DRS/.env.example at main · bigdatasciencegroup/DRS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
# drs-verify runtime configuration — public quickstart defaults.
#
# Copy to .env and edit as needed:
#   cp .env.example .env
#
# Unset (empty) values fall back to the drs-verify binary's built-in defaults.
# Nothing here is secret; any secret MUST be set out-of-band (Docker secrets,
# Kubernetes Secret, environment injection from a secret manager).

# -- Image / exposure ---------------------------------------------------------

# Pin a specific tag in production instead of :latest.
DRS_VERIFY_TAG=latest

# Host port that maps to container port 8080.
DRS_VERIFY_PORT=8080

# -- Logging ------------------------------------------------------------------

# debug | info | warn | error
LOG_LEVEL=info

# text | json — prefer json in production for log aggregators.
LOG_FORMAT=text

# -- Revocation ---------------------------------------------------------------

# Remote W3C Bitstring Status List URL. Leave blank to disable remote revocation.
# When set, /readyz waits for a successful first fetch before returning 200.
STATUS_LIST_BASE_URL=

# Cache TTL for the status list. A short TTL tightens revocation latency
# at the cost of more fetches.
STATUS_CACHE_TTL_SECS=300

# Bearer token for POST /admin/revoke. Leave blank to disable the endpoint
# (the handler returns 503 instead of 401, so callers see the difference).
# Generate with: openssl rand -hex 32
DRS_ADMIN_TOKEN=

# Filesystem path for the local revocation store. When set, /admin/revoke
# appends each revoked index to this file and calls fsync, so revocations
# survive container restart. Leave blank for in-memory mode (fastest, but
# /admin/revoke state is lost on restart). Parent dir is created if absent.
# Typical Docker volume mount: -v drs-revocation:/var/lib/drs-verify
REVOCATION_STORE_PATH=

# -- Replay protection --------------------------------------------------------

# Replay-protection backend:
#   memory (default) — in-process map; lost on restart; not replica-shared
#   redis            — shared across replicas and survives restart. REDIS_URL required.
NONCE_STORE_BACKEND=memory

# Redis connection URL for the redis nonce backend. Only read when
# NONCE_STORE_BACKEND=redis. Supports TLS via rediss://.
# Examples:
#   redis://localhost:6379/0
#   rediss://user:secret@redis.internal:6379/0
REDIS_URL=

# Max in-memory nonce (JTI) entries. Sized for expected concurrency × TTL.
# Ignored when NONCE_STORE_BACKEND=redis.
NONCE_STORE_MAX_ENTRIES=100000

# How long a JTI remains "seen" in the nonce store. Redis TTL mirrors this.
NONCE_STORE_TTL_SECS=900

# -- Server identity ----------------------------------------------------------

# Expected invocation.tool_server — invocations addressed to a different server
# will fail verification. Leave blank to disable this binding check.
SERVER_IDENTITY=

# -- Request handling ---------------------------------------------------------

# Hard cap on /verify request body bytes. 1 MiB default is plenty for typical
# delegation chains (≈10 receipts × ~8 KiB each).
MAX_BODY_BYTES=1048576

# -- Rate limiting ------------------------------------------------------------

# Sustained requests/sec per source IP.
RATE_LIMIT_PER_IP=100

# Sustained requests/sec across all IPs.
RATE_LIMIT_GLOBAL=1000

# Set to true ONLY when drs-verify runs behind a trusted reverse proxy
# (nginx, ALB, envoy) that attaches X-Forwarded-For. Otherwise spoofed XFF
# headers will allow per-IP limit bypass.
TRUST_PROXY=false

# -- did:web circuit breaker --------------------------------------------------

# Consecutive failures before the circuit opens for a did:web endpoint.
CIRCUIT_BREAKER_THRESHOLD=5

# Seconds the circuit stays open before a probe is allowed.
CIRCUIT_BREAKER_COOLDOWN_SECS=60

# -- Storage (optional) -------------------------------------------------------

# When STORE_DIR is set, receipts are persisted to the filesystem.
# Leave blank for Tier 0 (memory-only; receipts discarded on restart).
STORE_DIR=

# RFC 3161 timestamp authority URL. Only active when STORE_DIR is also set —
# enables Tier 3 storage with timestamped receipts.
TSA_URL=

# -- Metrics ------------------------------------------------------------------

# Separate listener address for the Prometheus /metrics endpoint.
# Leave blank to disable metrics entirely (safe production default).
#
# Dev (expose to host):        METRICS_ADDR=:9090
#   Also uncomment the 9090 port mapping in docker-compose.yml.
#
# Production (loopback only):  METRICS_ADDR=127.0.0.1:9090
#   Scraper must be a sidecar in the same container / pod.
#
# Kubernetes:                  METRICS_ADDR=127.0.0.1:9090
#   Use a NetworkPolicy to allow only the monitoring namespace to reach
#   pod port 9090.
#
# Generate Prometheus scrape target: http://<host>:9090/metrics
METRICS_ADDR=