envsync/.env.prod.example at dev · EnvSync-Cloud/envsync · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
# =============================================================================
# EnvSync Production Environment Variables
# Copy to .env and fill in values before running docker-compose.prod.yaml
# =============================================================================

# --- App (API) ---
NODE_ENV=production
PORT=4000
DB_LOGGING=false
DB_AUTO_MIGRATE=false
DATABASE_SSL=false

# --- Database (PostgreSQL) ---
# These are internal to the Docker network; no need to expose ports
DATABASE_HOST=postgres
DATABASE_PORT=5432
DATABASE_USER=postgres
DATABASE_PASSWORD=CHANGE_ME_POSTGRES_PASSWORD
DATABASE_NAME=envsync
POSTGRES_USER=postgres
POSTGRES_PASSWORD=CHANGE_ME_POSTGRES_PASSWORD
POSTGRES_DB=envsync

# --- S3 / RustFS ---
S3_BUCKET=envsync-bucket
S3_REGION=us-east-1
S3_ACCESS_KEY=CHANGE_ME_RUSTFS_ACCESS_KEY
S3_SECRET_KEY=CHANGE_ME_RUSTFS_SECRET_KEY
S3_BUCKET_URL=http://rustfs:9000
S3_ENDPOINT=http://rustfs:9000
RUSTFS_ACCESS_KEY=CHANGE_ME_RUSTFS_ACCESS_KEY
RUSTFS_SECRET_KEY=CHANGE_ME_RUSTFS_SECRET_KEY

# --- Redis ---
CACHE_ENV=production
REDIS_URL=redis://redis:6379

# --- SMTP (use a real SMTP provider in production) ---
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_SECURE=true
SMTP_USER=CHANGE_ME
SMTP_PASS=CHANGE_ME
SMTP_FROM=noreply@yourdomain.com

# --- Keycloak (OIDC / IAM) ---
KEYCLOAK_URL=http://keycloak:8080
KEYCLOAK_REALM=envsync
KEYCLOAK_ADMIN_USER=admin
KEYCLOAK_ADMIN_PASSWORD=CHANGE_ME_KEYCLOAK_ADMIN_PASSWORD
KEYCLOAK_WEB_CLIENT_ID=envsync-web
KEYCLOAK_WEB_CLIENT_SECRET=
KEYCLOAK_CLI_CLIENT_ID=envsync-cli
KEYCLOAK_API_CLIENT_ID=envsync-api
KEYCLOAK_API_CLIENT_SECRET=
KEYCLOAK_WEB_REDIRECT_URI=https://api.yourdomain.com/api/access/web/callback
KEYCLOAK_WEB_CALLBACK_URL=https://app.yourdomain.com/auth/callback
KEYCLOAK_API_REDIRECT_URI=https://api.yourdomain.com/api/access/api/callback

# --- URLs (public-facing) ---
LANDING_PAGE_URL=https://yourdomain.com
DASHBOARD_URL=https://app.yourdomain.com

# --- OpenFGA (authorization engine) ---
OPENFGA_API_URL=http://openfga:8090
OPENFGA_STORE_ID=
OPENFGA_MODEL_ID=
OPENFGA_DB_PASSWORD=CHANGE_ME_OPENFGA_DB_PASSWORD

# --- miniKMS (encryption key management) ---
MINIKMS_ROOT_KEY=CHANGE_ME_32_BYTE_HEX_ROOT_KEY
MINIKMS_GRPC_ADDR=minikms:50051
MINIKMS_TLS_ENABLED=false
MINIKMS_DB_USER=postgres
MINIKMS_DB_PASSWORD=CHANGE_ME_MINIKMS_DB_PASSWORD

# --- ClickStack / OTEL ---
OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-agent:4318
OTEL_SERVICE_NAME=envsync-api
OTEL_SDK_DISABLED=false
CLICKSTACK_URL=https://obs.yourdomain.com