Skip to main content

​
All variables

VariableRequiredDefaultDescription
REDIS_URLYes—Redis connection string. Example: redis://localhost:6379. Required — server will not start without it.
PARMANA_API_KEYRecommended""Bearer token for API authentication. If empty, all requests are accepted without authentication.
AUDIT_DATABASE_URLRecommended""PostgreSQL connection string. If empty, audit records are not stored.
PARMANA_SIGNING_PROVIDERYes—Signing key source: "env" or "disk".
PARMANA_SIGNING_PRIVATE_KEYConditional—PEM-encoded Ed25519 private key. Required when PARMANA_SIGNING_PROVIDER=env.
PARMANA_SIGNING_PUBLIC_KEYConditional—PEM-encoded Ed25519 public key. Required when PARMANA_SIGNING_PROVIDER=env.
PARMANA_SIGNING_PRIVATE_KEY_PATHConditional—Path to PEM private key file. Required when PARMANA_SIGNING_PROVIDER=disk.
PARMANA_SIGNING_PUBLIC_KEY_PATHConditional—Path to PEM public key file. Required when PARMANA_SIGNING_PROVIDER=disk.
PORTNo3000Server listen port.
HOSTNo0.0.0.0Server bind address. Use 127.0.0.1 in production when behind Nginx.
CORS_ORIGINNohttp://localhost:8081Allowed CORS origin for browser requests.
PARMANA_POLICIES_ROOTNo/app/policiesDirectory path for compiled policy bundles.
PARMANA_TRUST_ROOTNo/app/trust/trust-root.jsonPath to trust root metadata JSON.
PARMANA_TRUST_PUBLIC_KEYNo/app/trust/root.pubPath to trust root PEM public key.
PARMANA_RELEASE_MANIFESTNo/app/artifacts/release-manifest.jsonPath to release manifest JSON.
PARMANA_RELEASE_SIGNATURENo/app/artifacts/release-manifest.sigPath to release manifest Ed25519 signature.

​
Signing key — Option A (env)

Set key material directly in the environment. Suitable for Docker environments where secrets are injected via secrets managers. 
PARMANA_SIGNING_PROVIDER=env
PARMANA_SIGNING_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VwBCIEIMqFRG...
-----END PRIVATE KEY-----"
PARMANA_SIGNING_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEA...
-----END PUBLIC KEY-----"
Never write private key material to .env files in version control. Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, Docker secrets) and inject at deploy time.

​
Signing key — Option B (disk)

Load key files from the filesystem. Suitable when keys are managed via filesystem permissions or HSM-backed volumes. 
PARMANA_SIGNING_PROVIDER=disk
PARMANA_SIGNING_PRIVATE_KEY_PATH=/secure/parmana/private.pem
PARMANA_SIGNING_PUBLIC_KEY_PATH=/secure/parmana/public.pem
Mount the key directory as read-only in Docker: 
volumes:
  - /path/to/keys:/secure/parmana:ro

​
Minimal working configuration

The minimum set required to start the server with full functionality: 
REDIS_URL=redis://redis:6379
PARMANA_API_KEY=your-secret-key
AUDIT_DATABASE_URL=postgresql://Parmana:password@postgres:5432/Parmana_audit
PARMANA_SIGNING_PROVIDER=env
PARMANA_SIGNING_PRIVATE_KEY=<PEM private key>
PARMANA_SIGNING_PUBLIC_KEY=<PEM public key>
The remaining variables use defaults that work in the standard Docker setup.

​
Generating Ed25519 keys

# Generate a key pair (OpenSSL)
openssl genpkey -algorithm ed25519 -out private.pem
openssl pkey -in private.pem -pubout -out public.pem
Or using Node.js: 
import crypto from "crypto";
import fs from "node:fs";

const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519", {
  privateKeyEncoding: { type: "pkcs8", format: "pem" },
  publicKeyEncoding:  { type: "spki",  format: "pem" },
});

fs.writeFileSync("private.pem", privateKey);
fs.writeFileSync("public.pem", publicKey);
Distribute public.pem to auditors and verifiers. Keep private.pem in a secrets manager.