mirror of
https://github.com/luxfi/kms.git
synced 2026-07-26 23:59:24 +00:00
Hanzo AI
da574aa1db
Squashes all pre-rewrite history into a single root commit. Previous tree: - 14506 commits including upstream Infisical fork history - Multiple merge chains carrying pre-purge content Force-rewrite per disk-space reclamation discipline. GHCR images (1.9.9, 1.9.11) remain immutable; their git lineage is no longer materialized.
42 lines
1.5 KiB
YAML
42 lines
1.5 KiB
YAML
# KMS configuration.
|
|
#
|
|
# All values can be overridden by env vars or CLI flags.
|
|
# Env vars take precedence over this file; flags take precedence over env vars.
|
|
#
|
|
# Server:
|
|
# KMS_LISTEN - HTTP listen address (default ":8080")
|
|
# KMS_DATA_DIR - ZapDB data directory (default "/data/kms")
|
|
#
|
|
# MPC (signing backend):
|
|
# MPC_ADDR - ZAP address (host:port); empty = mDNS discovery (dev only)
|
|
# MPC_VAULT_ID - MPC vault for validator keys (keep in K8s secret, not here)
|
|
# KMS_NODE_ID - ZAP node ID (default "kms-0")
|
|
#
|
|
# Secrets server (ZAP transport):
|
|
# ZAP_PORT - ZAP listen port (default 9999, 0 = disable)
|
|
# KMS_MASTER_KEY_B64 - 32-byte master key (base64) for envelope encryption
|
|
#
|
|
# ZapDB at-rest encryption:
|
|
# KMS_ENCRYPTION_KEY_B64 - 32-byte key (base64) for ZapDB encryption
|
|
#
|
|
# ZapDB S3 replication:
|
|
# REPLICATE_S3_ENDPOINT - S3 endpoint (empty = replication disabled)
|
|
# REPLICATE_S3_BUCKET - S3 bucket (default "lux-kms-backups")
|
|
# REPLICATE_S3_REGION - S3 region (default "us-central1")
|
|
# REPLICATE_S3_ACCESS_KEY
|
|
# REPLICATE_S3_SECRET_KEY
|
|
# REPLICATE_AGE_RECIPIENT - age public key for backup encryption
|
|
# REPLICATE_AGE_IDENTITY - age private key for restore
|
|
# REPLICATE_PATH - S3 key prefix (default "kms/{KMS_NODE_ID}")
|
|
#
|
|
# Auth:
|
|
# IAM_ENDPOINT - Hanzo IAM endpoint (default "https://hanzo.id")
|
|
|
|
server:
|
|
addr: ":8080"
|
|
data_dir: "/data/kms"
|
|
|
|
mpc:
|
|
# ZAP direct connect address. Leave empty for mDNS discovery (dev only).
|
|
addr: ""
|