CDN, KMS & secrets
Beyond the database and object store, the server has three families of optional adapters. They’re all off (or set to a safe default) until you opt in, and you only configure the one you need.
None of these are required to run the server. Start without them; add one when you have the matching need — a CDN in front of delivery, encrypted PDFs, or a central secret manager.
CDN — signed delivery#
By default the server delivers bytes directly. To put a CDN in front and serve
signed, time-limited URLs from the edge, set CLOUDPDF_CDN_KIND:
CLOUDPDF_CDN_KIND=cloudfront # bunny | cloud-cdn | cloudfront | azure-fd | custom-hmac| Value | Provider |
|---|---|
none (default) | Direct delivery, no CDN signing. |
bunny | Bunny CDN. |
cloud-cdn | Google Cloud CDN. |
cloudfront | AWS CloudFront. |
azure-fd | Azure Front Door. |
custom-hmac | A generic HMAC-signed-URL scheme for your own edge. |
Each provider has its own credentials and key settings; the server validates them on boot and tells you what’s missing.
KMS — encrypted documents#
To work with password-protected or encrypted PDFs, the server needs a key source.
CLOUDPDF_KMS_KIND selects it:
CLOUDPDF_KMS_KIND=aws-kms # static | aws-kms | gcp-kms | azure-kv| Value | Behaviour |
|---|---|
static (default) | Keys from configuration — fine for development. |
aws-kms | AWS Key Management Service. |
gcp-kms | Google Cloud KMS. |
azure-kv | Azure Key Vault. |
KMS is only consulted for encrypted-document sessions. If you don’t serve encrypted PDFs, you never need to configure it.
Secrets — where credentials come from#
The other adapters need credentials (bucket keys, KMS access, CDN signing keys).
CLOUDPDF_SECRETS_PROVIDERS is a comma-separated registry of where the server
reads those secrets:
CLOUDPDF_SECRETS_PROVIDERS=env # default: read from environment variables
CLOUDPDF_SECRETS_PROVIDERS=aws-sm,env # try AWS Secrets Manager, then fall back to envThis lets enterprises keep secrets in a central manager (AWS Secrets Manager, GCP
Secret Manager, Azure Key Vault) instead of in plain environment variables, while
keeping env as a simple default for everyone else.
The provider SDKs are optional dependencies — installed with the npm package and baked into the Docker image — so adding a provider is a configuration change, not a new install.