fleetcrown/.env.example at main · bitbaum/fleetcrown · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
# ── Required ────────────────────────────────────────────────────────────────
# PostgreSQL — see docs/infrastructure/postgres-portability.md
#
# Local dev (Docker): direct URL only
DATABASE_URL=postgresql://fleetcrown:changeme@localhost:5432/fleetcrown
#
# Production (self-hosted Hetzner): set BOTH on the host — not in .env.local
#   DATABASE_URL       — direct (:5432) for migrations + LISTEN/NOTIFY
#   DATABASE_POOL_URL  — pooled (:6432 / PgBouncer) for app queries

# ── Smoke / QA (optional, never commit real values) ─────────────────────────
# Authenticated probe suite: npm run test:authenticated-smoke
# FLEETCROWN_SESSION_TOKEN=          # raw Auth.js session cookie (COCKPIT_SESSION_TOKEN legacy)
# SMOKE_EMAIL=                    # credentials sign-in for smoke
# SMOKE_PASSWORD=
# SMOKE_PRIVATE_PIN=              # unlock private-zone probes; pre-push prod dogfood (auto-read from .env.local)
# DOGFOOD_LOKI_ON_PUSH=           # set 1 to force Loki UI dogfood even if builder presence probe is offline
# UI_FLOW_FULL_DISPATCH=          # set 0 to skip the G07 harmless full-dispatch smoke prompt
# DOGFOOD_MACHINE_FORCE=          # set 1 to fail machine dogfood when no local Fleet Runner

# Login email used by scripts/seed.ts for the default user; keep out of git.
SEED_OWNER_EMAIL=

# Random secret for signing sessions — generate with: openssl rand -base64 32
AUTH_SECRET=

# ── Authentication ───────────────────────────────────────────────────────────
# Local password (quick dev) — leave empty to use the /setup wizard on first run.
# IMPORTANT: setting this alone does NOT enable the "Owner key" sign-in tab —
# you must also set ENABLE_OWNER_KEY=1 below. The hosted production deployment
# keeps LOCAL_AUTH_PASSWORD set for legacy reasons, but the tab stays hidden
# there because ENABLE_OWNER_KEY is unset.
LOCAL_AUTH_PASSWORD=

# Set to 1 only on local installs (fleetcrown-app systemd, dev machines). When
# unset, the Owner-key sign-in tab is hidden AND the "local" credentials
# provider rejects every authorize() call — structural defense in depth so a
# stray LOCAL_AUTH_PASSWORD on a public deployment can't be brute-forced.
ENABLE_OWNER_KEY=

# GitHub OAuth (optional — get at github.com/settings/developers)
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# ── Optional ─────────────────────────────────────────────────────────────────
# Timezone for cron jobs and schedule display (e.g. America/New_York).
# Reads APP_DEFAULT_TIMEZONE first, then COCKPIT_DEFAULT_TIMEZONE (legacy).
APP_DEFAULT_TIMEZONE=Europe/Zurich

# Locale for date/time formatting. APP_LOCALE preferred, COCKPIT_LOCALE accepted.
APP_LOCALE=de-CH

# Docker only — Postgres password (must match DATABASE_URL above)
POSTGRES_PASSWORD=changeme

# ── Brand alias scheme ───────────────────────────────────────────────────────
# Every env var below is read as APP_<KEY> first, then COCKPIT_<KEY> as a
# legacy fallback (mirror of scripts/_brand.sh:_brand_env). Set whichever
# prefix matches your environment — both work, APP_* takes precedence.

# ── Daemon ⇄ Cloud bridge ────────────────────────────────────────────────────
# When the local daemon talks to a remote app instance, it authenticates with
# a bearer token. Two paths exist:
#
#   1. Mint a per-user ck_* token from /settings (preferred, multi-tenant safe).
#   2. Use APP_DAEMON_TOKEN as a shared bearer — single-tenant only.
#
# To enable path (2), set BOTH of these on the *server*. The flag is required
# because the token maps to the "default" user and must not be on by accident
# in multi-tenant deployments.
APP_DAEMON_TOKEN=
APP_ALLOW_LEGACY_DAEMON_TOKEN=

# Set to 1 in the local daemon's environment when a local Next.js dev server
# is running alongside a different cloud deployment. Without this, the daemon
# prefers localhost:3000 (the local server's DB) and the cloud control
# panel's runtime state goes stale.
APP_DAEMON_FORCE_REMOTE=

