-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path.env.example
More file actions
169 lines (153 loc) · 7.93 KB
/
Copy path.env.example
File metadata and controls
169 lines (153 loc) · 7.93 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
# Erebrus Node v2 — environment template
#
# Where to put this file:
# Docker install → /opt/erebrus/.env (docker compose --env-file)
# Local dev → copy to .env in repo root
#
# Never commit real secrets (MNEMONIC, NODE_KEY, EREBRUS_NODE_REGISTRATION_TOKEN).
# =============================================================================
# REQUIRED — all runs (Validate() hard-fails if missing)
# =============================================================================
MNEMONIC= # BIP39 12-word phrase: wallet, PeerID, DID
WG_ENDPOINT_HOST= # Public IP address clients dial
# =============================================================================
# REQUIRED — release mode only (not enforced at boot; peer API fails without it)
# =============================================================================
# RUNTYPE=release
# NODE_KEY= # Per-node bearer for /api/v2/peers/* (gateway mints if unset)
# =============================================================================
# DEBUG profile — local smoke / gateway dev (copy these values)
# =============================================================================
# RUNTYPE=debug
# SERVER=127.0.0.1
# HTTP_PORT=9080
# MNEMONIC=abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
# WG_ENDPOINT_HOST=127.0.0.1
# GATEWAY_URL=http://127.0.0.1:8080
# ENABLE_STEALTH=false
# STATE_DIR=./var/lib/erebrus
# NODE_API_TOKEN= # leave unset — peer API is open in debug only
# =============================================================================
# RELEASE profile — production node (installer container path; public by default)
# =============================================================================
RUNTYPE=release
EREBRUS_PROFILE=standard
EREBRUS_ACCESS=public
EREBRUS_NETWORK_PROFILE=bridge
SERVER=0.0.0.0
HTTP_PORT=9080
NODE_NAME=erebrus-node
REGION=unknown
# Optional placement within REGION (e.g. east, west). Installer auto-sets east/west for US.
ZONE=
# Docker image (container install). Installer pulls ghcr.io/netsepio/erebrus:latest by default.
# EREBRUS_IMAGE=ghcr.io/netsepio/erebrus:latest
GATEWAY_URL=https://gateway.erebrus.io
EREBRUS_NODE_REGISTRATION_TOKEN=
NODE_KEY=
ENABLE_STEALTH=true
STEALTH_TCP_PORT=443
STEALTH_UDP_PORT=443
STATE_DIR=/var/lib/erebrus
# =============================================================================
# Deployment profile (standard | shield | sentinel)
# =============================================================================
# EREBRUS_PROFILE=standard
# FIREWALL_PROVIDER=none
# FIREWALL_DNS_ADDR=
# SHIELD_ADMIN_URL=
# Shield AdGuard admin login — the installer auto-generates the password; the node
# configures AdGuard with it and reports it to the gateway for org paid seats.
# SHIELD_ADMIN_USER=admin
# SHIELD_ADMIN_PASSWORD=
# Shield AdGuard upstream resolvers (comma-separated, applied only while AdGuard
# still runs its stock Quad9-DoH default; operator changes are never overwritten).
# Keep these fast UDP resolvers — DoH upstreams stall tunnel DNS on cache misses.
# SHIELD_UPSTREAM_DNS=1.1.1.1,1.0.0.1
# SENTINEL_API_URL=http://erebrus-sentinel:8788
# SENTINEL_IMAGE=ghcr.io/netsepio/erebrus-sentinel:latest
# Shield: FIREWALL_PROVIDER=adguard_home, FIREWALL_DNS_ADDR=adguardhome:53, WG_DNS=<WG gateway IP>
# Sentinel: FIREWALL_PROVIDER=unbound_erebrus, FIREWALL_DNS_ADDR=erebrus-sentinel:53, WG_DNS=<WG gateway IP>
# =============================================================================
# Erebrus Drop (optional Kubo sidecar; Docker only)
# =============================================================================
DROP_ENABLED=false
DROP_STORAGE_MAX=10GB
DROP_SWARM_PORT=4001
DROP_WEBUI_ENABLED=false
