truss/.env.selfhosted.example at main · binarysquadd/truss · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# ─── Truss Self-Hosted Configuration ───
# Copy this file to .env.selfhosted and customize before starting.
# Usage: docker compose -f docker-compose.selfhosted.yml --env-file .env.selfhosted up -d
#
# IMPORTANT: Generate unique secrets before first run!
# Quick setup:
#   cp .env.selfhosted.example .env.selfhosted
#   sed -i "s/GENERATE_DB_PASSWORD/$(openssl rand -hex 16)/" .env.selfhosted
#   sed -i "s/GENERATE_MINIO_KEY/$(openssl rand -hex 12)/" .env.selfhosted
#   sed -i "s/GENERATE_MINIO_SECRET/$(openssl rand -hex 24)/" .env.selfhosted
#   sed -i "s/GENERATE_ENCRYPTION_KEY/$(openssl rand -hex 32)/" .env.selfhosted
#   sed -i "s/GENERATE_COOKIE_SECRET/$(openssl rand -hex 16)/" .env.selfhosted
#   sed -i "s/GENERATE_CIPHER_SECRET/$(openssl rand -hex 16)/" .env.selfhosted
#   sed -i "s/GENERATE_HYDRA_SECRET/$(openssl rand -hex 16)/" .env.selfhosted
#   sed -i "s/GENERATE_VALKEY_PASSWORD/$(openssl rand -hex 16)/" .env.selfhosted

# ─── Database ───
DB_PASSWORD=GENERATE_DB_PASSWORD

# ─── Storage (MinIO) ───
MINIO_ACCESS_KEY=GENERATE_MINIO_KEY
MINIO_SECRET_KEY=GENERATE_MINIO_SECRET

# ─── Cache / KV (Valkey) ───
# Password for the Redis-compatible cache. Generate with: openssl rand -hex 16
VALKEY_PASSWORD=GENERATE_VALKEY_PASSWORD

# ─── Security ───
# Generate with: openssl rand -hex 32
ENCRYPTION_KEY=GENERATE_ENCRYPTION_KEY

# Kratos cookie + cipher secrets (32 chars each).
# Generate with: openssl rand -hex 16
KRATOS_COOKIE_SECRET=GENERATE_COOKIE_SECRET
KRATOS_CIPHER_SECRET=GENERATE_CIPHER_SECRET

# Hydra system secret (OAuth2/OIDC token signing + encryption, 16+ chars).
# Generate with: openssl rand -hex 16
HYDRA_SECRETS_SYSTEM=GENERATE_HYDRA_SECRET

# ─── Admin access ───
# Comma-separated Kratos identity IDs granted admin powers (DB roles, migrations,
# backups, authorization rules). Leave empty for first boot, then: register your
# account, copy your ID from the dashboard's Authentication panel, paste it here,
# and restart the API. Empty = nobody has the admin-gated surfaces.
TRUSS_ADMIN_IDENTITY_IDS=

# ─── First-boot default admin ───
# On first start (no account exists yet) Truss seeds a default admin so you can
# log in immediately — like Grafana / ArgoCD. Set a password below for known
# creds, or leave it blank and a random one is printed to the API logs. Change it
# after first login. Set TRUSS_BOOTSTRAP_ADMIN=false to disable seeding.
TRUSS_BOOTSTRAP_ADMIN_EMAIL=admin@truss.local
# TRUSS_BOOTSTRAP_ADMIN_PASSWORD=change-me-after-first-login

# ─── Public URL ───
# The URL where users access the dashboard in their browser.
TRUSS_PUBLIC_URL=http://localhost:3000

# ─── Optional: OAuth2 issuer ───
# Public https URL Hydra advertises as the OAuth2/OIDC issuer. Defaults to
# http://localhost:4444 for local use; set to your public Hydra URL in production.
# HYDRA_ISSUER_URL=https://oauth.yourdomain.com

# ─── Optional: SMTP for email verification/recovery ───
# Without SMTP, Kratos cannot send verification or recovery emails.
# SMTP_HOST=smtp.resend.com
# SMTP_PORT=587
# SMTP_USER=resend
# SMTP_PASS=re_your_api_key
# SMTP_FROM=noreply@yourdomain.com