# Override the daemon's remote base URL (defaults to APP_DOMAIN from brand.ts).
APP_BASE_URL=

# ── Web Push (optional — ambient agent-ready notifications) ─────────────────
# Generate keys: npx web-push generate-vapid-keys
# Server-side (host env): VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY, VAPID_SUBJECT (mailto: or https: URL)
# Client-side (browser subscribe): NEXT_PUBLIC_VAPID_PUBLIC_KEY must match VAPID_PUBLIC_KEY
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
VAPID_SUBJECT=mailto:you@example.com
NEXT_PUBLIC_VAPID_PUBLIC_KEY=

# ── OrangeCat integration (Loop A: mirror subscriptions to the economic layer)
# Mint at https://orangecat.ch/settings/integrations, choose the FleetCrown
# group actor at mint time. Format: ock_<48-hex>. Treat like a password — the
# plaintext is shown once and stored as a sha256 hash on OrangeCat's side.
# When unset, the integration no-ops (subscriptions are still saved locally).
ORANGECAT_API_KEY=
ORANGECAT_API_BASE=https://orangecat.ch

# ── "Login with OrangeCat" (cross-product identity bridge, Part A)
# OIDC relying-party credentials for the orangecat.ch authorization server.
# The client is registered on OrangeCat's side via scripts/oauth/register-client.ts
# (OC repo) with redirect https://fleetcrown.orangecat.ch/api/auth/callback/orangecat.
# When unset, the "Continue with OrangeCat" button is not mounted.
ORANGECAT_OAUTH_CLIENT_ID=
ORANGECAT_OAUTH_CLIENT_SECRET=
# Override only for local testing against a non-prod OrangeCat:
# ORANGECAT_OAUTH_ISSUER=https://orangecat.ch

# Same 32+ character random value on OrangeCat and FleetCrown. Signs
# ten-minute, one-use entity → build handoffs.
FLEETCROWN_BUILD_INTENT_SECRET=
# Same value on both products. Authenticates confirmed-payment activity events.
ORANGECAT_WEBHOOK_SECRET=
NEXT_PUBLIC_ORANGECAT_URL=https://www.orangecat.ch
NEXT_PUBLIC_FLEETCROWN_URL=https://fleetcrown.orangecat.ch
NEXT_PUBLIC_ORANGECAT_PROJECT_ID=cb093f00-8745-4579-98df-050ebfb37181
NEXT_PUBLIC_FLEETCROWN_ORANGECAT_PROJECT_ID=8130c927-114a-45b7-8cc2-99efd5224025

# ── Solon (governance pillar, solon.orangecat.ch) ───────────────────────────
# HMAC secret shared with the Solon deployment; verifies decision.finalized
# webhooks at /api/solon/events. Without it that route answers 503.
SOLON_WEBHOOK_SECRET=
# Base URL for Solon API calls (scripts/solon/cast-vote.ts). Public link
# override for nav/footer is NEXT_PUBLIC_SOLON_URL.
SOLON_BASE_URL=https://solon.orangecat.ch
NEXT_PUBLIC_SOLON_URL=https://solon.orangecat.ch
# Loki's Bitcoin signing key for Solon votes. Set ONLY on the box Loki runs
# on — the key never leaves that environment; Solon only ever sees signatures.
LOKI_SOLON_PRIVKEY=

# ── Observability (optional — Sentry error tracking) ────────────────────────
# Leave empty to disable (SDK silently no-ops without a DSN).
# Enable: create a Next.js project at sentry.io and paste its DSN here.
NEXT_PUBLIC_SENTRY_DSN=
# Only needed for sourcemap upload at build time:
# SENTRY_ORG= / SENTRY_PROJECT= / SENTRY_AUTH_TOKEN=

# ── Public demo access (optional) ────────────────────────────────────────────
# Set to 1 ONLY on an instance that should host the shared "explore without an
# account" demo. It gates three things at once: the sign-in button appears, the
# sandbox policy in src/config/demo.ts is enforced, and the nightly reset
# (which DELETES the demo user and everything it owns) is allowed to run at all.
# An instance that never sets this cannot be reset even with a valid CRON_SECRET.
#
# After setting it, seed the tenant once:
#   DEMO_ACCESS_ENABLED=1 DATABASE_URL=... npx tsx scripts/seed-demo.ts
DEMO_ACCESS_ENABLED=

# Owner for scripts that act on behalf of a person (scripts/provision-widget.ts).
# NOT a secret — an identifier. Without it, provisioning refuses to guess when
# the database holds more than one user, because guessing wrong sends a client's
# site feedback to a stranger.
FLEETCROWN_OWNER_EMAIL=you@example.com