diff --git a/docs/reference/cli/options.md b/docs/reference/cli/options.md
index 6692582..fc5e2ad 100644
--- a/docs/reference/cli/options.md
+++ b/docs/reference/cli/options.md
@@ -598,33 +598,37 @@ We don't recommend allowing all hostnames for production environments.
### `metrics-push-enabled`
-
+
-# Syntax
+
```bash
--metrics-push-enabled[=]
```
-# Example
+
+
```bash
--metrics-push-enabled=true
```
-# Environment variable
+
+
```bash
WEB3SIGNER_METRICS_PUSH_ENABLED=true
```
-# Configuration file
+
+
```bash
metrics-push-enabled=true
```
-
+
+
Enables or disables [push gateway integration](../../how-to/monitor/metrics.md#run-prometheus-with-web3signer-in-push-mode).
@@ -632,33 +636,37 @@ You can't specify `--metrics-push-enabled` with [`--metrics-enabled`](#metrics-e
### `metrics-push-host`
-
+
-# Syntax
+
```bash
--metrics-push-host=
```
-# Example
+
+
```bash
--metrics-push-host=127.0.0.1
```
-# Environment variable
+
+
```bash
WEB3SIGNER_METRICS_PUSH_HOST=127.0.0.1
```
-# Configuration file
+
+
```bash
metrics-push-host="127.0.0.1"
```
-
+
+
The host of the [Prometheus Push Gateway](https://github.com/prometheus/pushgateway). The default is `127.0.0.1`. The metrics server respects the [`--metrics-host-allowlist` option](#metrics-host-allowlist).
@@ -670,101 +678,112 @@ When pushing metrics, ensure you set `--metrics-push-host` to the machine on whi
### `metrics-push-interval`
-
+
-# Syntax
+
```bash
--metrics-push-interval=
```
-# Example
+
+
```bash
--metrics-push-interval=30
```
-# Environment variable
+
+
```bash
WEB3SIGNER_METRICS_PUSH_INTERVAL=30
```
-# Configuration file
+
+
```bash
metrics-push-interval=30
```
-
+
+
The interval, in seconds, to push metrics when in `push` mode. The default is 15.
### `metrics-push-port`
-
+
-# Syntax
+
```bash
--metrics-push-port=
```
-# Example
+
+
```bash
--metrics-push-port=6174
```
-# Environment variable
+
+
```bash
WEB3SIGNER_METRICS_PUSH_PORT=6174
```
-# Configuration file
+
+
```bash
metrics-push-port="6174"
```
-
+
+
The port (TCP) of the [Prometheus Push Gateway](https://github.com/prometheus/pushgateway). The default is `9001`.
### `metrics-push-prometheus-job`
-
+
-# Syntax
+
```bash
--metrics-push-prometheus-job=
```
-# Example
+
+
```bash
--metrics-push-prometheus-job="my-custom-job"
```
-# Environment variable
+
+
```bash
WEB3SIGNER_METRICS_PUSH_PROMETHEUS_JOB="my-custom-job"
```
-# Configuration file
+
+
```bash
metrics-push-prometheus-job="my-custom-job"
```
-
+
+
The job name when in `push` mode. The default is `web3signer-job`.
-
### `swagger-ui-enabled`
diff --git a/docs/reference/cli/subcommands.md b/docs/reference/cli/subcommands.md
index 2ff87b5..2cdf8d0 100644
--- a/docs/reference/cli/subcommands.md
+++ b/docs/reference/cli/subcommands.md
@@ -61,33 +61,37 @@ To view the command line help for the subcommands:
#### `aws-connection-cache-size`
-
+
-# Syntax
+
```bash
--aws-connection-cache-size=
```
-# Example
+
+
```bash
--aws-connection-cache-size=5
```
-# Environment variable
+
+
```bash
WEB3SIGNER_ETH1_AWS_CONNECTION_CACHE_SIZE=5
```
-# Configuration file
+
+
```bash
eth1.aws-connection-cache-size: 5
```
-
+
+
When [loading multiple keys from AWS Secrets Manager](../../how-to/store-keys/vaults/aws/secrets-manager-consensus-layer.md#cache-aws-secrets-manager-when-loading-multiple-keys),
@@ -96,99 +100,111 @@ The default is `1`.
#### `aws-endpoint-override`
-
+
-# Syntax
+
```bash
--aws-endpoint-override=
```
-# Example
+
+
```bash
--aws-endpoint-override=http://localstack:4566
```
-# Environment variable
+
+
```bash
WEB3SIGNER_ETH1_AWS_ENDPOINT_OVERRIDE=http://localstack:4566
```
-# Configuration file
+
+
```bash
eth1.aws-endpoint-override="http://localstack:4566"
```
-
+
+
Endpoint override for AWS KMS.
Useful for local testing against LocalStack.
