|
|
|
@@ -200,6 +200,53 @@ All optional. Each is absent rather than half-enabled when unconfigured.
|
|
|
|
|
| `FN_DONATE_ACCOUNT` | The connected account to charge, if `FN_DONATE_SECRET` belongs to a Stripe *platform* rather than to the account meant to receive the money. Sent as `Stripe-Account`, which makes the payment a direct charge there. Blank charges whatever account the key itself belongs to, the right answer when you are self-hosting with your own key, and the wrong one with a platform key, where Stripe answers 200 and the money lands on the platform with nothing on the page looking wrong. With this set, the publishable key stays the **platform's**. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## iPhone push (APNs)
|
|
|
|
|
|
|
|
|
|
Only the iOS app needs this; Android is woken directly. All five must be set
|
|
|
|
|
together, and the relay logs that push is disabled if any is missing.
|
|
|
|
|
|
|
|
|
|
| Variable | Default | Notes |
|
|
|
|
|
|---|---|---|
|
|
|
|
|
| `FN_APNS_KEY_P8` | unset | Path to the `.p8` signing key from Apple. Mount it as a secret; it is not a file to bake into an image. |
|
|
|
|
|
| `FN_APNS_KEY_ID` | unset | The key's ten-character id. |
|
|
|
|
|
| `FN_APNS_TEAM_ID` | unset | Your Apple developer team id. |
|
|
|
|
|
| `FN_APNS_TOPIC` | `net.flamenet.messenger` | The app's bundle id. Change it if you ship your own build. |
|
|
|
|
|
| `FN_APNS_ENV` | `sandbox` | `sandbox` or `production`. A token from a TestFlight or App Store build is meaningless to the sandbox host and the other way round, and APNs returns the same 400 either way. Getting this wrong means no iPhone is ever woken, so set it to `production` the moment you ship a build that is not from Xcode. |
|
|
|
|
|
|
|
|
|
|
## Behind a proxy
|
|
|
|
|
|
|
|
|
|
| Variable | Default | Notes |
|
|
|
|
|
|---|---|---|
|
|
|
|
|
| `FN_TRUSTED_PROXIES` | `0` | How many proxy hops to trust when reading `X-Forwarded-For`. Left at 0 the relay uses the socket address, which is your proxy, so every request looks like it comes from one IP and per-IP limits apply to everyone at once. Set it to the number of proxies in front of the relay, not higher: a client can forge the header for any hop you trust beyond the ones you actually run. |
|
|
|
|
|
|
|
|
|
|
## Pluggable transport (obfs4)
|
|
|
|
|
|
|
|
|
|
Reachability, not privacy: a second address that does not look like a relay,
|
|
|
|
|
for networks that block the first. It is what `docker-compose.prod.yml` runs
|
|
|
|
|
under the `obfs4` profile, and the variables are read by that compose file
|
|
|
|
|
rather than by the relay.
|
|
|
|
|
|
|
|
|
|
| Variable | Default | Notes |
|
|
|
|
|
|---|---|---|
|
|
|
|
|
| `FN_OBFS4_PORT` | `8443` | Published on every interface, unlike the relay. A bridge only loopback can reach helps nobody; what makes that safe is that the protocol answers nobody who cannot complete a handshake. |
|
|
|
|
|
| `FN_OBFS4_ADVERTISE` | unset | The public address to put in the bridge line handed to clients. A container cannot know its own, so without this the line says `<this-host>` and is not dialable. |
|
|
|
|
|
| `FN_OBFS4_IMAGE` | `flamenet-obfs4bridge:prod` | Set it to an image you can pull. |
|
|
|
|
|
| `FN_OBFS4_CONTEXT` | `../flamenet-elligator2` | Build context, a sibling checkout. That repository is private, so its registry image cannot be pulled anonymously. |
|
|
|
|
|
| `FN_OBFS4_UPSTREAM` | `relay:8080` | Where the bridge forwards to. |
|
|
|
|
|
|
|
|
|
|
The bridge's state volume holds its identity key, which clients pin through the
|
|
|
|
|
`cert` in the bridge line. Losing it invalidates every bridge line you have
|
|
|
|
|
handed out.
|
|
|
|
|
|
|
|
|
|
## Site copy
|
|
|
|
|
|
|
|
|
|
| Variable | Default | Notes |
|
|
|
|
|
|---|---|---|
|
|
|
|
|
| `FN_IOS_LIVE` | `false` | Flips clauses on the public pages that describe iPhone availability. Turning it on states general availability, so it belongs on after an App Store release and not during a beta. |
|
|
|
|
|
| `FN_DELETE_ON_ACK` | see Retention | Delete a delivered envelope the moment the recipient's app confirms it, rather than after the delivered-retention window. The metadata page reads this and describes whichever is true. |
|
|
|
|
|
| `FN_DISPOSABLE_EMAIL_DOMAINS` | unset | Comma-separated domains refused at sign-up. Empty means none are. |
|
|
|
|
|
| `FN_FEDERATION_SCREEN` | unset | Advisory IP screening for federated peers. It does not gate federation; the allowlist and the pinned key do. |
|
|
|
|
|
|
|
|
|
|
## Watching the key log (relay#32)
|
|
|
|
|
|
|
|
|
|
| Variable | Default | What it does |
|
|
|
|
|