egress/deploy/env.example

# Install to /etc/egress/env, root:root 0400, on the LUKS root.
#
# This file is the whole configuration. There is no orchestrator to ask, which
# is the point: this process runs where a cloud API token does not reach.

# NO MNEMONIC HERE. The identity KMS authorizes is the innermost secret on this
# box — it derives the key that unlocks every provider credential — so it is
# encrypted to this host and loaded as a unit credential, never as an environment
# variable this file could carry:
#
#   systemd-creds encrypt --with-key=host --name=mnemonic - /etc/egress/mnemonic.cred
#
# Everything below is configuration, not secret. This file holds no credential.

# Who may spend. A token must name this issuer and carry this audience.
# Audience has no default on purpose: a service accepting any audience accepts
# a token minted for a different app.
# The key set is published under the IAM prefix, not at the host root: the root
# spelling answers 404, and a JWKS is fetched on the first call rather than at
# boot — so the wrong URL here starts cleanly and then refuses every caller as
# unidentifiable, which reads like a token problem rather than a config one.
EGRESS_ISSUER=https://hanzo.id
EGRESS_JWKS=https://hanzo.id/v1/iam/.well-known/jwks
EGRESS_AUDIENCE=hanzo-egress

# Where the credentials live. KMSPath is this service's own identity path.
# HTTPS, because this process runs OFF the cluster and that is the whole design.
# The ZAP endpoint is a direct dial to a port the public edge does not carry —
# kms.hanzo.ai resolves to the CDN, which proxies 443 and nothing else — so a
# zap:// endpoint here is one that cannot be reached from where egress lives. Use
# zap:// only from inside the cluster, where the port is real.
EGRESS_KMS=https://kms.hanzo.ai
EGRESS_KMS_ORG=hanzo
EGRESS_KMS_PATH=hanzo/egress

# This service's own IAM identity, the app hanzo-egress. The https store
# transport signs in as it, and an AWS role egress assumes trusts it: its
# client_credentials token (aud hanzo-egress, sub admin/hanzo-egress) is the web
# identity STS is shown. Required with an https store or with EGRESS_AWS set.
# The matching secret is sealed, never written here:
#   systemd-creds encrypt --with-key=host --name=client-secret - /etc/egress/client-secret.cred
EGRESS_IAM=https://hanzo.id
EGRESS_CLIENT_ID=hanzo-egress

# The AWS endpoints egress signs requests for, comma-separated, each
# <service>.<region>.amazonaws.com for a service egress signs for (EC2 and
# CloudWatch; never an
# identity service such as STS, IAM, SSO or sign-in, which would answer with the
# role's own credentials). A caller names one of these or is refused; the
# signature's service and region are read from the name. STS is reached at
# sts.<region>.amazonaws.com for egress's own role exchange and needs no entry.
# The platform's account is a descriptor in KMS at cloud/aws/<label>/credential
# (org hanzo, env default): {"roleArn":"arn:aws:iam::<account>:role/<name>"},
# which holds no secret and may be written in the clear. A key pair is only ever
# a tenant's own, enrolled sealed. CloudWatch (monitoring) is where hosted
# compute reads each machine's NetworkOut.
EGRESS_AWS=ec2.us-east-1.amazonaws.com,monitoring.us-east-1.amazonaws.com

# The platform's own credentials egress spends, and the programs that spend
# each, by IAM client id: the whole list, as it is rolled out. A principal of the
# platform org (EGRESS_KMS_ORG) reaches the org's shared custody — on a fetch, a
# model call and a session alike — only for a label listed here and only as a
# caller listed for it. Every Hanzo application and person is filed under that
# org, so a platform credential missing from this list is spent by nobody, and a
# program missing from it spends none. An AWS label is pinned to its account id
# (@<12 digits>): the role its descriptor names must be in it, and a key pair
# there is refused. A label with no caller refuses to start.
#
# aws/hanzo-compute  Hanzo's AWS account (arn:aws:iam::123456789012:role/hanzo-compute,
#                    see aws/), spent by compute (IAM client hanzo-visor).
EGRESS_PLATFORM=aws/hanzo-compute@123456789012
EGRESS_PLATFORM_CALLERS=aws/hanzo-compute=hanzo-visor

# Inbound ZAP. Bind to the interface callers reach, never 0.0.0.0 on a host
# with a public address.
EGRESS_LISTEN=:9653

EGRESS_RPM=600
EGRESS_DEADLINE=5m

# OPTIONAL. Egress already knows where each cloud it can pay for answers —
# that is a fact about the cloud, not a choice this host makes — so nothing here
# is needed to serve DigitalOcean or Hetzner. Set an entry only to MOVE one: a
# regional or sovereign endpoint. It cannot admit a cloud egress cannot pay for,
# because an address is not what makes a cloud payable. https only, and a
# malformed entry refuses to start.
# EGRESS_URLS=digitalocean=https://api.digitalocean.com