script-manifest/.env.example at main · full-chaos/script-manifest · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
# ============================================================
# Script Manifest — Environment Variables
# ============================================================
# Copy this file to .env and fill in real values.
# Vars marked REQUIRED must be set. Vars marked OPTIONAL
# have sensible local-dev defaults shown below.
#
# Usage:
#   cp .env.example .env
#   # Edit .env with your real secrets, then:
#   docker compose up
# ============================================================


# ── Database ─────────────────────────────────────────────────────────────────

# PostgreSQL connection details for all DB-backed services.
# In docker-compose the DATABASE_URL is assembled per-service from these vars.
POSTGRES_DB=manifest                      # OPTIONAL — database name
POSTGRES_USER=manifest                    # OPTIONAL — database user
POSTGRES_PASSWORD=manifest                # REQUIRED in production (change this!)

# Convenience full DSN used directly by services in development.
# In compose.yml each service builds this from the vars above.
DATABASE_URL=postgresql://manifest:manifest@localhost:5432/manifest  # OPTIONAL


# ── Port Overrides (local dev only) ──────────────────────────────────────────
# These allow remapping host ports when defaults conflict with other services.

POSTGRES_PORT=5432         # OPTIONAL
REDIS_PORT=6379            # OPTIONAL
MINIO_PORT=9000            # OPTIONAL
MINIO_CONSOLE_PORT=9001    # OPTIONAL
API_PORT=4000              # OPTIONAL — gateway host port (prod compose)
WEB_PORT=3000              # OPTIONAL — writer-web host port (prod compose)


# ── Service URLs — Internal (Docker / Server-Side) ───────────────────────────
# Used by the API gateway and services calling each other.
# Local dev values shown; in Docker Compose these are set directly per service.

IDENTITY_SERVICE_URL=http://localhost:4005              # OPTIONAL
PROFILE_SERVICE_URL=http://localhost:4001               # OPTIONAL
COMPETITION_DIRECTORY_SERVICE_URL=http://localhost:4002 # OPTIONAL
SUBMISSION_TRACKING_SERVICE_URL=http://localhost:4004   # OPTIONAL
FEEDBACK_EXCHANGE_SERVICE_URL=http://localhost:4006     # OPTIONAL
RANKING_SERVICE_URL=http://localhost:4007               # OPTIONAL
COVERAGE_MARKETPLACE_SERVICE_URL=http://localhost:4008  # OPTIONAL
INDUSTRY_PORTAL_SERVICE_URL=http://localhost:4009       # OPTIONAL
PROGRAMS_SERVICE_URL=http://localhost:4012              # OPTIONAL
PARTNER_DASHBOARD_SERVICE_URL=http://localhost:4013     # OPTIONAL
NOTIFICATION_SERVICE_URL=http://localhost:4010          # OPTIONAL
SCRIPT_STORAGE_SERVICE_URL=http://localhost:4011        # OPTIONAL
API_GATEWAY_URL=http://localhost:4000                   # OPTIONAL — used by writer-web


# ── Auth (identity-service) ───────────────────────────────────────────────────

# AES-256-GCM key for encrypting TOTP secrets at rest.
# Must be exactly 64 hex characters (32 bytes).
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
MFA_ENCRYPTION_KEY=      # REQUIRED — 64 hex chars; rotate via re-encryption migration

# Google OAuth (leave blank to keep the local mock sign-in flow)
# When set, the identity service uses the real Google OAuth flow.
# GOOGLE_REDIRECT_URI controls where Google sends the browser after auth.
GOOGLE_CLIENT_ID=        # OPTIONAL — Google OAuth client ID
GOOGLE_CLIENT_SECRET=    # OPTIONAL — Google OAuth client secret
GOOGLE_REDIRECT_URI=     # OPTIONAL — public browser redirect URL, e.g. https://scripts.example.com/signin

# Session configuration
SESSION_DURATION_DAYS=30  # OPTIONAL — how long tokens stay valid

# Public-facing base URL for identity service (used in OAuth redirects)
IDENTITY_SERVICE_PUBLIC_URL=http://localhost:4005  # OPTIONAL
FRONTEND_URL=http://localhost:3000                 # OPTIONAL — CORS / redirect target


# ── Admin Allowlists ──────────────────────────────────────────────────────────
# Comma-separated list of user IDs that have admin access to the named domain.

COVERAGE_ADMIN_ALLOWLIST=admin_01,user_admin_01   # OPTIONAL
INDUSTRY_ADMIN_ALLOWLIST=admin_01,user_admin_01   # OPTIONAL


# ── Stripe (coverage-marketplace-service) ────────────────────────────────────

STRIPE_SECRET_KEY=         # REQUIRED for payment flows (sk_test_... / sk_live_...)
STRIPE_WEBHOOK_SECRET=     # REQUIRED for webhook signature validation (whsec_...)
PLATFORM_COMMISSION_RATE=0.15  # OPTIONAL — platform cut, expressed as a decimal (0–1)


# ── MinIO / S3-Compatible Object Storage ─────────────────────────────────────
# script-storage-service and coverage-marketplace-service both use MinIO.

