SOCIALWEB_GATEWAY_ADDR=127.0.0.1:8080
SOCIALWEB_GATEWAY_AUDIENCES=did:web:gateway.example
# the operator DIDs whose association the gateway requester carries; the Gateway root composes them into the requester MarketIdentity
SOCIALWEB_GATEWAY_APPROVED_ASSOCIATIONS=
SOCIALWEB_KCP_HOST=https://kcp.example.com:6443
# SOCIALWEB_KCP_KUBECONFIG is supplied by the systemd unit as a LoadCredential
# (%d/kcp.kubeconfig) and is deliberately NOT set here: settings from an
# EnvironmentFile override the unit's Environment=, so a path set here would
# replace the credential file the unit hands the process. See
# deploy/socialweb-gateway.service.
SOCIALWEB_GATEWAY_DIRECTORY_CACHE_TTL=60s
SOCIALWEB_GATEWAY_SHUTDOWN_TIMEOUT=30s
SOCIALWEB_GATEWAY_LOG_LEVEL=info
SOCIALWEB_GATEWAY_PLC_URL=https://plc.directory
# The address a USER's kubeconfig points at. It must be the deployment's PUBLIC front,
# not this gateway's loopback address: SOCIALWEB_KCP_HOST above is the loopback address
# the gateway itself speaks to kcp over, and only the rendered user kubeconfig changes.
# kubeconfig server of getKubeconfig; Caddy sends requests with a client certificate to
# the client certificate front (cert-front-address, 127.0.0.1:8444)
SOCIALWEB_GATEWAY_KCP_PUBLIC_HOST=https://kcp.socialweb.example

# The ServiceAccount (<workspace path>/<namespace>/<name>) that fulfils NodeClaims. When this
# gateway creates a home it lets that account get, list and patch NodeClaims and get ClusterLinks
# there, nothing else, and names the home in a ConfigMap labelled socialweb.computer/nodeclaim-home
# in the account's own namespace. Unset, no such grant is written.
# SOCIALWEB_GATEWAY_NODECLAIM_AGENT=root:app/default/socialweb-computer-k8s