.env.example

# PostgreSQL connection string for a local or hosted PostgreSQL 17 database.
DATABASE_URL=postgresql://<username>:<password>@<host>:5432/<database>

# Auth.js session signing and GitHub OAuth application credentials.
AUTH_SECRET=<generate-with-npx-auth-secret>
AUTH_GITHUB_ID=<github-oauth-client-id>
AUTH_GITHUB_SECRET=<github-oauth-client-secret>

# 32 random bytes encoded as unpadded base64url for AES-256-GCM OAuth token encryption.
TOKEN_ENCRYPTION_KEY=<base64url-32-byte-key>

# Public application and HTTPS GitHub webhook callback configuration.
# The ORIGIN of APP_URL — its scheme, host and port, with any path ignored — is
# the only origin Overflow accepts browser mutations from: a cookie-authenticated
# POST or PATCH whose Origin header is absent or does not match that origin is
# refused, and a missing or malformed APP_URL refuses every one of them.
APP_URL=https://<public-host>
GITHUB_WEBHOOK_URL=https://<public-host>/api/github/webhooks
GITHUB_WEBHOOK_SECRET=<github-webhook-secret>

# Comma-separated GitHub account ids granted the moderator role at sign-in.
# Ids, not logins — logins can be renamed and reused. Find one with: gh api users/<login> --jq .id
MODERATOR_GITHUB_USER_IDS=<github-user-id-1>,<github-user-id-2>

# Admission threshold for new reconciliation passes per sponsor, not a guaranteed
# remaining balance: an admitted pass can spend past it. 0 disables the hold;
# missing, blank or malformed values fall back to 500. A very large nonnegative
# integer deliberately makes admission very restrictive.
# The process-local per-account observations appear at /moderation and clear on restart.
# For production, edit /etc/overflow/overflow.env and restart overflow.service;
# locally, update .env and restart pnpm dev. See README.md for quota ownership and deferral behavior.
GITHUB_GRAPHQL_BUDGET_RESERVE=500