Fail-closed startup

Configuration

Security-critical settings are validated before RustyAuth accepts traffic.

Core variables

AUTH_ISSUER

Public RustyAuth origin

WEBAUTHN_RP_ORIGIN

Exact browser application origin

WEBAUTHN_RP_ID

Exact host of the browser origin

SABLEDB_URL

Private Valkey-protocol URL

AUTH_MASTER_KEY_HEX

Active key wrapping signing material

BOOTSTRAP_TOKEN

Administrative enrolment credential

AUTH_EVENT_RPC_TOKEN

Private event-stream bearer credential

AUTH_IDENTITY_RPC_TOKEN

Private identity-control bearer credential

SPACETIME_AUDIENCE

Expected downstream audience

AUTH_TENANT_ID

Stable tenant identifier

Origin policy

RustyAuth compares exact origins. Production wildcard origins are rejected because WebAuthn relying-party identity and browser cookies both depend on a stable boundary.

SableDB boundary

The production SableDB hostname must resolve on the private network. The process refuses configurations that imply a public production database endpoint.

Signing rotation

Signing keys rotate automatically with safe JWKS prepublication and retired-key overlap. To rotate the master key, place the new value in AUTH_MASTER_KEY_HEX and keep the old value temporarily in AUTH_MASTER_PREVIOUS_KEYS_HEX. RustyAuth derives key IDs and rewraps private material automatically.

Scheduled backups

Provide the six required AUTH_BACKUP_* storage and encryption values to enable a verified backup at startup and every six hours by default. During backup-key rotation, retain old keys temporarily in AUTH_BACKUP_PREVIOUS_KEYS_HEX.

Protect secrets

Signing keys, bootstrap values and production credentials belong in your deployment platform's encrypted secret store, never in committed environment files.