# =============================================================================
# git-pkgs-proxy — SeaweedFS credentials for bucket `proxy-cache`
#
# Copy to .env and fill in the secret, then commit .env (this repo's convention
# is to commit stack .env files — see backup/agent/.env).
#
# The values here must match the `git-pkgs-proxy` identity in the SeaweedFS
# s3.json. That file is read at startup, so changing the identity there needs a
# restart of the seaweedfs container before these credentials work.
# =============================================================================

# Values are deliberately UNQUOTED. Compose strips quotes from an env_file, but
# `docker run --env-file` does not — a quoted secret reaches the process with
# the quote characters still in it and every S3 request fails with 403.

# Access key of the dedicated identity. It is scoped to Read/Write/List/Tagging
# on the single bucket `proxy-cache`: it cannot see backups, static sites or any
# other bucket on the server.
AWS_ACCESS_KEY_ID=git-pkgs-proxy

# Secret key for that identity. Generate ONCE with:  openssl rand -hex 32
AWS_SECRET_ACCESS_KEY=a21aad9192886e4b42ed49ae7b9e12ed0e84df80a4ceab7cdf2be0da5882e183

# SeaweedFS ignores the region, but SigV4 signing still needs one.
AWS_REGION=us-east-1
