Configuration
Exactly one variable is required to boot: FLOODGATE_JWT_SECRET. Everything else has a working default, shown in [brackets] below. [(required)] means there is none; [(unset)] means the feature stays off until you set it. Each variable name is a link you can share.
no matches — press Esc, or clear the pattern, to see everything again.
boot
FLOODGATE_JWT_SECRET[(required)]Verifies every REST and socket JWT for the startup tenantFLOODGATE_TENANT_ID[fluid]Id of the tenant seeded at startup from FLOODGATE_JWT_SECRET
network
PORT / FLOODGATE_PORT[3000]Listen port (PORT wins)FLOODGATE_BIND[localhost]Listen interface; containers need 0.0.0.0FLOODGATE_PUBLIC_URL[http://localhost:<port>]Externally reachable base URLFLOODGATE_ALLOWED_ORIGINS[(same-origin)]Comma-separated allow-list, or * — see the note below
admin sign-in (github oauth)
FLOODGATE_GITHUB_CLIENT_ID[(unset)]GitHub OAuth App client id. OAuth stays disabled when unsetFLOODGATE_GITHUB_CLIENT_SECRET[(unset)]GitHub OAuth App client secretFLOODGATE_GITHUB_REDIRECT_URI[<public-url>/auth/github/callback]Explicit OAuth callback URIFLOODGATE_ADMIN_GITHUB_USERS[(unset)]Comma-separated GitHub usernames permitted to become admins. Unset denies OAuth login
admin surface
FLOODGATE_ADMIN_SESSION_TTL_SECONDS[604800]Admin browser session lifetimeFLOODGATE_ADMIN_STATIC_DIR[priv/static/admin]Built Lustre admin UI directoryFLOODGATE_ADMIN_KEY[(unset)]Bearer key for the tenant management API. Unset disables that API entirely
token mint
FLOODGATE_TOKEN_MINT_SECRET[(unset)]Enables the token-mint endpointFLOODGATE_TOKEN_MINT_USER_ID[floodgate-token-mint]User id in minted tokensFLOODGATE_TOKEN_MINT_USER_NAME[Floodgate Token Mint]User name in minted tokens
storage
FLOODGATE_STORAGE_BACKEND[shelf]shelf/ets (persistent DETS) or memory — also selects where tenants persistFLOODGATE_DATA_DIR[priv/floodgate_data]Shelf DETS directory; one file per documentFLOODGATE_DOC_IDLE_MS[300000]Drop an idle, disconnected document's cache and open file after this long. 0 disablesFLOODGATE_MAX_OPEN_DOCUMENTS[1024]Document files open at once; least-recently-used is closed at the cap. 0 disables
limits
FLOODGATE_MAX_FRAME_BYTES[16777216 (16 MiB)]Inbound frame ceiling; also maxMessageSize and Engine.IO's maxPayloadFLOODGATE_MAX_CONNECTIONS_PER_IP[256]Concurrent sockets per peer addressFLOODGATE_MAX_CONNECTIONS[4096]Concurrent sockets node-wideFLOODGATE_MESSAGE_RATE / _BURST[1000 / 2000]Per-socket inbound frame and decoded-message ratesFLOODGATE_JOIN_RATE / _BURST[100 / 200]Per-socket joins per secondFLOODGATE_HEARTBEAT_TIMEOUT_MS[60000]Server-side staleness window; a silent socket is evicted and closed
FLOODGATE_ALLOWED_ORIGINS applies to both socket endpoints. Non-browser clients (including the official Fluid drivers) send no Origin and are admitted under the default same-origin policy; the allow-list is only needed for browser clients served from another origin.
Set any limit to 0 to disable it. Defaults are deliberately generous: the conformance suites open several concurrent sockets from one address and burst ops during sync tests. The per-IP limit uses the real socket peer address and deliberately ignores X-Forwarded-For, which a client can set freely; behind a proxy every connection shares the proxy's address, so enforce per-client limits there instead.