#### `aws-kms-access-key-id`
-
+
-# Syntax
+
```bash
--aws-kms-access-key-id=
```
-# Example
+
+
```bash
--aws-kms-access-key-id=AKIA...EXAMPLE
```
-# Environment variable
+
+
```bash
WEB3SIGNER_ETH1_AWS_KMS_ACCESS_KEY_ID=AKIA...EXAMPLE
```
-# Configuration file
+
+
```bash
eth1.aws-kms-access-key-id: "AKIA...EXAMPLE"
```
-
+
+
AWS Access Key ID to authenticate AWS KMS.
Required when [`--aws-kms-auth-mode`](#aws-kms-auth-mode) is `SPECIFIED`.
#### `aws-kms-auth-mode`
-
+
-# Syntax
+
```bash
--aws-kms-auth-mode=
```
-# Example
+
+
```bash
--aws-kms-auth-mode=ENVIRONMENT
```
-# Environment variable
+
+
```bash
-WEB3SIGNER_ETH1_AWS_SECRETS_AUTH_MODE=ENVIRONMENT
+WEB3SIGNER_ETH1_AWS_KMS_AUTH_MODE=ENVIRONMENT
```
-# Configuration file
+
+
```bash
-eth1.aws-secrets-auth-mode: "ENVIRONMENT"
+eth1.aws-kms-auth-mode: "ENVIRONMENT"
```
-
+
+
Authentication mode for AWS KMS.
Options are `SPECIFIED` and `ENVIRONMENT`.
@@ -200,98 +216,110 @@ Set [`--aws-kms-access-key-id`](#aws-kms-access-key-id),
#### `aws-kms-client-cache-size`
-
+
-# Syntax
+
```bash
--aws-kms-client-cache-size=
```
-# Example
+
+
```bash
--aws-kms-client-cache-size=5
```
-# Environment variable
+
+
```bash
WEB3SIGNER_ETH1_AWS_KMS_CLIENT_CACHE_SIZE=5
```
-# Configuration file
+
+
```bash
eth1.aws-kms-client-cache-size: "5"
```
-
+
+
AWS KMS client cache size. Set to the total number of credentials
used to access the service plus the number of regions the service is accessed from. The default is `1`.
#### `aws-kms-enabled`
-
+
-# Syntax
+
```bash
--aws-kms-enabled=
```
-# Example
+
+
```bash
--aws-kms-enabled=true
```
-# Environment variable
+
+
```bash
WEB3SIGNER_ETH1_AWS_KMS_ENABLED=true
```
-# Configuration file
+
+
```bash
eth1.aws-kms-enabled: "true"
```
-
+
+
Set to `true` to enable bulk loading from the AWS KMS. The default is `false`.
#### `aws-kms-region`
-
+
-# Syntax
+
```bash
--aws-kms-region=
```
-# Example
+
+
```bash
--aws-kms-region=us-east-2
```
-# Environment variable
+
+
```bash
WEB3SIGNER_ETH1_AWS_KMS_REGION=us-east-2
```
-# Configuration file
+
+
```bash
eth1.aws-kms-region: "us-east-2"
```
-
+
+
AWS region where AWS KMS is available.
@@ -299,100 +327,111 @@ Required when [`--aws-kms-auth-mode`](#aws-kms-auth-mode) is `SPECIFIED`.
#### `aws-kms-secret-access-key`
-
+
-# Syntax
+
```bash
--aws-kms-secret-access-key=
```
-# Example
+
+
```bash
--aws-kms-secret-access-key=sk...EXAMPLE
```
-# Environment variable
+
+
```bash
WEB3SIGNER_ETH1_AWS_KMS_SECRET_ACCESS_KEY=sk...EXAMPLE
```
-# Configuration file
+
+
```bash
eth1.aws-kms-secret-access-key: "sk...EXAMPLE"
```
-
+
+
AWS secret access key to authenticate AWS KMS.
Required when [`--aws-kms-auth-mode`](#aws-kms-auth-mode) is `SPECIFIED`.
#### `aws-kms-tag-names-filter`
-
+
-# Syntax
+
```bash
--aws-kms-tag-names-filter=[,,...]
```
-# Example
+
+
```bash
--aws-kms-tag-names-filter=tagName1,tagName2
```
-# Environment variable
+
+
```bash
WEB3SIGNER_ETH1_AWS_KMS_TAG_NAMES_FILTER=tagName1,tagName2
```
-# Configuration file
+
+
```bash
eth1.aws-kms-tag-names-filter: ["tagName1","tagName2"]
-
```
-
+
+
Optional comma-separated list of tag names filter to apply while fetching key IDs from AWS KMS.
Applied as `AND` operation with other filters.
#### `aws-kms-tag-values-filter`
-
+
-# Syntax
+
```bash
--aws-kms-tag-values-filter=[,,...]
```
-# Example
+
+
```bash
--aws-kms-tag-values-filter=tagValue1,tagValue2
```
-# Environment variable
+
+
```bash
WEB3SIGNER_ETH1_AWS_KMS_TAG_VALUES_FILTER=tagValue1,tagValue2
```
-# Configuration file
+
+
```bash
eth1.aws-kms-tag-values-filter: ["tagValue1","tagValue2"]
```
-
+
+
Optional comma-separated list of tag values filter to apply while fetching key IDs from AWS KMS.
Applied as `AND` operation with other filters.