166 lines
8.3 KiB
Bash
166 lines
8.3 KiB
Bash
# =============================================================================
|
|
# .env.example - config for docker-compose.yml (app + local Supabase stack)
|
|
# =============================================================================
|
|
# ./scripts/generate-env.sh # copies this file to .env and fills
|
|
# # every secret below with fresh values
|
|
# docker compose up -d --build
|
|
#
|
|
# For `pnpm dev` against the local stack, copy these into .env.local:
|
|
# NEXT_PUBLIC_SUPABASE_URL = NEXT_PUBLIC_SUPABASE_URL below
|
|
# NEXT_PUBLIC_SUPABASE_ANON_KEY = ANON_KEY below
|
|
# SUPABASE_SERVICE_ROLE_KEY = SERVICE_ROLE_KEY below
|
|
#
|
|
# Secrets left empty here are filled by scripts/generate-env.sh. ANON_KEY and
|
|
# SERVICE_ROLE_KEY are JWTs signed with JWT_SECRET; if you change JWT_SECRET
|
|
# you must regenerate both. This file is committed: never put real secrets in
|
|
# it. Keep the generated .env out of git and lock it down: chmod 600 .env
|
|
# =============================================================================
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Postgres
|
|
# -----------------------------------------------------------------------------
|
|
# Superuser password for Postgres. Also used by auth/rest/realtime/meta to
|
|
# connect. Filled by scripts/generate-env.sh (hex, so it is safe inside postgres:// URLs).
|
|
POSTGRES_PASSWORD=
|
|
# Database name. Keep "postgres" unless you have a reason not to.
|
|
POSTGRES_DB=postgres
|
|
# Host port the Postgres admin port is published on (bound to 127.0.0.1 only,
|
|
# for psql / pg_dump from the host). Container always listens on 5432.
|
|
POSTGRES_HOST_PORT=5432
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# JWT / API keys (the god-mode secrets)
|
|
# -----------------------------------------------------------------------------
|
|
# Symmetric secret GoTrue/PostgREST/Realtime use to sign and verify JWTs.
|
|
# 32+ random bytes. Generate: openssl rand -hex 32
|
|
JWT_SECRET=
|
|
# Access-token lifetime in seconds (1 hour). Also used as the JWT expiry hint.
|
|
JWT_EXPIRY=3600
|
|
|
|
# Public "anon" API key. A JWT with role=anon signed by JWT_SECRET above.
|
|
# This is the NEXT_PUBLIC_SUPABASE_ANON_KEY the app/browser use. Generate with
|
|
# JWT_SECRET exported, on your local machine:
|
|
# export JWT_SECRET='the-value-above'
|
|
# npx -y -p jsonwebtoken@9 node -e "const jwt=require('jsonwebtoken');const iat=Math.floor(Date.now()/1000);console.log(jwt.sign({role:'anon',iss:'supabase',iat,exp:iat+60*60*24*365*10},process.env.JWT_SECRET))"
|
|
ANON_KEY=
|
|
|
|
# Service-role API key. A JWT with role=service_role signed by JWT_SECRET.
|
|
# Bypasses RLS (god mode) - this is the app's SUPABASE_SERVICE_ROLE_KEY. Same
|
|
# command as above with role:'service_role'. Treat like root credentials.
|
|
# npx -y -p jsonwebtoken@9 node -e "const jwt=require('jsonwebtoken');const iat=Math.floor(Date.now()/1000);console.log(jwt.sign({role:'service_role',iss:'supabase',iat,exp:iat+60*60*24*365*10},process.env.JWT_SECRET))"
