Configuration
Every SuperDRM setting is an environment variable, read once at process start. Under Compose they live in .env; under Helm in the chart values and Secret; under systemd in ~/.config/superdrm/api.env (mode 600). deploy/compose/.env.example lists every variable with its default.
#Service
| Variable | Default | Meaning |
|---|---|---|
PORT | 8770 | Listen port |
HOST | 127.0.0.1 | Bind address. 0.0.0.0 behind the tunnel or Caddy |
SUPERDRM_PUBLIC_URL | http://127.0.0.1:8770 | Origin used in returned licence URLs and CPIX (https://api.<your domain> in production) |
SUPERDRM_ADMIN_TOKEN | (unset = admin API disabled) | Operator bearer for /v1/admin/*; rotate by editing and restarting |
SUPERDRM_IP_SALT | superdrm | Salt for the hashed viewer IP stored on meter rows |
SUPERDRM_LOG_JSON | 0 | 1 for JSON logs |
SUPERDRM_MODE | standalone | standalone · onprem · mothership |
#Database
| Variable | Default | Meaning |
|---|---|---|
DATABASE_URL | (empty) | Postgres connection string. Empty → embedded PGlite (single node only) |
SUPERDRM_DATA_DIR | ./data | PGlite data directory when DATABASE_URL is empty |
Migrations in db/migrations/*.sql apply automatically at start and are tracked in superdrm_migrations.
#Key vault
| Variable | Default | Meaning |
|---|---|---|
SUPERDRM_VAULT | local | local · pkcs11 · aws-kms |
SUPERDRM_KEK_ID | local-1 / pkcs11:<label> / aws-kms | Identifier written on every sealed row; change it when you rotate |
SUPERDRM_LOCAL_KEK_FILE | — | local: 32-byte hex or base64 file, mode 600 |
SUPERDRM_PKCS11_MODULE | — | pkcs11: path to the token's PKCS#11 library |
SUPERDRM_PKCS11_PIN | — | pkcs11: user PIN |
SUPERDRM_PKCS11_KEY_LABEL | superdrm-kek-1 | pkcs11: AES-256 KEK object label (created non-extractable if absent) |
SUPERDRM_PKCS11_TOKEN_LABEL | — | pkcs11: pick a slot by token label |
SUPERDRM_PKCS11_SLOT | 0 | pkcs11: slot index when no label is given |
SUPERDRM_PKCS11_GCM_PARAMS | v240 | pkcs11: v230 for tokens that predate PKCS#11 2.40 GCM params |
SUPERDRM_KMS_KEY_ID | — | aws-kms: CMK id or ARN |
AWS_REGION | us-west-2 | aws-kms: region |
See Hardware key vault for the ceremony and rotation.
#Widevine
| Variable | Default | Meaning |
|---|---|---|
SUPERDRM_WIDEVINE_ENV | uat | Which partner credential set new keys register under: uat (Google's test signer) or prod (partner_creds row widevine:prod) |
SUPERDRM_ALLOW_BUILTIN_UAT | 1 | Allow the built-in public widevine_test signer when no widevine:uat row exists |
SUPERDRM_WV_TRACK | SD | Track type registered for single-key content; HD makes Google require L1 |
SUPERDRM_KEY_SOURCE | widevine | local generates keys here and licenses them via content_key_specs; Google only signs |
#FairPlay
| Variable | Default | Meaning |
|---|---|---|
SUPERDRM_FPS_KSM_URL | (unset = FairPlay 503) | KSM sidecar base URL, e.g. http://127.0.0.1:8781 |
SUPERDRM_FPS_KSM_TOKEN | — | Bearer for a non-loopback sidecar |
#On-prem licence and reporting
| Variable | Default | Meaning |
|---|---|---|
SUPERDRM_LICENSE_KEY | — | Your signed install licence (sdrmi1.…). Absent or expired → community mode (one tenant) |
SUPERDRM_INSTALL_PUBKEY | — | SuperDRM's Ed25519 install-signing public key |
SUPERDRM_INSTALL_ID | (from the licence) | Override the install id |
SUPERDRM_TENANT_CAP | (from the licence) | Override the tenant cap |
SUPERDRM_REPORT_URL | — | Where hourly usage reports go; empty = never report (air-gapped) |
SUPERDRM_REPORT_KEY / SUPERDRM_REPORT_SECRET | — | Credentials for the report |
#Console, docs and live
| Variable | Default | Meaning |
|---|---|---|
SUPERDRM_API_URL | — | Internal api address the console, docs and live use |
SUPERDRM_PUBLIC_API_URL | — | Live console: the api URL players use |
DOCS_PASSWORD_HASH | — | scrypt hash of the one password that opens docs and live (single-quote it: it contains $) |
DOCS_SESSION_SECRET | — | Cookie signing secret for docs and live |
DOCS_CANONICAL_HOST | — | Redirect other hostnames here |
DOCS_INSECURE_COOKIE | 0 | 1 only on plain-HTTP internal hosts |
LIVE_PORT / LIVE_HOST | 8773 / 127.0.0.1 | Live console bind |
#Environment matrix
| Variable | api | console | docs | live |
|---|---|---|---|---|
DATABASE_URL | ✓ | |||
SUPERDRM_PUBLIC_URL | ✓ | ✓ (SUPERDRM_PUBLIC_API_URL) | ||
SUPERDRM_ADMIN_TOKEN | ✓ | ✓ | ✓ | ✓ |
| Vault variables | ✓ | |||
| Widevine / FairPlay variables | ✓ | |||
SUPERDRM_MODE, licence and reporting | ✓ | |||
SUPERDRM_API_URL | ✓ | ✓ | ✓ | |
DOCS_* | ✓ | ✓ | ||
PORT / HOST | ✓ | ✓ | ✓ | ✓ |
Updated September 2026