Server mode

In Server mode, your app is a masks server and nothing else.

Setting up

Add the gem to your Gemfile:
```
gem "masks-server"
```
Run the install generator:
Terminal window
```
bin/rails generate masks:server:install --mode server
```
The generator mounts masks at / and writes config/initializers/masks_server.rb, which sets config.masks.mode = :server. When the app has a config/puma.rb, the generator adds plugin :masks_ldap to it, so Puma also serves LDAP.
Set config.active_record.schema_format = :sql. Row-level security does not survive a schema.rb.
Set up the database roles, as described below.
Set the Active Record encryption keys, config.active_record.encryption.primary_key and key_derivation_salt. masks encrypts each tenant’s secret columns under a key derived from them.
Set MASKS_PUBLIC_ORIGIN_TEMPLATE, such as https://auth.example.com. masks builds the issuer and every link it emails from it. Outside development and test, masks does not boot without it.
Run bin/rails db:prepare.
Run bin/rails masks:tenants. It creates each tenant that MASKS_TENANTS or MASKS_TENANT names, and prints the setup token of each tenant that is not set up yet.
Open /login and set up the first account with the setup token.

Database roles

masks keeps its tables in the primary database. Row-level security, which limits each query to one tenant’s rows, keeps tenants apart. Two kinds of role get around it, so masks checks the role it serves as:

A role that holds SUPERUSER or BYPASSRLS is always refused.
Outside development and test, a role that owns masks’ tables is refused, since an owner can turn row-level security off.

Migrate as one role and serve as another, as database roles describes. The serving role needs SELECT, INSERT, UPDATE, and DELETE on the tables and the sequences behind them.

Settings

The gem reads masks’ own settings from the environment, such as MASKS_TENANTS and MASKS_SMTP_ADDRESS. Environment variables lists them.

Some variables on that page belong to the container image’s app and are not part of the gem, such as POSTGRES_HOST, MASKS_MASTER_KEY, and RAILS_FORCE_SSL. Your app sets up its database, encryption keys, and SSL in its own way.