swiyu-verifier.env (5420B)
1 #################################################################### 2 # Environment of the SWIYU Generic Verifier service. 3 # 4 # This file is read by swiyu-verifier.service as an EnvironmentFile, 5 # and every variable in it is a Spring Boot property of the verifier 6 # (see swiyu-verifier(1) and the upstream reference at 7 # https://github.com/swiyu-admin-ch/swiyu-verifier). 8 # 9 # Syntax is systemd's, not the shell's: VAR=value, one per line, no 10 # export, no command substitution, and quotes only where the value 11 # itself needs them. 12 # 13 # PUT YOUR OWN SETTINGS IN /etc/swiyu-verifier/local.env INSTEAD. 14 # That file is read after this one, so it overrides it, and it does 15 # not belong to the package -- which means an upgrade that changes 16 # the defaults here will not stop to ask you about a file you have 17 # edited. This file is the reference for what can be set. 18 # 19 # Secrets do not belong here, because this file is readable by the 20 # service user: the database password is in secrets/db.env (written 21 # by swiyu-verifier-dbconfig) and the signing key in 22 # secrets/signing-key.yml, both mode 0640 root:swiyu-verifier. 23 # 24 # Restart after editing: systemctl restart swiyu-verifier 25 #################################################################### 26 27 # --- Identity (required; no default can be right here) ------------ 28 # 29 # These three come out of onboarding to the SWIYU Base Registry; see 30 # https://swiyu-admin-ch.github.io/cookbooks/onboarding-generic-verifier/ 31 # and the operator manual at 32 # https://docs.taler.net/taler-swiyu-verifier-manual.html. 33 # 34 # The public HTTPS URL at which wallets reach this verifier. The 35 # SWIYU wallet only accepts HTTPS with a certificate from a public 36 # CA, so this is the URL of the reverse proxy in front of the 37 # service, never the loopback address below. 38 #EXTERNAL_URL=https://verifier.example.com 39 40 # The DID of this verifier, and the verification method inside that 41 # DID document whose key signs the authorization requests. 42 #VERIFIER_DID=did:tdw:QmExample:identifier-reg.trust-infra.swiyu.admin.ch:api:v1:did:0000 43 #DID_VERIFICATION_METHOD=did:tdw:QmExample:identifier-reg.trust-infra.swiyu.admin.ch:api:v1:did:0000#auth-key-01 44 45 # The signing key itself does NOT go here: a PEM document has newlines in 46 # it, and a systemd environment file cannot express those. It lives in 47 # /etc/swiyu-verifier/secrets/signing-key.yml 48 # which the shipped application.yml imports; copy 49 # /usr/share/swiyu-verifier/signing-key.yml.example to it. 50 # 51 # A key held in an HSM is configured here after all, since those settings are 52 # single-line: set SIGNING_KEY_MANAGEMENT_METHOD and the HSM_* variables; see 53 # swiyu-verifier(1). 54 55 # --- Where the service listens ------------------------------------ 56 # 57 # Plain HTTP on the loopback interface only: the OID4VP endpoints 58 # must be reachable by wallets over HTTPS, which is the reverse 59 # proxy's job, and the management API under /management/api/ must not 60 # be reachable from outside the host at all. 61 SERVER_ADDRESS=127.0.0.1 62 SERVER_PORT=8080 63 64 # --- Database ----------------------------------------------------- 65 # 66 # swiyu-verifier-dbconfig(1) creates this database and writes the 67 # password it generated to /etc/swiyu-verifier/secrets/db.env. The 68 # connection is over TCP because the PostgreSQL JDBC driver cannot 69 # use peer authentication on a Unix socket, which is why there is a 70 # password at all. 71 POSTGRES_JDBC=jdbc:postgresql://localhost:5432/swiyu_verifier 72 POSTGRES_USER=swiyu_verifier 73 74 # Schema inside that database. The service creates and migrates it 75 # itself with Flyway on every start. 76 POSTGRES_DB_SCHEMA=public 77 78 # --- Talking to KyCH ---------------------------------------------- 79 # 80 # Where to report a finished verification. With kych on the same 81 # host behind a reverse proxy this is the proxy's /notification path; 82 # the webhook carries no authentication of its own, so restrict that 83 # path to this host in the proxy configuration. 84 #WEBHOOK_CALLBACK_URI=https://kych.example.com/notification 85 86 # How often an unanswered callback is retried, in milliseconds. 87 WEBHOOK_INTERVAL=2000 88 89 # --- Trust infrastructure ----------------------------------------- 90 # 91 # The defaults built into the verifier point at the swiyu-int 92 # *sandbox*. Switch both to the production registry before serving 93 # real credentials; see the cookbook linked above for the current 94 # values. 95 SWIYU_TRUST_REGISTRY_API_URL=https://trust-reg.trust-infra.swiyu-int.admin.ch 96 #SWIYU_TRUST_ISSUER_DID= 97 98 # --- What the management API reports back ------------------------- 99 # 100 # KyCH reads the disclosed claims out of the management API's 101 # response, so this must stay on; it is the verifier's default. 102 ADDITIONAL_AUDIT_INFORMATION_CREDENTIAL_SUBJECT_DATA_ENABLED=true 103 104 # The raw presentation and the per-credential trust evaluation are 105 # off by default. Turning them on makes the verifier hand out more 106 # personal data than the verification needs, so only do it if the 107 # audit trail is worth that. 108 ADDITIONAL_AUDIT_INFORMATION_VP_TOKEN_ENABLED=false 109 ADDITIONAL_AUDIT_INFORMATION_CREDENTIAL_EVALUATION_ENABLED=false 110 111 # --- Miscellaneous ------------------------------------------------ 112 113 # How long a verification stays open for the wallet, in seconds. 114 VERIFICATION_TTL_SEC=900 115 116 # Deeplink scheme of the QR code; the wallet has to support it. 117 DEEPLINK_SCHEMA=swiyu-verify 118 119 # Set to DEBUG to follow a verification through the logs. 120 LOGGING_LEVEL_CH_ADMIN_BJ_SWIYU=INFO