gatehouse/.env.example at main · bshandley/gatehouse · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# ─── Required ────────────────────────────────────────
# 64-char hex string. Derives the key that encrypts all secrets.
# If lost, all secrets are unrecoverable. If leaked, anyone with
# the database file can decrypt everything offline.
# Generate with: openssl rand -hex 32
GATEHOUSE_MASTER_KEY=

# Bootstrap token for initial setup. Has full admin access, bypasses
# all policies. Remove from your environment after creating your first
# user account and AppRoles.
GATEHOUSE_ROOT_TOKEN=gatehouse-root-changeme

# ─── Networking ──────────────────────────────────────
GATEHOUSE_PORT=3100

# Comma-separated CORS origins. Only needed if you access the UI from
# a different origin than where Gatehouse runs (e.g., reverse proxy).
# When empty, CORS is restricted to same-origin only.
# GATEHOUSE_CORS_ORIGINS=https://gatehouse.yourdomain.com

# Public URL used when generating onboarding links. Set this when Gatehouse
# runs behind a reverse proxy or on a LAN IP and the Host header isn't the
# address you want agents to fetch. Takes precedence over request headers.
# GATEHOUSE_PUBLIC_URL=https://gatehouse.home.arpa

# Comma-separated CIDRs of reverse proxies allowed to set the client IP via
# X-Forwarded-For / X-Real-IP. The client IP drives AppRole IP allowlists, the
# rotate-token allowlist, and the lease/proxy auto_approve_from_ip gate, so a
# forwarded header is honored ONLY when the connection comes from one of these
# proxies. Loopback (127.0.0.0/8, ::1) is always trusted, which covers a proxy
# on the same host. Set this when your proxy is on a separate host or a Docker
# network (e.g. the bridge gateway 172.18.0.1). If you use IP allowlists or
# auto-approve from behind such a proxy and leave this unset, those controls
# fail closed (logins denied, auto-approve falls back to human approval).
# GATEHOUSE_TRUSTED_PROXIES=172.18.0.0/16

# LAN-only URL for split-DNS deployments. Set this when you have a public
# reverse proxy AND a separate LAN address (e.g. PUBLIC_URL is your https
# domain, INTERNAL_URL is http://10.0.0.5:3100). When set, the admin UI's
# onboarding modal defaults new links to the internal URL so LAN agents get
# the fast path, and the bootstrap doc fetched via the internal host renders
# internal URLs throughout every curl example.
# GATEHOUSE_INTERNAL_URL=http://10.0.0.5:3100

# Max request body size in bytes (default: 1MB). Increase if you proxy
# large payloads. Setting too high lets agents send big requests through
# Gatehouse.
# GATEHOUSE_MAX_BODY_SIZE=1048576

# ─── Proxy / SSRF ───────────────────────────────────
# Private-network proxying is ALLOWED by default. Gatehouse is built for
# homelabs, where your services live on private IPs (10.x, 172.16-31.x,
# 192.168.x, 127.x, link-local) - blocking them out of the box would make
# the proxy useless. Your per-secret allowed_domains metadata and your
# policies are what scope what an agent can actually reach.
#
# Set this to "false" to re-enable SSRF blocking (e.g. when exposing
# Gatehouse on the public internet). You can then selectively re-allow
# specific secrets by setting metadata allow_private=true on them.
#
# You can also force-block a specific secret while leaving the global
# default on, by setting metadata allow_private=false on that secret.
# GATEHOUSE_PROXY_ALLOW_PRIVATE=true

# ─── Paths ───────────────────────────────────────────
GATEHOUSE_DATA_DIR=./data
GATEHOUSE_CONFIG_DIR=./config

# ─── Logging ─────────────────────────────────────────
# Options: debug (verbose), info (default), error (errors only)
GATEHOUSE_LOG_LEVEL=info

# ─── Auth ────────────────────────────────────────────
# Override JWT signing secret. By default derived from MASTER_KEY via
# HKDF. Only set this if you need tokens to survive a master key rotation.
# GATEHOUSE_JWT_SECRET=

# ─── OAuth / SSO (optional) ─────────────────────────
# OIDC issuer URL. When set, enables "Sign in with SSO" on the login screen.
# GATEHOUSE_OAUTH_ISSUER=https://auth.yourdomain.com
# GATEHOUSE_OAUTH_CLIENT_ID=gatehouse
# GATEHOUSE_OAUTH_CLIENT_SECRET=
# GATEHOUSE_OAUTH_REDIRECT_URI=https://gatehouse.yourdomain.com/v1/auth/callback

# ─── MCP stdio mode ─────────────────────────────────
# Only used when running the MCP stdio transport directly, not the server.
# GATEHOUSE_TOKEN=          # pre-authenticated JWT or root token
# GATEHOUSE_IDENTITY=mcp-agent
# GATEHOUSE_POLICIES=admin  # comma-separated policy list