node.env.example

# Exactly one identity source is required:
#   TOWONEL_IDENTITY_KEY_PATH       -- load or generate a key file on disk (hub or edge).
#   TOWONEL_EDGE_INVITE_TOKEN       -- derive the iroh key from the seed in
#                                      an operator-issued `tt_edge_2_...`
#                                      token. The hub URL is taken from the
#                                      token unless TOWONEL_EDGE_HUB_URLS is
#                                      set. Stateless; no disk required.

TOWONEL_IDENTITY_KEY_PATH=/var/lib/towonel/node.key
# TOWONEL_EDGE_INVITE_TOKEN=tt_edge_2_...

TOWONEL_HUB_ENABLED=true
TOWONEL_HUB_LISTEN_ADDR=0.0.0.0:8443
TOWONEL_HUB_HEALTH_LISTEN_ADDR=0.0.0.0:9091
TOWONEL_HUB_PUBLIC_URL=https://hub.example.eu:8443
TOWONEL_HUB_OPERATOR_API_KEY_PATH=/var/lib/towonel/operator.key
TOWONEL_HUB_DNS_WEBHOOK_URL=https://dns-sidecar.internal/reconcile

TOWONEL_HUB_DB_DRIVER=sqlite
# TOWONEL_HUB_DB_DSN=postgresql://user:pass@host/db
# TOWONEL_HUB_DB_MAX_OPEN_CONNS=25
# TOWONEL_HUB_DB_MAX_IDLE_CONNS=10

# Pin peer node_ids to close the MITM window at first contact.
TOWONEL_HUB_PEERS=[{"url":"https://hub-b.example.eu:8443","node_id":"<64 hex>"}]
# TOWONEL_HUB_SYNC_OPERATIONS=invite_redeem
# TOWONEL_ALLOW_UNPINNED_FEDERATION_PEERS=1

TOWONEL_TENANTS=[{"name":"alice","id":"<64 hex>","pq_public_key":"<base64url>","hostnames":["app.alice.test"]}]

TOWONEL_EDGE_ENABLED=true
TOWONEL_EDGE_LISTEN_ADDR=0.0.0.0:443
TOWONEL_EDGE_HEALTH_LISTEN_ADDR=0.0.0.0:9090
TOWONEL_EDGE_HUB_URLS=https://hub-a.example.eu:8443,https://hub-b.example.eu:8443
TOWONEL_EDGE_PUBLIC_ADDRESSES=edge-a.example.eu:443
# TOWONEL_EDGE_LISTEN_WORKERS=4

# Leave TLS unset for pure passthrough.
# TOWONEL_EDGE_TLS_CERT_DIR=/data/certs
# TOWONEL_EDGE_TLS_ACME_EMAIL=ops@example.eu
# TOWONEL_EDGE_TLS_ACME_STAGING=false
# TOWONEL_EDGE_TLS_HTTP_LISTEN_ADDR=0.0.0.0:80