Web console

Off by default. The hub ships a CLI + operator-key flow that needs no web surface; TOWONEL_HUB_WEB_ENABLED=true mounts the account routes (/v1/auth/*, /v1/signup-invites, /v1/users) that back a browser console — self-service signup, passkeys, TOTP, password reset, OIDC login.

Requirements

Enabling the console adds two hard startup checks:

• TOWONEL_HUB_PUBLIC_URL must be set. The WebAuthn RP ID and the credential/invite URLs derive from it; the 0.0.0.0 listen-address fallback yields unusable passkeys.
• Mail must be configured (TOWONEL_MAIL_MAILJET_API_KEY, TOWONEL_MAIL_MAILJET_API_SECRET, TOWONEL_MAIL_FROM_EMAIL). Signup is verification-gated, so without a mailer unverified accounts lock themselves out.

-e TOWONEL_HUB_WEB_ENABLED=true
-e TOWONEL_HUB_PUBLIC_URL=https://hub.example.eu
-e TOWONEL_HUB_CONSOLE_URL=https://console.example.eu   # browser front-end origin
# WebAuthn RP ID derives from PUBLIC_URL; override only if they differ:
-e TOWONEL_HUB_WEBAUTHN_RP_ID=example.eu

Transactional mail (Mailjet)

-e TOWONEL_MAIL_MAILJET_API_KEY=...
-e TOWONEL_MAIL_MAILJET_API_SECRET=...
-e TOWONEL_MAIL_FROM_EMAIL=no-reply@example.eu
-e TOWONEL_MAIL_FROM_NAME=Towonel
-e TOWONEL_MAIL_SANDBOX=false   # true routes to Mailjet's sandbox (no delivery)

OIDC login (Codeberg)

-e TOWONEL_HUB_OIDC_CODEBERG_ISSUER=https://codeberg.org
-e TOWONEL_HUB_OIDC_CODEBERG_CLIENT_ID=...
-e TOWONEL_HUB_OIDC_CODEBERG_CLIENT_SECRET=...
-e TOWONEL_HUB_OIDC_CODEBERG_REDIRECT_URI=https://console.example.eu/api/v1/auth/oidc/codeberg/callback

TOWONEL_HUB_OIDC_CODEBERG_TRUST_EMAIL_VERIFIED is off by default. It auto-links an OIDC login into an existing verified local account when the emails match — only enable it for a provider whose email_verified claim you trust as much as mailbox control.

On Kubernetes these are env under controllers.main.containers.main.env (secrets via envFrom) — see Hub on Kubernetes.