsa [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-jwk-generate-hmac.md

@@ -50,7 +50,7 @@ talos jwk generate hmac [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-jwk-generate-rsa.md

@@ -54,7 +54,7 @@ talos jwk generate rsa [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-jwk-generate.md

@@ -27,7 +27,7 @@ Generate a new cryptographic key in JWK format for signing or encryption.
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-jwk-get.md

@@ -45,7 +45,7 @@ talos jwk get [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-jwk.md

@@ -28,7 +28,7 @@ algorithms.
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-batch-verify.md

@@ -30,7 +30,7 @@ talos keys batch-verify [credentials...] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-derive-token.md

@@ -36,7 +36,7 @@ talos keys derive-token [api-key-token] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-imported-batch-import.md

@@ -34,7 +34,7 @@ talos keys imported batch-import --file keys.json [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-imported-delete.md

@@ -29,7 +29,7 @@ talos keys imported delete [key-id] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-imported-get.md

@@ -29,7 +29,7 @@ talos keys imported get [key-id] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-imported-import.md

@@ -37,7 +37,7 @@ talos keys imported import [name] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-imported-list.md

@@ -33,7 +33,7 @@ talos keys imported list [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-imported-revoke.md

@@ -31,7 +31,7 @@ talos keys imported revoke [key-id] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-imported-update.md

@@ -36,7 +36,7 @@ talos keys imported update [key-id] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-imported.md

@@ -29,7 +29,7 @@ Import, list, get, update, revoke, and delete externally-created API keys.
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-issue.md

@@ -36,7 +36,7 @@ talos keys issue [name] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-issued-get.md

@@ -29,7 +29,7 @@ talos keys issued get [key-id] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-issued-issue.md

@@ -36,7 +36,7 @@ talos keys issued issue [name] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-issued-list.md

@@ -33,7 +33,7 @@ talos keys issued list [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-issued-revoke.md

@@ -31,7 +31,7 @@ talos keys issued revoke [key-id] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-issued-rotate.md

@@ -32,7 +32,7 @@ talos keys issued rotate [key-id] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-issued-update.md

@@ -36,7 +36,7 @@ talos keys issued update [key-id] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-issued.md

@@ -29,7 +29,7 @@ Get, list, update, and rotate issued API keys.
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys-self-revoke.md

@@ -32,7 +32,7 @@ talos keys self-revoke [credential] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
       --format string     Set the output format. One of table, json, yaml, json-pretty, jsonpath and jsonpointer. (default "table")
   -q, --quiet             Be quiet with output printing.

docs/talos/reference/cli/talos-keys-verify.md

@@ -34,7 +34,7 @@ talos keys verify [credential] [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-keys.md

@@ -29,7 +29,7 @@ Create, list, get, revoke, and rotate API keys.
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-migrate-down.md

@@ -50,7 +50,7 @@ talos migrate down [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-migrate-force.md

@@ -55,7 +55,7 @@ talos migrate force VERSION [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-migrate-status.md

@@ -47,7 +47,7 @@ talos migrate status [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```
 

docs/talos/reference/cli/talos-migrate-up.md

@@ -59,7 +59,7 @@ talos migrate up [flags]
 ### Options inherited from parent commands
 
 ```
-      --config string     path to a config file (without it, only schema defaults and TALOS_-prefixed env vars apply)
+      --config string     path to a config file (without it, only schema defaults and env vars apply)
   -e, --endpoint string   HTTP server base URL including scheme, e.g. http://host:port (for client commands) (default "http://localhost:4420")
 ```