mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
150 lines
8.2 KiB
Plaintext
150 lines
8.2 KiB
Plaintext
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# $APP_NAME — Environment Variables Template (PRODUCTION / SELF-HOSTED)
|
|
# Copy to .env and fill in all CHANGE_ME values before deploying.
|
|
#
|
|
# Self-hosted setup (recommended):
|
|
# 1. cp .env-production .env
|
|
# 2. Fill in every CHANGE_ME value below
|
|
# 3. docker compose up -d (see docker-compose.yml)
|
|
# — or, without Docker: npm install && npm start
|
|
# (or: pm2 start server.js --name $APP_NAME, with Nginx in front)
|
|
#
|
|
# For local development, use .env-development instead (memory cache, no
|
|
# Docker/Redis/TLS required).
|
|
#
|
|
# Generate random secrets with:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# ── App ───────────────────────────────────────────────────────────────────────
|
|
APP_NAME=starr
|
|
NODE_ENV=production
|
|
ORIGIN_GUARD_DISABLED=false # set to true in dev to allow Postman/curl (ignored in production)
|
|
PORT=3024
|
|
APP_URL=https://api.yourdomain.com
|
|
APP_LOGO_URL=https://your-cdn.com/logo.png
|
|
FRONTEND_URL=https://yourdomain.com
|
|
|
|
# ── Database (PostgreSQL / CockroachDB) ──────────────────────────────────────
|
|
# For self-hosted PostgreSQL: DB_HOST=127.0.0.1 DB_PORT=5432
|
|
# For CockroachDB serverless: DB_HOST=<cluster>.cockroachlabs.cloud DB_PORT=26257
|
|
DB_HOST=CHANGE_ME
|
|
DB_PORT=5432
|
|
DB_NAME=CHANGE_ME
|
|
DB_USER=CHANGE_ME
|
|
DB_PASSWORD=CHANGE_ME
|
|
# DB_SSL=false → disable SSL (use when PostgreSQL is on the same Docker network)
|
|
# DB_SSL=true → enable SSL with rejectUnauthorized=false (default — for managed DBs)
|
|
DB_SSL=true
|
|
|
|
# ── Cache driver ──────────────────────────────────────────────────────────────
|
|
# Controls the store used by rate limiters and the CSRF session.
|
|
#
|
|
# memory → no Redis required. Safe for local development (single process).
|
|
# Rate limit counters reset on restart; CSRF sessions are in-process.
|
|
# Set this in your local .env — no Redis installation needed.
|
|
#
|
|
# redis → Redis or Valkey required. Use in production (multi-process safe,
|
|
# survives restarts). Requires REDIS_URL below.
|
|
#
|
|
CACHE_DRIVER=redis
|
|
|
|
# ── Redis / Valkey URL ────────────────────────────────────────────────────────
|
|
# Only read when CACHE_DRIVER=redis.
|
|
# Valkey is a drop-in Redis replacement — fully supported.
|
|
# Arch Linux / Valkey default port: 6380
|
|
# Ubuntu / Debian / macOS Redis default port: 6379
|
|
# Check your port: systemctl status valkey | grep "valkey-server"
|
|
# Managed TLS example: rediss://:<password>@<host>:6380
|
|
REDIS_URL=redis://127.0.0.1:6379
|
|
|
|
# ── JWT ───────────────────────────────────────────────────────────────────────
|
|
# Generate each secret independently — never reuse across fields.
|
|
JWT_SECRET=CHANGE_ME_32_BYTE_HEX
|
|
MEDIA_JWT_SECRET=CHANGE_ME_32_BYTE_HEX
|
|
JWT_EXPIRES_IN=15m
|
|
JWT_REFRESH_SECRET=CHANGE_ME_32_BYTE_HEX
|
|
JWT_REFRESH_EXPIRES_IN=7d
|
|
|
|
# ── CSRF & Cookies ────────────────────────────────────────────────────────────
|
|
SESSION_SECRET=CHANGE_ME_32_BYTE_HEX
|
|
|
|
# ── Google OAuth ──────────────────────────────────────────────────────────────
|
|
# console.cloud.google.com → Credentials → OAuth 2.0 Client ID
|
|
# Add https://api.yourdomain.com/api/auth/google/callback to Authorized redirect URIs
|
|
GOOGLE_CLIENT_ID=CHANGE_ME
|
|
GOOGLE_CLIENT_SECRET=CHANGE_ME
|
|
GOOGLE_CALLBACK_URL=https://api.yourdomain.com/api/auth/google/callback
