.env.example

# SPDX-FileCopyrightText: 2021 - 2022 Netherlands eScience Center
# SPDX-FileCopyrightText: 2021 - 2022 dv4all
# SPDX-FileCopyrightText: 2022 Helmholtz Centre for Environmental Research (UFZ)
#
# SPDX-License-Identifier: CC-BY-4.0
#
# example env file
# copy to .env and /frontend/.env.local

################ WARNING ################
# Using special characters in the values (e.g. in passwords or secrets) might corrupt some processes.
# If you experience any problems, remove the special characters from the values or place them in quotes (' or ").
################ WARNING ################

# .env.local is consumed by frontend (Next)
# see https://nextjs.org/docs/basic-features/environment-variables

# .env is consumed by docker-compose.yml
# currently assigned values are for .env
# .env.local values, if they differ, are placed as a comment above the env variable

# You also need to obtain/generate missing secrets

# ---- DOCKER PROJECT SETTINGS ----------

# Define this variable, if you are running different versions of the RSD, in
# order to define the docker project name. If you leave this empty, docker will
# automatically name the containers.
COMPOSE_PROJECT_NAME="rsd"

# ---- PUBLIC ENV VARIABLES -------------

# postgresql
# consumed by services: backend, background-services
POSTGRES_DB_HOST=database
# consumed by services: backend, background-services
POSTGRES_DB_HOST_PORT=5432
# consumed by services: database, backend, background-services
POSTGRES_DB=rsd-db
# consumed by services: database, background-services
POSTGRES_USER=rsd

# backend (postgREST)
# consumed by services: backend
PGRST_DB_ANON_ROLE=rsd_web_anon
PGRST_DB_SCHEMA=public
PGRST_SERVER_PORT=3500
PGRST_ADMIN_SERVER_PORT=3501

# postgREST API
# consumed by services: authentication,frontend,auth-tests, scrapers, codemeta
# .env.local: http://localhost/api/v1, .env: http://backend:3500
POSTGREST_URL=http://backend:3500

# postgREST API reachable outside of Docker
# consumed by services: swagger
POSTGREST_URL_EXTERNAL=http://localhost/api/v1

# RSD Auth module
# consumed by services: frontend (api/fe)
# .env.local: http://localhost/auth, .env: http://auth:7000/auth
RSD_AUTH_URL=http://auth:7000/auth

# consumed by services: auth
RSD_API_ACCESS_TOKEN_ENABLED=true

# consumed by services: auth
HOST_URL=http://localhost

# RSD Reverse Proxy URL
# consumed by services: frontend
# .env.local: http://localhost, .env: http://nginx
RSD_REVERSE_PROXY_URL=http://nginx

# consumed by services: authentication
# If set to "dev", the first user to log in will become admin.
# Furthermore, when using SURFconext, you will be forced to sign in with your username and password,
# even if you're already signed in.
# Any other value doesn't activate this feature (and doesn't do anything).
RSD_ENVIRONMENT=prod

# consumed by services: authentication
# provide a list of supported OpenID auth providers
# the entries should be separated by semicolon (;)
# Each value should consist of a key and a value (values are CASE SENSITIVE), separated by a colon (:)
# Allowed keys are: SURFCONEXT, HELMHOLTZ, ORCID, AZURE, LINKEDIN, GITHUB or LOCAL
# Allowed values are DISABLED, INVITE_ONLY, or EVERYONE
# If a value is something else, it is considered to be misconfigured and will be disabled
# If one of the allowed keys is missing, DISABLED is used
# if you add the entry "LOCAL:EVERYONE" or "LOCAL:INVITE_ONLY", then local accounts are enabled, USE THIS FOR TESTING/DEVELOPMENT PURPOSES ONLY
RSD_AUTH_PROVIDERS=SURFCONEXT:EVERYONE;ORCID:INVITE_ONLY;LOCAL:DISABLED

# SURFCONEXT - TEST ENVIRONMENT
# consumed by: authentication
SURFCONEXT_CLIENT_ID=www.research-software.nl
# consumed by: authentication
SURFCONEXT_WELL_KNOWN_URL=https://connect.test.surfconext.nl/.well-known/openid-configuration

# Helmholtz ID
# consumed by: authentication
HELMHOLTZID_CLIENT_ID=rsd-dev
# consumed by: authentication
HELMHOLTZID_WELL_KNOWN_URL=https://login-dev.helmholtz.de/oauth2/.well-known/openid-configuration
# consumed by: authentication
HELMHOLTZID_SCOPES=openid+profile+email+eduperson_principal_name
# consumed by: authentication
# uncomment if you want to allow users from non-Helmholtz centres or social IdPs without mandatory invitation
#HELMHOLTZID_ALLOW_EXTERNAL_USERS=true

# ORCID
# consumed by: authentication
ORCID_CLIENT_ID=APP-4D4D69ASWTYOI9QI
# consumed by: authentication
ORCID_WELL_KNOWN_URL=https://sandbox.orcid.org/.well-known/openid-configuration

