# Apply migrations separately with a schema-owner DATABASE_URL and --migrate.
# The running service rejects SUPERUSER and BYPASSRLS connections.
DATABASE_URL=postgres://iam_app:CHANGE_ME@127.0.0.1:5432/iam
TENANT_ID=example-tenant
ENCRYPTION_KEY=replace-with-a-high-entropy-field-encryption-key
# LEGACY_ENCRYPTION_KEYS=previous-key
HMAC_SECRET_KEY=replace-with-a-service-secret
# This service publishes its session signing key at /api/auth/jwks; every
# service (this one included) verifies session JWTs against that URL.
JWKS_PUBLIC_KEY_URL=https://iam.example.com/api/auth/jwks
JWT_ISSUER=https://iam.example.com
JWT_AUDIENCE=https://api.example.com
# RS256 session JWTs (the default): configure all four values together, or omit
# all four for opaque sessions that only this service can verify.
# The PEM may be given verbatim or base64-encoded on one line; `forklaunch init
# module` writes a git-ignored development key to the root .env.
SESSION_JWT_PRIVATE_KEY_PEM=<base64 of an RSA private key PEM>
SESSION_JWT_KEY_ID=iam-session-key-1
SESSION_JWT_ISSUER=https://iam.example.com
SESSION_JWT_AUDIENCE=https://api.example.com
# Exact browser origins allowed to call IAM cross-origin, comma-separated.
# CORS_ORIGINS=https://app.example.com
# `iam --seed` creates the roles and users in seed.toml (or IAM_SEED_FILE);
# each user's password comes from the variable it names.
# IAM_SEED_FILE=/path/to/seed.toml
IAM_SEED_ADMIN_PASSWORD=replace-with-a-strong-password
# Optional browser sessions: exact trusted HTTPS origin, encrypted PostgreSQL store.
# Apply migrations and grant runtime CRUD on fl_iam_browser_sessions before enabling.
# SESSION_COOKIE_ORIGIN=https://app.example.com
HOST=127.0.0.1
PORT=8000
RUST_LOG=info
# Directory grants: jwt-claims, or stored-session for current linked identities.
IAM_DIRECTORY_AUTHORIZATION=jwt-claims
# Optional OTLP/HTTP export. Omit endpoints for local structured logs only.
# OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318
# OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
# OTEL_EXPORTER_OTLP_HEADERS=authorization=Bearer%20replace-me
# OTEL_SERVICE_NAME=replace-with-service-name
# OTEL_RESOURCE_ATTRIBUTES=deployment.environment.name=local
# OTEL_SDK_DISABLED=true
# MCP shares PORT; set public hosts/origins explicitly behind a proxy.
MCP_ENABLED=true
MCP_PATH=/mcp
# MCP_ALLOWED_HOSTS=api.example.com
# MCP_ALLOWED_ORIGINS=https://app.example.com:443
# MCP uses the HTTP listener by default. For a separate listener:
# MCP_LISTENER=separate
# MCP_PORT=10000
# MCP_HOST=127.0.0.1
# Without MCP_PORT, separate mode uses the HTTP port + 2000.
# MCP_PATH=/mcp
# MCP_ENABLED=false
# Optional OIDC browser login; requires SESSION_COOKIE_ORIGIN and explicit
# tenant/issuer/subject bindings. Register the exact provider redirect URI:
# https://app.example.com/auth/browser/oidc/callback
# SESSION_OIDC_ISSUER=https://identity.example.com
# SESSION_OIDC_CLIENT_ID=app-client
# SESSION_OIDC_CLIENT_SECRET=server-secret
# IAM_DIRECTORY_AUTHORIZATION=stored-session requires SESSION_JWT_* signing and a
# matching trusted JWKS_PUBLIC_KEY_URL. Grant SELECT/INSERT/UPDATE/DELETE on
# fl_iam_directory_identities; provision links explicitly.