-
Notifications
You must be signed in to change notification settings - Fork 71
Expand file tree
/
Copy pathcompass.example.yaml
More file actions
113 lines (98 loc) · 5.25 KB
/
Copy pathcompass.example.yaml
File metadata and controls
113 lines (98 loc) · 5.25 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# Compass Config
# Notes
# - Copy this file to compass.yaml and replace values for your local setup.
# - Do not commit this file; it contains secrets.
# - For detailed explanations, see: https://docs.compasscalendar.com/docs/config
runtime:
version: latest
nodeEnv: development
logLevel: debug
timezone: Etc/UTC
web:
port: 9080
url: http://localhost:9080
# Public booking guest app (Docker compose profile `booking`). Optional until you
# run apps/booking-web beside calendar-web.
# bookingWeb:
# port: 9081
# image: switchbacktech/compass-booking-web:latest
backend:
port: 3000
apiUrl: http://localhost:3000/api
originsAllowed:
- http://localhost:3000
- http://localhost:9080
compassToken: REPLACE_WITH_COMPASS_TOKEN # any string will do
mongo:
username: compass
password: local-mongo-password
replicaSetKey: local-mongo-replica-set-key
uri: mongodb+srv://admin:REPLACE_WITH_MONGO_PASSWORD@cluster0.m99yy.mongodb.net/dev_calendar?authSource=admin&retryWrites=true&w=majority&tls=true
supertokens:
uri: REPLACE_WITH_SUPERTOKENS_URI
key: REPLACE_WITH_SUPERTOKENS_KEY
# google:
# clientId: REPLACE_WITH_GOOGLE_CLIENT_ID # e.g. your-id.apps.googleusercontent.com
# clientSecret: REPLACE_WITH_GOOGLE_CLIENT_SECRET
# microsoft:
# clientId: REPLACE_WITH_MICROSOFT_CLIENT_ID
# clientSecret: REPLACE_WITH_MICROSOFT_CLIENT_SECRET
# Entra /common app registration. Both values are required together.
# apple:
# signIn:
# servicesId: REPLACE_WITH_APPLE_SERVICES_ID
# teamId: REPLACE_WITH_APPLE_TEAM_ID
# keyId: REPLACE_WITH_APPLE_KEY_ID
# privateKey: REPLACE_WITH_APPLE_PRIVATE_KEY
# Sign in with Apple only. iCloud calendar connect uses an app-specific
# password and sync.credentialEncryptionKey; it needs no Apple app credentials.
# posthog:
# key: REPLACE_WITH_POSTHOG_KEY
# host: REPLACE_WITH_POSTHOG_HOST
# stripe:
# secretKey: REPLACE_WITH_STRIPE_SECRET_KEY # sk_test_... is fine for staging
# webhookSecret: REPLACE_WITH_STRIPE_WEBHOOK_SECRET
# priceId: REPLACE_WITH_STRIPE_PRICE_ID
# publishableKey: REPLACE_WITH_STRIPE_PUBLISHABLE_KEY # pk_test_... is fine for staging
# Omit the whole block for self-host. All four values are required together.
# email:
# provider: resend # resend | log
# apiKey: REPLACE_WITH_RESEND_API_KEY
# from: Compass <hello@mail.compasscalendar.com>
# webhookSecret: REPLACE_WITH_RESEND_WEBHOOK_SECRET
# unsubscribeSecret: REPLACE_WITH_EMAIL_UNSUBSCRIBE_SECRET # openssl rand -base64 32
# scheduleProfile: real # real | fast — fast is rejected when runtime.nodeEnv is production
# allowlist: []
# Omit the whole block to keep email off (no enrollment, poller, or send routes).
# provider resend requires apiKey, from, webhookSecret, and unsubscribeSecret together.
# billing:
# enforcement: false # operator pause switch — keep the app free for everyone
# bypassEmails: [] # accounts exempt from the gate, even with enforcement on
# Independent of `stripe:` above: you can keep Stripe keys configured while
# enforcement stays false, so Checkout/webhook work can continue without
# gating any user. Defaults to false when omitted.
#
# `bypassEmails` is a narrower escape hatch for test accounts that cannot
# complete a real Stripe Checkout. Listed accounts skip payment entirely and
# are reported as subscribed, so keep this to staging and leave it empty in
# production. Matched case-insensitively; empty when omitted.
# Compass Sync service — required. The backend exits at startup without
# serviceUrl/internalAuthToken, and self-host runs Sync by default. mongoUri
# MUST point at an isolated database/user that cannot read the backend's
# database. execution defaults to `passive` (health + read-only verification,
# no provider calls or job claims).
sync:
port: 3010
mongoUri: mongodb+srv://compass_sync:REPLACE_WITH_SYNC_MONGO_PASSWORD@cluster/compass_sync?retryWrites=true&w=majority
internalAuthToken: REPLACE_WITH_SYNC_INTERNAL_AUTH_TOKEN # any string; must match the value the API uses
callbackBaseUrl: http://localhost:3010 # public base URL for provider OAuth/webhook callbacks
postConnectRedirectUrl: http://localhost:9080 # where the browser lands after connect/reconnect — set to web.url. Unset falls back to callbackBaseUrl (this service's own host), stranding the user there.
serviceUrl: http://localhost:3010 # base URL the API uses to reach this service; compose uses http://sync:3010
# cloudMutationMode: enabled # enabled (default) | maintenance — maintenance rejects cloud edits / connect with typed MAINTENANCE
# execution: passive # passive | active — active required for OAuth begin + provider import/jobs
# Public OAuth/webhook paths (via Caddy → sync): /sync/google, /sync/notifications/google
# maxConcurrency: 4
# reservedPullLanes: 1 # of maxConcurrency, how many drains never claim initialImport/repair — keeps pulls from starving behind a wave of long imports. Must stay < maxConcurrency.
# enforceLeastPrivilege: false # true only where a scoped compass_sync database user exists (managed cloud)
# compassApiDatabase: prod_calendar # API database the least-privilege check must be denied access to
# credentialEncryptionKey: REPLACE_WITH_SYNC_CREDENTIAL_ENCRYPTION_KEY # 32-byte base64; required when any provider is configured (openssl rand -base64 32)