.env.example

# Your domain name pointing to this VPS (e.g. ultimate.yourdomain.com).
DOMAIN=

# A long random string used to sign JWTs.
# Generate one with: python3 -c "import secrets; print(secrets.token_hex(32))"
# Must be at least 32 characters long. Keep this secret.
SECRET_KEY=

# Only needed for HTTP-only deployments (no domain name, no Caddy).
# Set to your server's IP and port: http://YOUR_SERVER_IP:8000
# FRONTEND_ORIGIN=

# Account service used when an ordinary self-hosted Möbius links a Möbius · You
# identity. Change this when identity moves to an independent public host.
MOBIUS_ACCOUNT_ORIGIN=https://www.mobius.you
# Usually blank: the server derives the exact client origin from
# FRONTEND_ORIGIN. Set an HTTPS origin here only when a reverse proxy makes the
# browser-facing origin different.
MOBIUS_ACCOUNT_CLIENT_ORIGIN=

# Optional shared browser origin for owner-trusted full web services. Point one
# DNS name at this Möbius host, then enable public_surface per service in
# local-services.json. Every enabled service uses /services/<slug> below this
# one origin, so later services need no additional DNS record.
# MOBIUS_SERVICE_GATEWAY_ORIGIN=https://services.mobius.example.com
# The normal in-product agent has passwordless full root by default. Set this
# to 0 only as an operator kill switch; changing it requires recreating the app.
MOBIUS_AGENT_SUDO=1

# Optional self-hosted Möbius trial control plane. The runtime holds no central
# secret: signing in binds the root-owned local broker key through public PKCE.
# Railway-managed deployments receive these values and a one-use bootstrap
# automatically from mobius.you.
# MOBIUS_IDENTITY_ISSUER=https://www.mobius.you
# MOBIUS_AGENT_GATEWAY_URL=https://www.mobius.you
# Anonymous contribution relay. The relay URL defaults to the identity issuer,
# but the reviewed target is deliberately explicit. Non-mobius-os targets are
# rejected unless they are also named in the test-only allowlist.
# MOBIUS_CONTRIBUTION_RELAY_URL=https://www.mobius.you
# MOBIUS_CONTRIBUTION_TARGET_REPO=mobius-os/mobius
# MOBIUS_CONTRIBUTION_RELAY_TEST_REPOSITORIES=owner/test-repository