|
|
|
|
# ── PayPal ────────────────────────────────────────────────────────────────────
|
|
# Switch PAYPAL_ENV from "sandbox" to "live" when ready for real payments.
|
|
# Live credentials come from developer.paypal.com → My Apps & Credentials → Live tab.
|
|
PAYPAL_CLIENT_ID=CHANGE_ME
|
|
PAYPAL_CLIENT_SECRET=CHANGE_ME
|
|
PAYPAL_ENV=live
|
|
|
|
# ── Email (Gmail API — OAuth2, over HTTPS) ────────────────────────────────────
|
|
# Raw SMTP (port 25/465/587) is blocked outbound on Render and several other
|
|
# PaaS hosts, so sending goes through the Gmail REST API over HTTPS instead.
|
|
# Reuses the same OAuth client as GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET above —
|
|
# just enable the Gmail API on that project, then run:
|
|
# node scripts/get_gmail_refresh_token.js
|
|
# and paste the printed value below.
|
|
GMAIL_REFRESH_TOKEN=CHANGE_ME
|
|
EMAIL_FROM=CHANGE_ME@gmail.com
|
|
|
|
OTP_EXPIRY_MINUTES=10
|
|
|
|
# ── S3-compatible Storage (Garage self-hosted) ────────────────────────────────
|
|
# Garage is bundled in docker-compose.yml — no separate install needed.
|
|
#
|
|
# Docker setup: S3_ENDPOINT=http://garage:3900 (use the service name)
|
|
# Bare-metal: S3_ENDPOINT=http://127.0.0.1:3900
|
|
#
|
|
# S3_PUBLIC_URL: public-facing URL served by your reverse proxy
|
|
# (e.g. Caddy/Nginx → https://cdn.yourdomain.com → garage:3900)
|
|
#
|
|
# GARAGE_RPC_SECRET: shared secret for Garage RPC.
|
|
# Generate with: openssl rand -hex 32
|
|
S3_ENDPOINT=http://garage:3900
|
|
S3_REGION=garage
|
|
S3_ACCESS_KEY=CHANGE_ME
|
|
S3_SECRET_KEY=CHANGE_ME
|
|
S3_BUCKET=CHANGE_ME
|
|
S3_PUBLIC_URL=https://cdn.yourdomain.com
|
|
GARAGE_RPC_SECRET=CHANGE_ME_32_BYTE_HEX
|
|
|
|
# ── Chibisafe (optional — used alongside S3 for some asset types) ─────────────
|
|
# Set CHIBISAFE_BASE_URL to the public domain pointing to your Chibisafe instance.
|
|
CHIBISAFE_BASE_URL=https://files.yourdomain.com
|
|
CHIBISAFE_API_KEY=CHANGE_ME
|
|
CHIBISAFE_ALBUM_AVATARS=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_IMAGES=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_VIDEOS=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_THUMBNAILS=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_DOCUMENTS=CHANGE_ME_UUID
|
|
CHIBISAFE_ALBUM_ARCHIVED=CHANGE_ME_UUID
|
|
|
|
# ── MarkItDown (document-import PDF/PPTX -> Markdown sidecar) ────────────────
|
|
# Lives in the separate chibistar/ stack, not this one — not reachable by
|
|
# Docker service name.
|
|
#
|
|
# Self-hosted via this repo's docker-compose.yml, on the SAME machine as
|
|
# chibistar: reach it via host.docker.internal (see docker-compose.yml's
|
|
# extra_hosts on `backend`), which resolves to the host running chibistar's
|
|
# markitdown container (published to 127.0.0.1:8000 there).
|
|
MARKITDOWN_BASE_URL=http://host.docker.internal:8000
|
|
#
|
|
# Deployed elsewhere (e.g. Render) — no shared network with chibistar, so
|
|
# use the public hostname instead (zrok reserved share, see
|
|
# chibistar/docker-compose.yml's zrok-markitdown service):
|
|
# MARKITDOWN_BASE_URL=https://markitdownstarr.share.zrok.io
|
|
#
|
|
# Required in both cases — /convert checks this on every request since it's
|
|
# reachable publicly, not just over loopback/the Docker network.
|
|
MARKITDOWN_SHARED_SECRET=CHANGE_ME
|
|
|
|
# ── CORS ──────────────────────────────────────────────────────────────────────
|
|
# Comma-separated list of allowed origins. Must match FRONTEND_URL exactly.
|
|
ALLOWED_ORIGINS=https://yourdomain.com
|