HOST=0.0.0.0
PORT=3000
# Empty/unset keeps auth_request adapter mode. Cleartext proxy mode example:
# UPSTREAM_URL=http://127.0.0.1:4096
# UPSTREAM_PROTOCOL=http1
UPSTREAM_URL=
# auto is valid for HTTPS and adapter mode; cleartext proxy mode must select http1 or http2.
UPSTREAM_PROTOCOL=auto
# Startup-validated process capacities. Proxy mode requires downstream >= active + 16.
GATEWAY_MAX_DOWNSTREAM_CONNECTIONS=256
GATEWAY_MAX_ACTIVE_UPSTREAMS=128
GATEWAY_MAX_BLOCKING_RESOLVERS=8
# Empty trusts no forwarding peer. Entries must include an explicit prefix.
TRUSTED_PROXY_CIDRS=
GATEWAY_PUBLIC_BASE_URL=http://localhost:8080
AUTH_MINI_ISSUER=http://127.0.0.1:7777
AUTH_MINI_PUBLIC_BASE_URL=http://localhost:7777
AUTH_MINI_LOGIN_URL=
GATEWAY_DB=./auth-mini-gateway.sqlite
GATEWAY_COOKIE_SECRET=replace-with-at-least-32-random-characters
COOKIE_SECURE=false
COOKIE_SAME_SITE=lax
# Exact auth-mini user IDs (the JWT sub values of allowed users). Empty denies
# all users. ALLOW_EMAILS is unsupported: any nonempty value fails startup.
# The gateway derives its required JWT audience from the
# GATEWAY_PUBLIC_BASE_URL hostname and appends an explicit aud parameter to
# the login redirect only for loopback origins.
ALLOW_USER_IDS=
SESSION_TTL_SECONDS=604800
SESSION_ABSOLUTE_TTL_SECONDS=2592000
SESSION_TOUCH_INTERVAL_SECONDS=3600
LOGIN_STATE_TTL_SECONDS=600
REFRESH_SKEW_SECONDS=60
LOGOUT_REDIRECT=/