unlinked-access/.env.dev.sample at main · ivpn/unlinked-access · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
##############################################################################
# DEVELOPMENT ONLY — DO NOT USE IN PRODUCTION
#
# This file enables insecure modes (mock signing, TLS disabled, plaintext
# data stores) that are required by the DEV_MODE guard added in all services.
# Copy to .env for local development: cp .env.dev.sample .env
#
# For production: cp .env.sample .env  (secure defaults, no DEV_MODE)
##############################################################################

DEV_MODE=true

# token:
TOKEN_HOST=token
TOKEN_PORT=50051
TOKEN_MOCK=true
TOKEN_DEBUG=false
AWS_TOKEN_KEY_ID=
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=
FORTANIX_ENDPOINT=
FORTANIX_API_KEY=
FORTANIX_KEY_ID=

# token TLS (mTLS) — server
# TOKEN_TLS_ENABLED=false allows the token service to start without certs in dev.
# Generate certs once with: scripts/gen-certs.sh (see README for instructions)
TOKEN_TLS_ENABLED=false
TOKEN_TLS_CERT_FILE=/certs/server.crt
TOKEN_TLS_KEY_FILE=/certs/server.key
TOKEN_TLS_CA_FILE=/certs/ca.crt

# token TLS — clients (generator + preauth)
TOKEN_TLS_CLIENT_CA_FILE=/certs/ca.crt
TOKEN_TLS_CLIENT_CERT_FILE=/certs/client.crt
TOKEN_TLS_CLIENT_KEY_FILE=/certs/client.key

# generator:
SERVER_DB_HOST=server-db
SERVER_DB_PORT=3306
SERVER_DB_NAME=server
SERVER_DB_USER=user
SERVER_DB_PASSWORD=password
SAMPLE_DATA=false
GENERATOR_MOCK=true
GENERATOR_TPS=10

# distributor:
DISTRIBUTOR_PORT=3001
DISTRIBUTOR_PSK=
API_TRUSTED_PROXIES=127.0.0.1,10.0.0.0/8,172.16.0.0/12
API_ALLOW_IPS=127.0.0.1

# preauth:
PREAUTH_ADD_PORT=3002
PREAUTH_ADD_PSK=
PREAUTH_GET_PORT=3003
PREAUTH_GET_PSK=
PREAUTH_TTL=60m
SESSION_SERVICE= # use comma to separate multiple entries
SESSION_URL= # use comma to separate multiple entries
SESSION_PSK= # use comma to separate multiple entries
REDIS_ADDR=redis:6379
REDIS_ADDRS=
REDIS_MASTER_NAME=
REDIS_USERNAME=
REDIS_PASSWORD=
REDIS_FAILOVER_USERNAME=
REDIS_FAILOVER_PASSWORD=
REDIS_TLS_ENABLED=false
REDIS_CERT_FILE=
REDIS_KEY_FILE=
REDIS_CA_CERT_FILE=
REDIS_TLS_INSECURE_SKIP_VERIFY=false

# verifier:
MANIFEST_URL=
MANIFEST_PSK=
CLIENT_DB_HOST=client-db
CLIENT_DB_PORT=3306
CLIENT_DB_NAME=client
CLIENT_DB_USER=user
CLIENT_DB_PASSWORD=password
CLIENT_DB_TABLE=subscriptions

CLIENT_DB_NOSQL_HOST= # set to enable MongoDB store, e.g. client-db-nosql
CLIENT_DB_NOSQL_PORT=27017
CLIENT_DB_NOSQL_NAME=client
CLIENT_DB_NOSQL_USER=user
CLIENT_DB_NOSQL_PASSWORD=password
CLIENT_DB_NOSQL_COLLECTION=subscriptions
CLIENT_DB_NOSQL_AUTH_SOURCE=admin

CLIENT_PGSQL_HOST=client-db
CLIENT_PGSQL_PORT=5432
CLIENT_PGSQL_NAME=client
CLIENT_PGSQL_USER=user
CLIENT_PGSQL_PASSWORD=password
CLIENT_PGSQL_TABLE=subscriptions
CLIENT_PGSQL_SSLMODE=disable