# DROP_WEBUI_ENABLED is accepted only on private nodes. Kubo RPC 5001 and the
# gateway port 8080 remain internal to the VPN / authenticated Erebrus API.
# =============================================================================
# RELEASE profile — public access node
# =============================================================================
# EREBRUS_ACCESS=public
# EREBRUS_NETWORK_PROFILE=bridge # host-network for Docker host networking
# STEALTH_TCP_PORT=443
# STEALTH_UDP_PORT=443
# =============================================================================
# Access and network profile
# =============================================================================
# EREBRUS_ACCESS=private|public gateway directory visibility (org controls private access)
# EREBRUS_NETWORK_PROFILE=bridge|host-network|native
# =============================================================================
# API bind
# =============================================================================
# API_BIND_ADDR= # overrides SERVER when set
# UNSAFE_PUBLIC_API=false # acknowledge risk when binding 0.0.0.0 publicly
# =============================================================================
# Gateway integration (optional; empty GATEWAY_URL disables control plane)
# =============================================================================
# GATEWAY_URL=https://gateway.erebrus.io
# GATEWAY_AUTO_REGISTER=true
# EREBRUS_NODE_REGISTRATION_TOKEN= # ere_reg_* from POST /orgs/{id}/node-registration-tokens
# EREBRUS_ORG_ENROLLMENT_SECRET= # deprecated alias for EREBRUS_NODE_REGISTRATION_TOKEN
# WALLET_CHAIN=SOLANA # SOLANA | ETHEREUM (aliases sol/evm accepted)
# API_PUBLIC_URL= # gateway peer provision URL (default: http://WG_ENDPOINT_HOST:HTTP_PORT)
# NODE_KEY= # optional pre-register bearer; gateway mints if empty (persisted)
# GATEWAY_PUBLIC_KEY= # optional override; normally saved at registration
# NODE_ID= # persisted peer_id after registration; skip auto-register if set with NODE_TOKEN
# NODE_TOKEN=
# GATEWAY_PEER_MULTIADDR= # libp2p bootstrap (DHT advertise only)
# P2P_LISTEN_PORT=9002 # optional override; Compose publishes the existing 9002 default
# =============================================================================
# WireGuard
# =============================================================================
WG_CONF_DIR=/etc/wireguard
WG_INTERFACE_NAME=wg0
WG_ENDPOINT_PORT=51820 # alias: WG_PORT
WG_IPv4_SUBNET=100.64.0.1/24
WG_IPv6_SUBNET=fd00:64:64::1/64
WG_DNS=1.1.1.1
WG_NAT_IFACE=eth0
# Leave PostUp/PostDown empty to derive NAT/FORWARD from the subnets above.
# Set WG_IPv6_SUBNET=off to disable the IPv6 tunnel (client ::/0 then blackholes IPv6).
# WG_POST_UP=
# WG_POST_DOWN=
# =============================================================================
# Stealth carriers (sing-box) — DPI-resistant fallbacks when WG UDP is blocked
# Canonical ports: STEALTH_TCP_PORT / STEALTH_UDP_PORT
# Legacy aliases: VLESS_PORT / HYSTERIA2_PORT (same values if you prefer old names)
# =============================================================================
# ENABLE_STEALTH=true
# STEALTH_TCP_PORT=443 # VLESS+REALITY (tcp)
# STEALTH_UDP_PORT=443 # Hysteria2 (udp)
REALITY_SERVER_NAMES=www.microsoft.com
REALITY_HANDSHAKE_SERVER=
HYSTERIA2_OBFS_PASSWORD=
ENABLE_TUIC=false
# =============================================================================
# Private DNS (opt-in; backed by service registry)
# =============================================================================
PRIVATE_DNS_ENABLED=false
PRIVATE_DNS_DOMAIN=ere
PRIVATE_DNS_ADDR=
UPSTREAM_DNS=1.1.1.1
DNS_QUERY_LOGS=false
# =============================================================================
# Registrar (on-chain; noop in v2.0)
# =============================================================================
CHAIN_REGISTRATION=off # off | solana (future)
# =============================================================================
# Docker only — set by docker-compose.yml; do not set on host/systemd installs
# =============================================================================
# LOAD_CONFIG_FILE=TRUE