deploy/systemd/gunnar.env.example
# /etc/gunnar/gunnar.env — root-owned, mode 0600.
#
# The key-encrypting key. 32 bytes of hex; everything gunnar seals is sealed
# under it. Generate once and back it up somewhere that is not this machine:
#
# openssl rand -hex 32
#
# Losing it means losing the transparency and provenance keys, which means the
# log can no longer be headed and every chain stops at the last signed head.
GUNNAR_SECRET_KEK=REPLACE-ME-WITH-32-HEX-BYTES
GUNNAR_DATA_ROOT=/var/lib/gunnar
RUST_LOG=info