commit 2cf2da20e824f802e7f6267a9a7127e470373ed0 · bretton.dev/coves

.env.dev

···

       152
       152
        
       # When false, verifies JWT signature against issuer's JWKS

     

       153
       153
        
       AUTH_SKIP_VERIFY=true

     

       154
       154
        
       

     

       155
       155
       +
       # HS256 Issuers: PDSes allowed to use HS256 (shared secret) authentication

     

       156
       156
       +
       # Must share PDS_JWT_SECRET with Coves instance. External PDSes use ES256 via DID resolution.

     

       157
       157
       +
       # For local dev, allow the local PDS or turn AUTH_SKIP_VERIFY = true

     

       158
       158
       +
       HS256_ISSUERS=http://localhost:3001

     

       159
       159
       +
       

     

       155
       160
        
       # Logging

     

       156
       161
        
       LOG_LEVEL=debug

     

       157
       162
        
       LOG_ENABLED=true

+28

.env.prod.example

···

       27
       27
        
       # PDS_EMAIL_FROM_ADDRESS=noreply@coves.me

     

       28
       28
        
       

     

       29
       29
        
       # =============================================================================

     

       30
       30
       +
       # JWT Authentication

     

       31
       31
       +
       # =============================================================================

     

       32
       32
       +
       # Coves supports two JWT verification methods:

     

       33
       33
       +
       #

     

       34
       34
       +
       # 1. HS256 (shared secret) - For your own PDS

     

       35
       35
       +
       #    - Fast, no network calls needed

     

       36
       36
       +
       #    - Requires shared PDS_JWT_SECRET

     

       37
       37
       +
       #    - Only for PDSes you control

     

       38
       38
       +
       #

     

       39
       39
       +
       # 2. ES256 (DID resolution) - For federated users

     

       40
       40
       +
       #    - Works with any PDS (bsky.social, etc.)

     

       41
       41
       +
       #    - Resolves user's DID document to get public key

     

       42
       42
       +
       #    - No shared secret needed

     

       43
       43
       +
       #

     

       44
       44
       +
       # HS256_ISSUERS: Comma-separated list of PDS URLs allowed to use HS256

     

       45
       45
       +
       # These PDSes MUST share the same PDS_JWT_SECRET with Coves

     

       46
       46
       +
       # Example: HS256_ISSUERS=https://pds.coves.social,https://pds.example.com

     

       47
       47
       +
       HS256_ISSUERS=https://pds.coves.me

     

       48
       48
       +
       

     

       49
       49
       +
       # PLC Directory URL for DID resolution (optional)

     

       50
       50
       +
       # Defaults to https://plc.directory if not set

     

       51
       51
       +
       # PLC_DIRECTORY_URL=https://plc.directory

     

       52
       52
       +
       

     

       53
       53
       +
       # Skip JWT signature verification (DEVELOPMENT ONLY!)

     

       54
       54
       +
       # Set to false in production for proper security

     

       55
       55
       +
       AUTH_SKIP_VERIFY=false

     

       56
       56
       +
       

     

       57
       57
       +
       # =============================================================================

     

       30
       58
        
       # AppView OAuth (for mobile app authentication)

     

       31
       59
        
       # =============================================================================

     

       32
       60
        
       OAUTH_CLIENT_ID=https://coves.social/client-metadata.json

docker-compose.prod.yml

···

       96
       96
        
             # Cursor encryption for pagination

     

       97
       97
        
             CURSOR_SECRET: ${CURSOR_SECRET}

     

       98
       98
        
       

     

       99
       99
       +
             # PDS JWT secret for verifying HS256 tokens from the PDS

     

       100
       100
       +
             # Must match the PDS_JWT_SECRET configured on the PDS

     

       101
       101
       +
             PDS_JWT_SECRET: ${PDS_JWT_SECRET}

     

       102
       102
       +
             # Whitelist PDS issuer(s) allowed to use HS256 (no kid)

     

       103
       103
       +
             HS256_ISSUERS: ${HS256_ISSUERS}

     

       104
       104
       +
       

     

       99
       105
        
             # Restrict community creation to instance DID only

     

       100
       106
        
             COMMUNITY_CREATORS: did:web:coves.social

     

       101
       107
        
           networks: