mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
120 lines
6.7 KiB
Bash
120 lines
6.7 KiB
Bash
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# $APP_NAME — Environment Variables Template
|
|
# Copy to .env and fill in all CHANGE_ME values before deploying.
|
|
#
|
|
# Self-hosted setup (recommended):
|
|
# 1. cp .env.example .env
|
|
# 2. Fill in every CHANGE_ME value below
|
|
# 3. npm install
|
|
# 4. npm start (or: pm2 start server.js --name $APP_NAME)
|
|
# 5. Point Nginx to PORT (see nginx.conf.example)
|
|
#
|
|
# Generate random secrets with:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# ── App ───────────────────────────────────────────────────────────────────────
|
|
APP_NAME=starr
|
|
NODE_ENV=production
|
|
ORIGIN_GUARD_DISABLED=false # set to true in dev to allow Postman/curl (ignored in production)
|
|
PORT=3024
|
|
APP_URL=https://api.yourdomain.com
|
|
APP_LOGO_URL=https://your-cdn.com/logo.png
|
|
FRONTEND_URL=https://yourdomain.com
|
|
|
|
# ── Database (PostgreSQL / CockroachDB) ──────────────────────────────────────
|
|
# For self-hosted PostgreSQL: DB_HOST=127.0.0.1 DB_PORT=5432
|
|
# For CockroachDB serverless: DB_HOST=<cluster>.cockroachlabs.cloud DB_PORT=26257
|
|
DB_HOST=CHANGE_ME
|
|
DB_PORT=5432
|
|
DB_NAME=CHANGE_ME
|
|
DB_USER=CHANGE_ME
|
|
DB_PASSWORD=CHANGE_ME
|
|
# DB_SSL=false → disable SSL (use when PostgreSQL is on the same Docker network)
|
|
# DB_SSL=true → enable SSL with rejectUnauthorized=false (default — for managed DBs)
|
|
DB_SSL=true
|
|
|
|
# ── Cache driver ──────────────────────────────────────────────────────────────
|
|
# Controls the store used by rate limiters and the CSRF session.
|
|
#
|
|
# memory → no Redis required. Safe for local development (single process).
|
|
# Rate limit counters reset on restart; CSRF sessions are in-process.
|
|
# Set this in your local .env — no Redis installation needed.
|
|
#
|
|
# redis → Redis or Valkey required. Use in production (multi-process safe,
|
|
# survives restarts). Requires REDIS_URL below.
|
|
#
|
|
CACHE_DRIVER=redis
|
|
|
|
# ── Redis / Valkey URL ────────────────────────────────────────────────────────
|
|
# Only read when CACHE_DRIVER=redis.
|
|
# Valkey is a drop-in Redis replacement — fully supported.
|
|
# Arch Linux / Valkey default port: 6380
|
|
# Ubuntu / Debian / macOS Redis default port: 6379
|
|
# Check your port: systemctl status valkey | grep "valkey-server"
|
|
# Managed TLS example: rediss://:<password>@<host>:6380
|
|
REDIS_URL=redis://127.0.0.1:6379
|
|
|
|
# ── JWT ───────────────────────────────────────────────────────────────────────
|
|
# Generate each secret independently — never reuse across fields.
|
|
JWT_SECRET=CHANGE_ME_32_BYTE_HEX
|
|
MEDIA_JWT_SECRET=CHANGE_ME_32_BYTE_HEX
|
|
JWT_EXPIRES_IN=15m
|
|
JWT_REFRESH_SECRET=CHANGE_ME_32_BYTE_HEX
|
|
JWT_REFRESH_EXPIRES_IN=7d
|
|
|
|
# ── CSRF & Cookies ────────────────────────────────────────────────────────────
|
|
SESSION_SECRET=CHANGE_ME_32_BYTE_HEX
|
|
|
|
# ── Google OAuth ──────────────────────────────────────────────────────────────
|
|
# console.cloud.google.com → Credentials → OAuth 2.0 Client ID
|
|
# Add https://api.yourdomain.com/api/auth/google/callback to Authorized redirect URIs
|
|
GOOGLE_CLIENT_ID=CHANGE_ME
|
|
GOOGLE_CLIENT_SECRET=CHANGE_ME
|
|
GOOGLE_CALLBACK_URL=https://api.yourdomain.com/api/auth/google/callback
|
|
|
|
# ── PayPal ────────────────────────────────────────────────────────────────────
|
|
# Switch PAYPAL_ENV from "sandbox" to "live" when ready for real payments.
|
|
# Live credentials come from developer.paypal.com → My Apps & Credentials → Live tab.
|
|
PAYPAL_CLIENT_ID=CHANGE_ME
|
|
PAYPAL_CLIENT_SECRET=CHANGE_ME
|
|
PAYPAL_ENV=live
|
|
|
|
# ── Email (SMTP) ──────────────────────────────────────────────────────────────
|
|
# Gmail: enable 2FA → generate an App Password at myaccount.google.com/apppasswords
|
|
# For higher volume use a transactional provider (Mailgun, Resend, SendGrid, etc.)
|
|
SMTP_HOST=smtp.gmail.com
|
|
SMTP_PORT=587
|
|
SMTP_USER=CHANGE_ME@gmail.com
|
|
SMTP_PASS=CHANGE_ME_APP_PASSWORD
|
|
EMAIL_FROM=CHANGE_ME@gmail.com
|
|
|
|
OTP_EXPIRY_MINUTES=10
|
|
|
|
# ── S3-compatible Storage (Garage self-hosted) ────────────────────────────────
|
|
# S3_ENDPOINT: internal address of your Garage node (e.g. http://127.0.0.1:3900
|
|
# if Garage runs on the same server, or http://<garage-host>:3900)
|
|
# S3_PUBLIC_URL: the public-facing base URL served by your reverse proxy
|
|
# (e.g. https://cdn.yourdomain.com)
|
|
S3_ENDPOINT=http://127.0.0.1:3900
|
|
S3_REGION=garage
|
|
S3_ACCESS_KEY=CHANGE_ME
|
|
S3_SECRET_KEY=CHANGE_ME
|
|
S3_BUCKET=CHANGE_ME
|
|
S3_PUBLIC_URL=https://cdn.yourdomain.com
|
|
|
|
# ── Chibisafe (optional — used alongside S3 for some asset types) ─────────────
|
|
# Replace the zrok tunnel URL with a stable domain pointing to your Chibisafe instance.
|
|
CHIBISAFE_BASE_URL=https://files.yourdomain.com
|
|
CHIBISAFE_API_KEY=CHANGE_ME
|
|
CHIBISAFE_ALBUM_AVATARS=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_IMAGES=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_VIDEOS=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_THUMBNAILS=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_DOCUMENTS=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_ARCHIVED=CHANGE_ME_UUID
|
|
|
|
# ── CORS ──────────────────────────────────────────────────────────────────────
|
|
# Comma-separated list of allowed origins. Must match FRONTEND_URL exactly.
|
|
ALLOWED_ORIGINS=https://yourdomain.com
|