Configuration

FLOODGATE_ALLOWED_ORIGINS applies to both socket endpoints. Non-browser clients — including the official Fluid drivers — send no Origin and are admitted under the default same-origin policy; the allow-list is only needed for browser clients served from another origin. Set any limit below to 0 to disable it — defaults are deliberately generous, since the conformance suites open several concurrent sockets from one address and burst ops during sync tests.

• FLOODGATE_JWT_SECRET [(required)] — Verifies every REST and socket JWT for the startup tenant
• PORT / FLOODGATE_PORT [3000] — Listen port (PORT wins)
• FLOODGATE_BIND [localhost] — Listen interface; containers need 0.0.0.0
• FLOODGATE_TENANT_ID [fluid] — Id of the tenant seeded at startup from FLOODGATE_JWT_SECRET
• FLOODGATE_GITHUB_CLIENT_ID [(unset)] — GitHub OAuth App client id. OAuth stays disabled when unset
• FLOODGATE_GITHUB_CLIENT_SECRET [(unset)] — GitHub OAuth App client secret
• FLOODGATE_GITHUB_REDIRECT_URI [<public-url>/auth/github/callback] — Explicit OAuth callback URI
• FLOODGATE_ADMIN_GITHUB_USERS [(unset)] — Comma-separated GitHub usernames permitted to become admins. Unset denies OAuth login
• FLOODGATE_ADMIN_SESSION_TTL_SECONDS [604800] — Admin browser session lifetime
• FLOODGATE_ADMIN_STATIC_DIR [priv/static/admin] — Built Lustre admin UI directory
• FLOODGATE_ADMIN_KEY [(unset)] — Bearer key for the tenant management API. Unset disables that API entirely
• FLOODGATE_TOKEN_MINT_SECRET [(unset)] — Enables the token-mint endpoint
• FLOODGATE_TOKEN_MINT_USER_ID [floodgate-token-mint] — User id in minted tokens
• FLOODGATE_TOKEN_MINT_USER_NAME [Floodgate Token Mint] — User name in minted tokens
• FLOODGATE_STORAGE_BACKEND [shelf] — shelf/ets (persistent DETS) or memory — also selects where tenants persist
• FLOODGATE_DATA_DIR [priv/floodgate_data] — Shelf DETS directory; one file per document
• FLOODGATE_DOC_IDLE_MS [300000] — Drop an idle, disconnected document's cache and open file after this long. 0 disables
• FLOODGATE_MAX_OPEN_DOCUMENTS [1024] — Document files open at once; least-recently-used is closed at the cap. 0 disables
• FLOODGATE_PUBLIC_URL [http://localhost:<port>] — Externally reachable base URL
• FLOODGATE_ALLOWED_ORIGINS [(same-origin)] — Comma-separated allow-list, or * — see Limits below

• FLOODGATE_MAX_FRAME_BYTES [16777216 (16 MiB)] — Inbound frame ceiling; also maxMessageSize and Engine.IO's maxPayload
• FLOODGATE_MAX_CONNECTIONS_PER_IP [256] — Concurrent sockets per peer address
• FLOODGATE_MAX_CONNECTIONS [4096] — Concurrent sockets node-wide
• FLOODGATE_MESSAGE_RATE / _BURST [1000 / 2000] — Per-socket inbound frames per second
• FLOODGATE_JOIN_RATE / _BURST [100 / 200] — Per-socket joins per second
• FLOODGATE_HEARTBEAT_INTERVAL_MS [30000] — Suggested client ping cadence; informational only
• FLOODGATE_HEARTBEAT_TIMEOUT_MS [60000] — Server-side staleness window; a silent socket is evicted and closed

The per-IP limit uses the real socket peer address and deliberately ignores X-Forwarded-For, which a client can set freely; behind a proxy every connection shares the proxy's address, so enforce per-client limits there instead.