Document environment variables, fixes #772

Some things to discuss:

1. There are some envs/features, which are currently only deployed in the v3 path. Do we need them in v5 (I don't think so - maybe to specify a gateway to debug one...)
2. Can you please check the envs LEAP_PRIVATE_BRIDGE_CERT and LEAP_PRIVATE_BRIDGE. For me they don't make sense. So far I haven't looked into the obfs4 code part

docs/debug.rst

@@ -91,33 +91,29 @@ To force logging:
 
   QT_FORCE_STDERR_LOGGING=1 ./riseup-vpn.exe
 
+We should probably restrict this to non-release versions only.
 
-Ciphersuites and other openvpn params
--------------------------------------
-You can specify a custom `openvpn_configuration` block from a local file
-(instead of fetching it from `eip-service.json`) via an environment variable:
-
-.. code:: bash
-
-  LEAP_OPENVPN_EXTRA_CONFIG=../extra-config.json ./riseup-vpn
-
-Manual Gateway Selection
-------------------------
-In the same spirit, you can manually override the gateway selection via an
-environment variable that contains the hostname of the gateway:
-
-
-.. code:: bash
+Environment Variables
+~~~~~~~~~~~~~~~~~~~~~
 
-  LEAP_GW=hostname.riseup.net ./riseup.vpn
+The envs are only used for debugging and developing. The envs affecting the logging behavior are documented in the logging section in the `README <https://0xacab.org/leap/bitmask-vpn/-/blob/main/README.md?ref_type=heads#logging>`_.
 
-Dry run
--------
+- ``SKIP_VERSION_CHECK``: Do not check if there is an update available
+- ``LEAP_DRYRUN``: Don't route traffic over VPN (run openvpn with "--pull-filter ignore route" argument) and do not touch firewall rules
+- ``MOTD_URL``: Overwrite the MOTD (message of the day) url
+- ``SNAP``: If not empty, we expect to be in a Snap environment (client was installed by Snap)
+- ``UDP``: If we use UDP, UDP is set to 1. If we use TCP, UDP is set to 0. The value is read by the bitmask-root helper which sets firewall rules on Linux
+- ``LEAP_PROVIDER``: Select the provider to use. Must be one of the providers listed in ``gui/providers/providers.json``. File is generated by the Makefile which runs ``./branding/scripts/gen-providers-json``
 
-To avoid setting up the routes, you can pass the LEAP_DRYRUN variable:
+Only implemented in v3/vpnweb:
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-.. code:: bash
+- ``LEAP_GW``: Specify the gateway hostname to connect with. It needs to be one of the gateway returned by vpnweb
+- ``LEAP_OPENVPN_EXTRA_CONFIG``: Specify a file with extra OpenVPN arguments to use. File should be in json format (in key value format like {"--dev": "tun"} or {"--persist-key": true})
+- ``LEAP_KCP``: Enforce the use of KCP in obfsvpn
 
-  LEAP_DRYRUN=1 ./riseup.vpn
+obfs4
+~~~~~
 
-We should probably restrict this to non-release versions only.
+- ``LEAP_PRIVATE_BRIDGE_CERT``: Specify the cert string for the obfs4 bridge to be used
+- ``LEAP_PRIVATE_BRIDGE``: Specify the host:port for the obfs4 bridge to be used