Table of Contents

Production Configuration

View this file on GitHub

These files override Development defaults for production deployments.

Secrets Architecture

Secrets are split into two categories:

1. Database Credentials (environment variables)

Database credentials (FISHMMO_DB_HOST, FISHMMO_DB_PORT, FISHMMO_DB_NAME, FISHMMO_DB_USERNAME, FISHMMO_DB_PASSWORD) are the only secrets set via environment. They are resolved by the DatabaseSecrets class from:

  • FISHMMO_DB_* environment variables (highest priority)
  • /etc/fishmmo/db-secrets.env (Linux production)
  • %ProgramData%\FishMMO\db-secrets.env (Windows)

2. Application Secrets (database-backed)

Application secrets (gate secret, connection token HMAC key, signing key KEK) are never set via environment variables. They are:

  1. Generated by the FishMMO-Installer via SecurityKeyInstaller.ConfigureDatabaseKeysAsync() (Database menu > Configure Server Keys) and stored directly in the PostgreSQL deployment_secrets and connection_token_keys tables.
  2. Loaded by all servers at startup from the database — no env files to copy between machines.
  3. Client-side .generated.cs files (ClientApiSecret.generated.cs, CertificatePins.generated.cs, HostConfig.generated.cs) are generated from within the Unity Editor: FishMMO Dashboard (FishMMO > FishMMO Dashboard, or Ctrl+Shift+D) > Game Settings. There is no FishMMO > Security menu — these are Dashboard panels, not menu items.

Summary

Secret Type Storage How to Generate
DB credentials Env vars + /etc/fishmmo/db-secrets.env FishMMO-Installer > Database > Configure Database Secrets
Gate secret, HMAC key, KEK PostgreSQL database FishMMO-Installer > Database > Configure Server Keys
Client .generated.cs files Unity project files Unity Editor > FishMMO Dashboard (Ctrl+Shift+D) > Game Settings

Never commit real credentials to these files. See Development/.env.example for the required database credential environment variables.