Configuration

Every SuperDRM setting is an environment variable, read once at process start. Under Compose they live in .env; under Helm in the chart values and Secret; under systemd in ~/.config/superdrm/api.env (mode 600). deploy/compose/.env.example lists every variable with its default.

#Service

VariableDefaultMeaning
PORT8770Listen port
HOST127.0.0.1Bind address. 0.0.0.0 behind the tunnel or Caddy
SUPERDRM_PUBLIC_URLhttp://127.0.0.1:8770Origin used in returned licence URLs and CPIX (https://api.<your domain> in production)
SUPERDRM_ADMIN_TOKEN(unset = admin API disabled)Operator bearer for /v1/admin/*; rotate by editing and restarting
SUPERDRM_IP_SALTsuperdrmSalt for the hashed viewer IP stored on meter rows
SUPERDRM_LOG_JSON01 for JSON logs
SUPERDRM_MODEstandalonestandalone · onprem · mothership

#Database

VariableDefaultMeaning
DATABASE_URL(empty)Postgres connection string. Empty → embedded PGlite (single node only)
SUPERDRM_DATA_DIR./dataPGlite data directory when DATABASE_URL is empty

Migrations in db/migrations/*.sql apply automatically at start and are tracked in superdrm_migrations.

#Key vault

VariableDefaultMeaning
SUPERDRM_VAULTlocallocal · pkcs11 · aws-kms
SUPERDRM_KEK_IDlocal-1 / pkcs11:<label> / aws-kmsIdentifier written on every sealed row; change it when you rotate
SUPERDRM_LOCAL_KEK_FILElocal: 32-byte hex or base64 file, mode 600
SUPERDRM_PKCS11_MODULEpkcs11: path to the token's PKCS#11 library
SUPERDRM_PKCS11_PINpkcs11: user PIN
SUPERDRM_PKCS11_KEY_LABELsuperdrm-kek-1pkcs11: AES-256 KEK object label (created non-extractable if absent)
SUPERDRM_PKCS11_TOKEN_LABELpkcs11: pick a slot by token label
SUPERDRM_PKCS11_SLOT0pkcs11: slot index when no label is given
SUPERDRM_PKCS11_GCM_PARAMSv240pkcs11: v230 for tokens that predate PKCS#11 2.40 GCM params
SUPERDRM_KMS_KEY_IDaws-kms: CMK id or ARN
AWS_REGIONus-west-2aws-kms: region

See Hardware key vault for the ceremony and rotation.

#Widevine

VariableDefaultMeaning
SUPERDRM_WIDEVINE_ENVuatWhich partner credential set new keys register under: uat (Google's test signer) or prod (partner_creds row widevine:prod)
SUPERDRM_ALLOW_BUILTIN_UAT1Allow the built-in public widevine_test signer when no widevine:uat row exists
SUPERDRM_WV_TRACKSDTrack type registered for single-key content; HD makes Google require L1
SUPERDRM_KEY_SOURCEwidevinelocal generates keys here and licenses them via content_key_specs; Google only signs

#FairPlay

VariableDefaultMeaning
SUPERDRM_FPS_KSM_URL(unset = FairPlay 503)KSM sidecar base URL, e.g. http://127.0.0.1:8781
SUPERDRM_FPS_KSM_TOKENBearer for a non-loopback sidecar

#On-prem licence and reporting

VariableDefaultMeaning
SUPERDRM_LICENSE_KEYYour signed install licence (sdrmi1.…). Absent or expired → community mode (one tenant)
SUPERDRM_INSTALL_PUBKEYSuperDRM's Ed25519 install-signing public key
SUPERDRM_INSTALL_ID(from the licence)Override the install id
SUPERDRM_TENANT_CAP(from the licence)Override the tenant cap
SUPERDRM_REPORT_URLWhere hourly usage reports go; empty = never report (air-gapped)
SUPERDRM_REPORT_KEY / SUPERDRM_REPORT_SECRETCredentials for the report

#Console, docs and live

VariableDefaultMeaning
SUPERDRM_API_URLInternal api address the console, docs and live use
SUPERDRM_PUBLIC_API_URLLive console: the api URL players use
DOCS_PASSWORD_HASHscrypt hash of the one password that opens docs and live (single-quote it: it contains $)
DOCS_SESSION_SECRETCookie signing secret for docs and live
DOCS_CANONICAL_HOSTRedirect other hostnames here
DOCS_INSECURE_COOKIE01 only on plain-HTTP internal hosts
LIVE_PORT / LIVE_HOST8773 / 127.0.0.1Live console bind

#Environment matrix

Variableapiconsoledocslive
DATABASE_URL
SUPERDRM_PUBLIC_URL✓ (SUPERDRM_PUBLIC_API_URL)
SUPERDRM_ADMIN_TOKEN
Vault variables
Widevine / FairPlay variables
SUPERDRM_MODE, licence and reporting
SUPERDRM_API_URL
DOCS_*
PORT / HOST

Updated September 2026