master.env.example

# Copy to master.env. Materialize private files from the operator's age store.
# Secret files must be readable by container uid 65532 and have mode 0400 or 0600.
# Compose variables (CORTEX_IMAGE and bind address) are supplied with --env-file.
CORTEX_IMAGE=
BASE_GATEWAY_BIND_ADDRESS=
# Absolute host directory holding <challenge id>/internal.token (and admin.token, ...).
# The supervisor bind-mounts <dir>/<id> read-only into each challenge container.
BASE_CHALLENGE_SECRETS_HOST_DIR=
# Host group owning /var/run/docker.sock (`stat -c %g /var/run/docker.sock`).
BASE_DOCKER_GID=
BASE_NETUID=541
BASE_CHAIN_ENDPOINT=test
BASE_CHAIN_FALLBACK_ENDPOINTS=[]
BASE_EMIT_POLL_SECS=120
BASE_EPOCH_REFRESH_SECS=12
BASE_EPOCH_STALE_SECS=60
BASE_CHALLENGES_MIN_VERSION=1
BASE_MEASUREMENTS_MIN_VERSION=1
# Dedicated KVM host on the VPC. Empty URL keeps Proof unwired.
PROOF_VM_ORCHESTRATOR_URL=
PROOF_VM_ORCHESTRATOR_TOKEN_FILE=/run/secrets/proof-vm.token
PROOF_VM_ORCHESTRATOR_CA_FILE=/run/secrets/proof-vm-ca.pem
# Fill only from measured bytes and the signed offer; blanks make master boot fail if URL is set.
PROOF_RLM_VM_IMAGE_DIGEST=
# Small-host smoke shape, shared by persistent topic and fresh experiment VMs.
# Match the host caps and capacity; see deploy/README.md before enabling Proof.
PROOF_RLM_VM_VCPUS=1
PROOF_RLM_VM_MEM_MIB=1024
PROOF_RLM_VM_DISK_MIB=16384
PROOF_INFERENCE_OFFER_COMMITMENT=
# Comma-separated ids; every id must also appear in host.toml custom_ids.
PROOF_VM_RUNNER_CUSTOM_IDS=