Configuration
The service
| Variable | What it is |
|---|---|
FILM_SECRET | The shared secret every caller sends in x-film-secret; the deployment injects it. |
WAVESPEED_API_KEY | With FILM_PUBLIC_URL, gives the deployment the wavespeed renderer. |
KIE_API_KEY | With FILM_PUBLIC_URL, gives it kling, sora and veo. |
HEDRA_API_KEY | With FILM_PUBLIC_URL, gives it hedra (key_id:secret). |
FILM_PUBLIC_URL | Film's public https:// origin. Renderers call back to {FILM_PUBLIC_URL}/v1/callbacks/{pipeline}. Without it KIE, WaveSpeed and Hedra are left out and the log says why. |
FILM_PIPELINE_URL | Gives it the deployment's own wisent pipeline. |
A renderer whose variables are incomplete is left out and logged as
renderer not configured with the reason; the others still serve.
GET /readyz names the renderers this deployment has.
The caller
| Variable | What it is |
|---|---|
FILM_URL | Where the service is. |
FILM_SECRET_ROLE | ROLE#FIELD: the vault role whose item holds the caller secret, and its field, read with stado credentials get --role ROLE --field FIELD. No item is named, so replacing the item changes nothing here. The CLI never takes the secret itself from the environment. |
STADO_BIN | Another Stado executable than stado. |
FILM_CREDENTIALS_FILE | Without Stado: an owner-only (mode 600) JSON file of role → field → value that answers FILM_SECRET_ROLE in Stado's place. |
Refusals
Exit 1 from start,
status and
list, before anything is sent:
FILM_URL is not set: <cause>
FILM_SECRET_ROLE is not set (<cause>): name the vault role holding the Film caller secret and its field as ROLE#FIELD
FILM_SECRET_ROLE must be a role reference ROLE#FIELD, not "<value>"
FILM_SECRET_ROLE: <binary> could not be run: <cause>; without Stado set FILM_CREDENTIALS_FILE to an owner-only JSON file of role -> field -> value
FILM_SECRET_ROLE: <binary> credentials get --role <role> --field <field> failed (<exit status>): <what Stado said>
FILM_SECRET_ROLE: the item playing role <role> holds no value in field <field>
FILM_CREDENTIALS_FILE <path> must be readable by its owner only (mode <mode>)
FILM_CREDENTIALS_FILE <path> cannot be read: <cause>
FILM_CREDENTIALS_FILE <path> is not a JSON object of role -> field -> value: <cause>
FILM_CREDENTIALS_FILE <path> has no non-empty <role>#<field>