PORT | 3100 | Server port |
PAPERCLIP_BIND | loopback | Reachability preset: loopback, lan, tailnet, or custom |
PAPERCLIP_BIND_HOST | (unset) | Required when PAPERCLIP_BIND=custom |
HOST | 127.0.0.1 | Legacy host override; prefer PAPERCLIP_BIND for new setups |
DATABASE_URL | (embedded) | PostgreSQL connection string |
PAPERCLIP_HOME | ~/.paperclip | Base directory for all Vagaris data |
PAPERCLIP_INSTANCE_ID | default | Instance identifier (for multiple local instances) |
PAPERCLIP_DEPLOYMENT_MODE | local_trusted | Runtime mode override |
PAPERCLIP_DEPLOYMENT_EXPOSURE | private | Exposure policy when deployment mode is authenticated |
PAPERCLIP_API_URL | (auto-derived) | Vagaris API base URL. When set externally (e.g., via Kubernetes ConfigMap, load balancer, or reverse proxy), the server preserves the value instead of deriving it from the listen host and port. Useful for deployments where the public-facing URL differs from the local bind address. |
IDENTITY_CLI_CLIENT_ID | app-vagaris-cli | Public native client registered at the fleet OIDC issuer for CLI authorization-code + PKCE login. Override only when the issuer has a corresponding reviewed native client. |
IDENTITY_MFA_ACR | (unset — fail-closed) | The acr the fleet OIDC issuer stamps on an access token when, and only when, a second factor completed (the issuer's MFA_ACR). The ratification gate's MFA arm reads it beside IDENTITY_ISSUER: a RATIFY-family decision on a fleet identity token is refused with the step-up envelope (step_up_required, details.reason: ratification_requires_mfa, details.step_up: second_factor_required) unless the token's acr matches this value. It is disclosed to clients (GET /api/auth/step-up, the CLI's oidc-config) so a refusal can name what it wants; it is never sent back to the issuer as acr_values — the fleet issuer reads none, and whether a sign-in includes a second factor is the organization's login policy there. Unset, no token can assert a second factor, so every federated ratification is refused — the setting can make an assertion readable, never unnecessary. |