Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
107 lines (96 loc) · 5.13 KB
/
Copy path.env.example
File metadata and controls
107 lines (96 loc) · 5.13 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# Copied to .env by `make` on first run. .env is gitignored; never commit secrets.
# development | test | production. Production turns on email verification and
# requires RESEND_API_KEY; development logs email links instead of sending.
APP_ENV=development
# Public origin of the app (links in emails, auth callbacks). The server binds
# 0.0.0.0, so set this to the URL people actually use (LAN/Tailscale host is fine).
PUBLIC_URL=http://localhost:3000
# Optional: origin the server uses to reach itself (defaults to PUBLIC_URL).
# INTERNAL_URL=http://127.0.0.1:3000
# Optional: extra origins allowed to call auth endpoints (comma-separated),
# e.g. the mobile app scheme or a Tailscale hostname.
# TRUSTED_ORIGINS=betterstack://,http://dev-box:3000
# Optional: header your proxy sets to the client IP, used for auth rate limits
# (Railway: X-Real-IP). Leave empty without a proxy: clients could spoof it.
# CLIENT_IP_HEADER=X-Real-IP
# Optional: the product name in the UI header and page titles (default "My App").
# APP_NAME=My App
# Optional: listen port (Railway sets it).
# PORT=3000
# Unset: make points it at this checkout's docker compose Postgres (`make env`).
# Hosted Postgres uses ?sslmode=require.
# DATABASE_URL=postgres://postgres:postgres@127.0.0.1:5432/app?sslmode=disable
# At least 32 characters. Generate one with: openssl rand -base64 32
AUTH_SECRET=dev-only-secret-change-me-0123456789abcdef
# While rotating: the old value(s), comma-separated, still accepted for
# AUTH_SECRET_GRACE (default: session lifetime, 30 days with 2FA). docs/secrets.md.
# AUTH_SECRET_PREVIOUS=
# A leaked value: never accepted again, only used to unwrap 2FA keys.
# AUTH_SECRET_REVOKED=
# AUTH_SECRET_GRACE=168h
# Required in production. Without it auth emails are logged, not sent.
# With SECRETS_PROVIDER=doppler it comes from Doppler instead (this is ignored).
RESEND_API_KEY=
# Required in production: a sender on your Resend-verified domain (an
# example.com address is refused there).
FROM_EMAIL=noreply@example.com
# Google / Apple sign-in (optional, docs/sign-in.md). A
# provider is on when its client id is set; then its credentials are required.
# Register <PUBLIC_URL>/auth/callback/google (or /apple) with the provider.
# GOOGLE_CLIENT_ID=xxxx.apps.googleusercontent.com
# GOOGLE_CLIENT_SECRET= live secret
# APPLE_CLIENT_ID=com.example.web the Services ID
# APPLE_TEAM_ID=
# APPLE_KEY_ID= live secret, rotates with the key
# APPLE_PRIVATE_KEY= live secret: the .p8 contents, \n for newlines
# Live secrets (docs/secrets.md): env (default, read once at boot) or doppler
# (polled; RESEND_API_KEY rotates without a restart).
# SECRETS_PROVIDER=doppler
# DOPPLER_TOKEN=dp.st.dev.xxxx read-only service token for one config
# SECRETS_REFRESH_INTERVAL=60s
# SECRETS_MAX_STALENESS=15m
# Optional object storage + image uploads (docs/storage.md): off unless all
# four STORAGE_S3_* secrets are set (live secrets: from Doppler with
# SECRETS_PROVIDER=doppler). Region and path style are plain env.
# STORAGE_S3_ENDPOINT=http://127.0.0.1:9000
# STORAGE_S3_BUCKET=app
# STORAGE_S3_ACCESS_KEY_ID=
# STORAGE_S3_SECRET_ACCESS_KEY=
# STORAGE_S3_REGION=us-east-1 (empty: auto, for Railway and R2)
# STORAGE_S3_PATH_STYLE=true (MinIO)
# make derives a compose project and ports per checkout so parallel worktrees
# never collide; `make env` prints them. Override only if you need fixed values.
# COMPOSE_PROJECT_NAME=myapp
# POSTGRES_PORT=5432
# PGWEB_PORT=5050
# TEST_POSTGRES_PORT=54329 (unset: a free port on every start)
# --- Admin dashboard (apps/admin, optional) ---
# `make admin-dev` serves it on 0.0.0.0:ADMIN_PORT. It reads DATABASE_URL (the
# app's users) and its own ADMIN_DATABASE_URL (admins + audit log; unset: make
# points it at the "admin" database on this checkout's dev Postgres).
ADMIN_PORT=3001
ADMIN_PUBLIC_URL=http://localhost:3001
# At least 32 characters and different from AUTH_SECRET: openssl rand -base64 32
ADMIN_AUTH_SECRET=dev-only-admin-secret-change-me-0123456789
# Rotating: ADMIN_AUTH_SECRET_PREVIOUS / ADMIN_AUTH_SECRET_REVOKED and
# ADMIN_AUTH_SECRET_GRACE work like the app's AUTH_SECRET_* (docs/secrets.md).
# Seeded (without a password) by `make admin-migrate`, which also sends its
# set-password link, again only once the last one has expired (in dev: open
# it from the log).
ADMIN_BOOTSTRAP_EMAIL=admin@example.com
# Admins must enrol in TOTP before their first session. Default: on in production.
# ADMIN_REQUIRE_2FA=true
# ADMIN_APP_NAME=Admin
# Admin changes are audited before they run; one whose outcome was never
# recorded is resolved from the current state once it is this old.
# ADMIN_AUDIT_RECONCILE_AFTER=2m
# ADMIN_TRUSTED_ORIGINS=http://dev-box:3001
# ADMIN_DATABASE_URL=postgres://postgres:postgres@127.0.0.1:5432/admin?sslmode=disable
# Backups (docs/backups.md). make db-backup encrypts with this key
# and stores in .backups/; set BACKUP_S3_* to use an S3-compatible bucket.
BACKUP_ENCRYPTION_KEY=dev-only-backup-key-change-me-0123456789abcdef
# BACKUP_S3_ENDPOINT=https://t3.storageapi.dev
# BACKUP_S3_BUCKET=
# BACKUP_S3_ACCESS_KEY_ID=
# BACKUP_S3_SECRET_ACCESS_KEY=
# BACKUP_S3_PATH_STYLE=false