oyster/.env.example at main · MystenLabs/oyster · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
# Oyster server configuration reference. Copy to .env (or export in the
# environment) and fill in the REPLACE_ME values. Only the variables you
# need must be set — everything has a default except the secrets.

# ---------------------------------------------------------------------------
# Core
# ---------------------------------------------------------------------------
#BIND_ADDR=0.0.0.0:3000
#DATABASE_URL=sqlite:oyster.db?mode=rwc          # or postgres://user:pass@host/db
#BLOB_STORE_PATH=blob_store

# Pearl (custodial wallet service)
#PEARL_GRPC_URL=http://127.0.0.1:50051
PEARL_SERVICE_SECRET=REPLACE_ME

# On-chain storage (omit to use the local filesystem blob store)
#SUI_RPC_URL=
#WALRUS_SYSTEM_OBJECT=
#WALRUS_STAKING_OBJECT=

# ---------------------------------------------------------------------------
# Self-serve web signup (/signup)
#
# Signup is enabled only when ALL FIVE of the values below are set; when
# none are set the signup routes are not mounted at all. Setting only
# some of them is a startup error (fail-fast against half-configured
# deployments).
# ---------------------------------------------------------------------------

# Public base URL of this server, used to build the Google OAuth
# redirect URI (<base>/signup/callback must be registered in the Google
# Cloud console).
#OYSTER_PUBLIC_BASE_URL=https://oyster.example.com

# Google Cloud console → APIs & Services → Credentials → OAuth 2.0
# Client ID (type: Web application).
#GOOGLE_OAUTH_CLIENT_ID=REPLACE_ME.apps.googleusercontent.com
#GOOGLE_OAUTH_CLIENT_SECRET=REPLACE_ME

# Cloudflare dashboard → Turnstile → your widget. For local development
# Cloudflare publishes dummy keys that need no account:
#   always-pass sitekey:  1x00000000000000000000AA
#   always-pass secret:   1x0000000000000000000000000000000AA
#TURNSTILE_SITE_KEY=REPLACE_ME
#TURNSTILE_SECRET_KEY=REPLACE_ME

# Gating mode: open | waitlist | closed. Defaults to closed so that
# configuring the credentials never silently opens signup. `closed`
# still allows existing users to sign in.
#OYSTER_SIGNUP_MODE=waitlist

# Comma-separated email domains whose (Google-verified) users skip the
# waitlist queue.
#OYSTER_SIGNUP_ALLOWED_DOMAINS=example.com

# Comma-separated individual emails (Google-verified) that skip the
# waitlist queue. Use this to pre-authorize named people without opening
# their whole domain; it works before they've ever signed in.
#OYSTER_SIGNUP_ALLOWED_EMAILS=alice@example.com,bob@partner.org

# Optional environment badge ("Testnet", "Mainnet", ...) shown on the
# signup pages so users can tell deployments apart.
#OYSTER_SIGNUP_ENV_LABEL=Testnet

# Maximum active admin keys per app on the web issuance path (the
# `oyster app` CLI bypasses this).
#OYSTER_MAX_ADMIN_KEYS_PER_APP=5

# DEV ONLY — point the signup flow at mock Google/Turnstile servers
# (see scripts/signup-testbed.sh, which sets these automatically).
# Never set these in production.
#GOOGLE_OAUTH_AUTH_URL=http://127.0.0.1:9081/auth
#GOOGLE_OAUTH_TOKEN_URL=http://127.0.0.1:9081/token
#GOOGLE_OAUTH_JWKS_URL=http://127.0.0.1:9081/certs
#TURNSTILE_SITEVERIFY_URL=http://127.0.0.1:9081/siteverify