mirror of
https://github.com/warmbly/warmbly.git
synced 2026-09-12 16:04:25 +00:00
57 lines
2.3 KiB
Bash
57 lines
2.3 KiB
Bash
# A worker on a machine you own, against a control plane elsewhere.
|
|
#
|
|
# Copy to worker.env and fill in. `warmbly join` writes the equivalent of this
|
|
# file for you; it is here so the hand-run path is not guesswork.
|
|
#
|
|
# What is NOT here is the point: no AWS access key, no bucket credential, no
|
|
# KMS key id, and no database DSN. A worker reaches relational data through the
|
|
# internal API, and the brokered providers below ask the control plane to
|
|
# perform the two operations that would otherwise need a cloud credential.
|
|
|
|
APP_ENV=prod
|
|
|
|
# One per machine, generated once: uuidgen. Keep it stable, because moving a
|
|
# mailbox to a different worker changes the client address its provider sees
|
|
# and buys a sign-in challenge for nothing.
|
|
WORKER_ID=
|
|
# Optional. Placement prefers a worker near where a mailbox's provider expects
|
|
# sign-ins. Blank is fine.
|
|
WARMBLY_NODE_REGION=
|
|
|
|
# --- the control plane ------------------------------------------------------
|
|
# One credential, for one instance, revocable from it.
|
|
ENCRYPTED_KEYS_PROVIDER=http
|
|
ENCRYPTED_KEYS_BACKEND_URL=https://api.example.com
|
|
ENCRYPTED_KEYS_WORKER_TOKEN=
|
|
INTERNAL_API_TOKEN=
|
|
|
|
# --- the bus and cache ------------------------------------------------------
|
|
# TLS on both: the bus carries recipient addresses and the cache carries each
|
|
# organization's decrypted data key.
|
|
EVENTBUS_PROVIDER=nats
|
|
NATS_URL=tls://<token>@bus.example.com:4222
|
|
CODEC_PROVIDER=json
|
|
REDIS=rediss://:<password>@bus.example.com:6380
|
|
|
|
# --- crypto and storage -----------------------------------------------------
|
|
# brokered: hold no key material and no bucket credential, and ask the control
|
|
# plane for the one privileged operation each. Blob bytes still travel directly
|
|
# between this machine and the object store.
|
|
KMS_PROVIDER=brokered
|
|
BLOB_PROVIDER=brokered
|
|
|
|
# Seals mailbox SMTP and IMAP passwords and OAuth tokens at rest. The same
|
|
# value as the control plane, or nothing this machine reads will decrypt.
|
|
CREDENTIALS_ENCRYPTION_KEY=
|
|
|
|
# --- mailbox OAuth clients --------------------------------------------------
|
|
# Needed to refresh Gmail and Microsoft 365 tokens. Plain SMTP and IMAP
|
|
# mailboxes need none of it.
|
|
BOX_GOOGLE_CLIENT_ID=
|
|
BOX_GOOGLE_CLIENT_SECRET=
|
|
BOX_OUTLOOK_CLIENT_ID=
|
|
BOX_OUTLOOK_CLIENT_SECRET=
|
|
|
|
# Real mailboxes present real certificates.
|
|
MAIL_TLS_INSECURE=false
|