Configure response signing to provide cryptographic proof that your gateway produced a given response.
If OBSERVER_KEYPAIR_PATH or OBSERVER_PRIVATE_KEY is set, the observer's Ed25519 Solana key signs responses directly. The key's Solana address is already in the on-chain Gateway Registry, so verifiers can confirm the signer with a single GAR lookup. If neither is set, the gateway auto-generates a standalone Ed25519 key at HTTPSIG_KEY_FILE; responses are still signed but can't be tied back to the registry. Setting both at once is rejected at startup as ambiguous.
Variable
Type
Default
Description
HTTPSIG_ENABLED
boolean
false
Enable RFC 9421 response signing
HTTPSIG_KEY_FILE
string
data/keys/httpsig.pem
Path to standalone Ed25519 private key PEM. Auto-generated on first startup if missing. Ignored when OBSERVER_KEYPAIR_PATH or OBSERVER_PRIVATE_KEY is set
HTTPSIG_BIND_REQUEST
boolean
true
Include request method and path in signature (prevents replay)
OBSERVER_KEYPAIR_PATH
string
-
Path to a 64-byte Solana keypair JSON file (e.g. solana-keygen new output). When set, used as the HTTPSIG signing key
OBSERVER_PRIVATE_KEY
string
-
Alternative to OBSERVER_KEYPAIR_PATH: base58-encoded 64-byte Solana secret key (the format Phantom and other browser wallets export)
The CDB64 index provides O(1) constant-time lookups for resolving data item IDs to their root Arweave transactions. As of Release 67, a pre-built index is enabled by default covering ~964 million records.
Variable
Type
Default
Description
ROOT_TX_LOOKUP_ORDER
string
db,gateways,cdb,graphql
Comma-separated list of root TX lookup sources. Options: db, cdb, gateways, turbo, graphql
CDB64_ROOT_TX_INDEX_SOURCES
string
shipped manifest
Comma-separated list of CDB64 sources: local paths, directories, HTTP URLs, Arweave TX IDs, or bundle data items
CDB64_ROOT_TX_INDEX_WATCH
boolean
true
Enable file watching for local CDB64 directories. New files auto-load without restart
CDB64_REMOTE_RETRIEVAL_ORDER
string
gateways,chunks
Data sources for fetching remote CDB64 files. Options: gateways, chunks, tx-data
CDB64_REMOTE_CACHE_MAX_REGIONS
number
100
Maximum byte-range regions to cache per remote source
CDB64_REMOTE_CACHE_TTL_MS
number
300000
TTL for cached byte-range regions (5 minutes)
CDB64_REMOTE_REQUEST_TIMEOUT_MS
number
30000
Request timeout for remote CDB64 sources
CDB64_REMOTE_MAX_CONCURRENT_REQUESTS
number
4
Maximum concurrent HTTP requests across all remote CDB64 sources
CDB64_REMOTE_SEMAPHORE_TIMEOUT_MS
number
5000
Maximum wait time for a request slot before failing
The gateway talks to four Solana programs that together implement the ar.io protocol (see protocol architecture). Each program ID is configured independently, so the same image can run against mainnet, staging-devnet, or a local devnet. Canonical mainnet IDs are listed in the Token docs. To confirm which set a running gateway is using, GET /ar-io/info returns the resolved programIds object.
Variable
Type
Default
Description
AR_IO_WALLET
string
-
Operator Solana public key (base58). Display label surfaced on /ar-io/info
SOLANA_RPC_URL
string
https://api.mainnet-beta.solana.com
Solana JSON-RPC endpoint. Public defaults throttle hard — use a premium provider (QuickNode, Helius, Triton) in production
SOLANA_KEYPAIR_PATH
string
-
Path to the operator's 64-byte Solana keypair JSON file. Signs join_network, update_gateway_settings, and cranker instructions. Inside the container the path must start with /app/wallets/
SOLANA_PRIVATE_KEY
string
-
Alternative to SOLANA_KEYPAIR_PATH: base58-encoded 64-byte secret (Phantom export format). Mutually exclusive with the file form
ENABLE_EPOCH_CRANKING
boolean
unset (= off)
When true, the observer runs permissionless epoch instructions (close_observation, tick_epoch, etc.). "When unset, observer skips cranking." Set false to make the off-state explicit
ARIO_CORE_PROGRAM_ID
string
-
ario-core program ID (token, staking, epoch state)
ARIO_GAR_PROGRAM_ID
string
-
ario-gar program ID (Gateway Registry; joins, observations, distributions)
ARIO_ARNS_PROGRAM_ID
string
-
ario-arns program ID (ArNS name registry)
ARIO_ANT_PROGRAM_ID
string
-
ario-ant program ID (ANT records — Metaplex Core NFTs that route names to data)
The default public Solana RPC is rate-limited and may block getProgramAccounts queries needed for full registry enumeration. For production gateways, use a dedicated RPC provider such as Helius, Triton, or QuickNode.
Submit observations to Solana programs. Pre-flight no-ops unless your pubkey is in epoch.prescribed_observers — harmless to leave at default before join_network
The observer uploads report bundles to Turbo. The upload signer is resolved from the first matching env in the precedence chain. Setting envs from more than one chain group at once is rejected at startup.
If your observer logs warn that TurboReportSink is not configured, explicitly set a Solana upload signer. Most operators can use the same base58 secret for both OBSERVER_PRIVATE_KEY and SOLANA_UPLOAD_PRIVATE_KEY.
Variable
Type
Default
Description
ARWEAVE_UPLOAD_KEY_FILE
string
-
Path to an Arweave JWK file. Highest priority for upload signing
ARWEAVE_UPLOAD_JWK
string
-
Inline Arweave JWK JSON. Lower priority than the file form
ETHEREUM_UPLOAD_PRIVATE_KEY_FILE
string
-
Path to a 32-byte hex private key (with or without 0x prefix)
ETHEREUM_UPLOAD_PRIVATE_KEY
string
-
Inline hex private key. Lower priority than the file form
SOLANA_UPLOAD_KEYPAIR_PATH
string
-
Path to a separate Solana keypair JSON for uploads. Ignored when any ARWEAVE_UPLOAD_* or ETHEREUM_UPLOAD_* is set
SOLANA_UPLOAD_PRIVATE_KEY
string
-
Alternative to above: base58 secret. Mutually exclusive with the file form
When none of the above are set, uploads fall back to the observer key, then the operator key. For production observers, prefer setting SOLANA_UPLOAD_KEYPAIR_PATH or SOLANA_UPLOAD_PRIVATE_KEY explicitly so report uploads do not depend on fallback behavior.