|
|
SERVICE_ROLE_KEY=
|
|
|
|
# Realtime needs its own long random base for signing/cookies. Independent of
|
|
# JWT_SECRET. Generate: openssl rand -hex 32
|
|
SECRET_KEY_BASE=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Public URLs
|
|
# -----------------------------------------------------------------------------
|
|
# Where GoTrue sends users back after auth flows, and the app's own public URL.
|
|
# For a local bundle these are localhost; for a server put your real domains
|
|
# here (and terminate TLS in a reverse proxy in front of Kong / the app).
|
|
SITE_URL=http://localhost:3000
|
|
# Comma-separated extra redirect URLs GoTrue will accept.
|
|
ADDITIONAL_REDIRECT_URLS=http://localhost:3000
|
|
# The externally reachable base URL of the Supabase API gateway (Kong). GoTrue
|
|
# embeds this in email links. Local bundle: http://localhost:8000
|
|
API_EXTERNAL_URL=http://localhost:8000
|
|
# Same gateway URL, shown by Studio. Usually identical to API_EXTERNAL_URL.
|
|
SUPABASE_PUBLIC_URL=http://localhost:8000
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Kong (API gateway) host ports (bound to 127.0.0.1 by the compose file)
|
|
# -----------------------------------------------------------------------------
|
|
KONG_HTTP_PORT=8000
|
|
KONG_HTTPS_PORT=8443
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Studio (admin dashboard) (bound to 127.0.0.1 by the compose file)
|
|
# -----------------------------------------------------------------------------
|
|
# Host port Studio is published on. Keep it off 3000 (the app owns that).
|
|
STUDIO_PORT=3001
|
|
STUDIO_DEFAULT_ORGANIZATION=hackerspace
|
|
STUDIO_DEFAULT_PROJECT=hackerspace
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# PostgREST
|
|
# -----------------------------------------------------------------------------
|
|
# Schemas PostgREST exposes over /rest/v1. The app only needs public; the rest
|
|
# match the Supabase defaults.
|
|
PGRST_DB_SCHEMAS=public,storage,graphql_public
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Auth behavior
|
|
# -----------------------------------------------------------------------------
|
|
# Allow email/password signup (the app's join flow needs this).
|
|
ENABLE_EMAIL_SIGNUP=true
|
|
# Auto-confirm new emails WITHOUT sending a verification mail. Handy for local
|
|
# dev when you have no SMTP configured; set false in production.
|
|
ENABLE_EMAIL_AUTOCONFIRM=true
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# SMTP for auth emails (invites, confirmations, password resets).
|
|
# Optional for local dev if ENABLE_EMAIL_AUTOCONFIRM=true. Required in prod.
|
|
# Use any provider (Resend, SendGrid, SES, Postmark, Mailgun).
|
|
# -----------------------------------------------------------------------------
|
|
SMTP_ADMIN_EMAIL=admin@example.com
|
|
SMTP_HOST=smtp.resend.com
|
|
SMTP_PORT=587
|
|
SMTP_USER=resend
|
|
SMTP_PASS=
|
|
SMTP_SENDER_NAME=hackerspace.sh
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# The app (Next.js) - these feed both build args and runtime env.
|
|
# -----------------------------------------------------------------------------
|
|
# Browser-reachable Supabase (Kong) URL. Baked into the client bundle at build
|
|
# time, so it must be what the BROWSER can reach: http://localhost:8000 locally,
|
|
# or https://supabase.yourdomain.com behind a proxy. Keep it equal to
|
|
# API_EXTERNAL_URL. (The app's anon key = ANON_KEY above; service key =
|
|
# SERVICE_ROLE_KEY above - the compose wires those through automatically.)
|
|
NEXT_PUBLIC_SUPABASE_URL=http://localhost:8000
|
|
# Public base URL of the app itself (OAuth redirects, emailed links). No
|
|
# trailing slash.
|
|
NEXT_PUBLIC_APP_URL=http://localhost:3000
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Single-tenant mode (optional; see docs/SINGLE_TENANT.md).
|
|
# Leave blank for the default multi-tenant platform. Set NEXT_PUBLIC_SINGLE_TENANT=true
|
|
# to dedicate this instance to exactly one space.
|
|
# -----------------------------------------------------------------------------
|
|
NEXT_PUBLIC_SINGLE_TENANT=
|
|
NEXT_PUBLIC_SITE_NAME=
|
|
NEXT_PUBLIC_SINGLE_TENANT_SPACE_SLUG=
|
|
NEXT_PUBLIC_SINGLE_TENANT_OPEN_JOIN=
|
|
NEXT_PUBLIC_SHOW_MARKETING=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# App secrets and optional integrations
|
|
# -----------------------------------------------------------------------------
|
|
# Secrets vault encryption key (/ops Secrets feature): 64 hex chars. Filled by
|
|
# scripts/generate-env.sh. Rotating it invalidates existing ciphertexts.
|
|
SECRETS_ENCRYPTION_KEY=
|
|
# Bearer secret guarding /api/cron/notifications. Filled by the script.
|
|
CRON_SECRET=
|
|
|
|
# Transactional email (optional). Unset = outbox rows are recorded as failed.
|
|
RESEND_API_KEY=
|
|
EMAIL_FROM=
|
|
# Sentry-compatible DSN (optional). Unset = error capture no-ops.
|
|
SENTRY_DSN=
|
|
# Login-page OAuth buttons: "true" only for providers configured in GoTrue.
|
|
NEXT_PUBLIC_OAUTH_GITHUB=
|
|
NEXT_PUBLIC_OAUTH_GOOGLE=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# First-admin bootstrap (read only by `pnpm setup`, never at runtime).
|
|
# -----------------------------------------------------------------------------
|
|
SETUP_SPACE_NAME=
|
|
SETUP_SPACE_SLUG=
|
|
SETUP_SPACE_CITY=
|
|
SETUP_ADMIN_EMAIL=
|
|
SETUP_ADMIN_PASSWORD=
|
|
SETUP_ADMIN_NAME=
|