MINIO_ROOT_USER=manifest       # OPTIONAL — MinIO admin username
MINIO_ROOT_PASSWORD=manifest123  # REQUIRED in production (change this!)
MINIO_API_CORS_ALLOW_ORIGIN=http://localhost:3000  # OPTIONAL

# S3 client configuration (used by services; maps to MinIO in dev)
STORAGE_S3_ENDPOINT=http://localhost:9000  # OPTIONAL — internal S3 endpoint
STORAGE_S3_REGION=us-east-1               # OPTIONAL
STORAGE_S3_ACCESS_KEY=manifest            # OPTIONAL — maps to MINIO_ROOT_USER
STORAGE_S3_SECRET_KEY=manifest123         # REQUIRED in production
STORAGE_S3_FORCE_PATH_STYLE=true          # OPTIONAL — set true for MinIO

# Script storage bucket settings
STORAGE_BUCKET=scripts                                     # OPTIONAL
STORAGE_UPLOAD_BASE_URL=http://localhost:9000              # OPTIONAL — browser-reachable presign base
STORAGE_PUBLIC_BASE_URL=http://localhost:9000              # OPTIONAL — public CDN / download base

# writer-web uses this to rewrite MinIO URLs inside the Next.js server
SCRIPT_UPLOAD_INTERNAL_BASE_URL=http://localhost:9000      # OPTIONAL

# Coverage marketplace delivery bucket (separate from script bucket)
COVERAGE_DELIVERY_BUCKET=coverage-reports  # OPTIONAL
COVERAGE_DELIVERY_PREFIX=deliveries/       # OPTIONAL
COVERAGE_DELIVERY_UPLOAD_URL=http://localhost:9000  # OPTIONAL
MINIO_ENDPOINT=http://localhost:9000        # OPTIONAL — alias used in some service configs


# ── Redis ─────────────────────────────────────────────────────────────────────
# Currently used as optional caching / rate-limit backing store.

REDIS_PASSWORD=manifest  # OPTIONAL — leave blank to run Redis without auth in dev
REDIS_URL=redis://localhost:6379  # OPTIONAL — api-gateway distributed rate-limit store


# ── API Gateway ──────────────────────────────────────────────────────
CORS_ALLOWED_ORIGINS=                                     # OPTIONAL — comma-separated allowed origins for CORS


# ── Observability ────────────────────────────────────────────────────
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317  # OPTIONAL — OTel collector gRPC endpoint (used by all services for traces + metrics)


# ── Logging & Rate Limiting ───────────────────────────────────────────────────

LOG_LEVEL=info        # OPTIONAL — trace | debug | info | warn | error
RATE_LIMIT_MAX=100    # OPTIONAL — max requests per window
RATE_LIMIT_WINDOW=60000  # OPTIONAL — window in milliseconds


# ── Feature Flags & Scheduler ─────────────────────────────────────────────────

# programs-service background scheduler
PROGRAMS_SCHEDULER_ENABLED=true       # OPTIONAL — set false to disable scheduler
PROGRAMS_SCHEDULER_INTERVAL_MS=60000  # OPTIONAL — how often the scheduler ticks (ms)


# ── Coverage Marketplace Operational Vars ────────────────────────────────────

COVERAGE_AUTO_COMPLETE_DAYS=14        # OPTIONAL — days before auto-completing a coverage order
COVERAGE_SLA_MAINTENANCE_MS=3600000   # OPTIONAL — SLA maintenance job interval (ms)
COVERAGE_SYSTEM_USER_ID=system        # OPTIONAL — user ID used for system-generated actions


# ── Docker Image Tag (production compose only) ────────────────────────────────

IMAGE_TAG=latest  # OPTIONAL — GHCR image tag, e.g. sha-abc1234 or v1.2.3


# ── Frontend (writer-web) ─────────────────────────────────────────────────────

# Demo / test writer user (only used in development / seeded environments)
WRITER_DEMO_USER_ID=writer_01  # OPTIONAL — remove or leave blank in production


# ── Bug Reporting (Linear) ────────────────────────────────────────────────────
# Used by the writer-web bug report widget to create issues in Linear.

LINEAR_API_KEY=             # REQUIRED for bug reporting — Linear personal API key
LINEAR_TEAM_ID=             # REQUIRED for bug reporting — Linear team UUID (not the key like "CHAOS")


# ── BugSink / Sentry Error Tracking ──────────────────────────────────────────
# Get the DSN from the BugSink UI after running setup and creating a project.
# Format: http://<key>@bugsink:8000/<project_id>
# Leave empty to disable error reporting (services check `if (!dsn) return;`).

SENTRY_DSN=                 # OPTIONAL — BugSink/Sentry DSN; empty = disabled