OpenFeed.KeyStore.Env (OpenFeed v0.1.0)

Copy Markdown View Source

Reads the private JWK from an environment variable.

Multi-node safe, because every node is handed the same value by whatever deploys it. This is usually the right choice for a release.

Options

  • :var — the environment variable name. Defaults to "OPENFEED_PRIVATE_JWK".
  • :encoding — :json (default) or :base64, for the common case of a JWK base64-encoded to survive being passed around as a single line.
  • :cache — see OpenFeed.KeyStore. Defaults to true.

Getting the value

mix openfeed.gen.key --print              # JWK JSON on stdout
mix openfeed.gen.key --print --base64     # base64 of the same

Store the output in your secret manager and expose it as the variable. It is private key material: it should never reach version control, logs, or a CI job's environment dump.

This store is read-only — mix openfeed.gen.key cannot write to it, which is the point.