# AZURE ACTIVE DIRECTORY
# consumed by: authentication
AZURE_CLIENT_ID=
# consumed by: authentication
AZURE_WELL_KNOWN_URL=
# consumed by: frontend
# the name displayed to users when multiple providers are configured
AZURE_DISPLAY_NAME="Imperial College Login"
# consumed by: frontend
# the description text displayed to users when multiple providers are configured
AZURE_DESCRIPTION_HTML="Sign in with your institutional credentials"
# consumed by: authentication
# the organisation recorded for users logged in via this provider
AZURE_ORGANISATION=

# LINKEDIN
# consumed by: authentication
LINKEDIN_CLIENT_ID=
# consumed by: authentication
LINKEDIN_WELL_KNOWN_URL=https://www.linkedin.com/oauth/.well-known/openid-configuration

# GITHUB
# consumed by: authentication
GITHUB_CLIENT_ID=
# consumed by: authentication
GITHUB_WELL_KNOWN_URL=https://github.com/login/oauth/.well-known/openid-configuration


# E-MAIL SERVICE
# consumed by: mail and publisher
# SMTP Server domain name, e.g. smtp.example.com
MAIL_SMTP_SERVER=
# Port number, usually 587
MAIL_SMTP_PORT=
# SSL or STARTTLS
MAIL_SMTP_SECURITY=
# The login used to send the emails, incl. domain, e.g. "user@example.com"
MAIL_SMTP_LOGIN=
# the email address that should send the emails from the mail service, e.g. "rsd@domain.org"
MAIL_FROM_ADDRESS=
# (optional) Set an email address that should be replied to
MAIL_REPLY_TO=
# (optional) Name of the rabbitmq channel used for the mail service
MAIL_QUEUE=mailq

# ---- PUBLIC SCRAPER ENV VARIABLES -------------

# max requests to the GitHub API per run, runs 10 times per hour
# optional, comment out if not available, a default of 6 will be used
# consumed by: scrapers
MAX_REQUESTS_GITHUB=6

# max request to GitLab API per run, runs 10 times per hour
# optional, comment out if not available, a default of 6 will be used
# consumed by: scrapers
MAX_REQUESTS_GITLAB=6

# max request to 4TU Git API per run, runs 10 times per hour
# optional, comment out if not available, a default of 6 will be used
# consumed by: scrapers
MAX_REQUESTS_4TU=6

# max request to Codeberg Git API per run, runs 10 times per hour
# optional, comment out if not available, a default of 6 will be used
# consumed by: scrapers
MAX_REQUESTS_CODEBERG=6

# max mentions to scrape per run, runs 10 times per hour
# optional, comment out if not available, a default of 6 will be used
# consumed by: scrapers
MAX_REQUESTS_DOI=6

# max reference papers of which to scrape citations per run, runs 10 times per hour
# optional, comment out if not available, a default of 6 will be used
# consumed by: scrapers
MAX_REQUESTS_OPENALEX=6

# max organisations to scrape per run, runs 10 times per hour
# optional, comment out if not available, a default of 6 will be used
# consumed by: scrapers
MAX_REQUESTS_ROR=6

# determines if the 4TU scraper is enabled
# optional, the scraper will only run then the value is equal to true (case sensitive)
# should only be enabled by the NLeSC RSD instance
# consumed by: codemeta
ENABLE_4TU_SCRAPER=false

# determines if the NASSA scraper is enabled
# optional, the scraper will only run then the value is equal to true (case sensitive)
# should only be enabled by the NLeSC RSD instance
# consumed by: scrapers
ENABLE_NASSA_SCRAPER=false

# determines if the ESCAPE OSSR scraper is enabled
# optional, the scraper will only run then the value is equal to true (case sensitive)
# should only be enabled by the NLeSC RSD instance
# consumed by: scrapers
ENABLE_ESCAPE_OSSR_SCRAPER=false

# ---- SECRETS ------ SECRETS -----------

# consumed by services: database, background-services
# generate random/strong password
POSTGRES_PASSWORD=

# consumed by services: database, backend
# generate random/strong password
POSTGRES_AUTHENTICATOR_PASSWORD=

# POSTGREST JWT SECRET
# consumed by services: authentication, frontend (auth-node), auth-tests, scrapers, codemeta
# generate random/strong password with at least 32 characters
PGRST_JWT_SECRET=

# MAIL SERVICE
# consumed by: mail service
# Password for MAIL_SMTP_LOGIN
MAIL_SMTP_PASSWORD=

# PUBLISHER JWT SECRET
# consumed by: publisher
# generate a strong password
PUBLISHER_JWT_SECRET_KEY=

# SURFCONEXT
# consumed by services: authentication
# obtain the secret from SURFCONEXT dashboard
AUTH_SURFCONEXT_CLIENT_SECRET=

# Helmholtz ID
# consumed by services: authentication
# obtain the secret from the project team
AUTH_HELMHOLTZID_CLIENT_SECRET=

# ORCID
# consumed by services: authentication
# obtain the secret from the project team
AUTH_ORCID_CLIENT_SECRET=

# Azure Active Directory
# consumed by services: authentication
AUTH_AZURE_CLIENT_SECRET=

# LinkedIn
# consumed by services: authentication
AUTH_LINKEDIN_CLIENT_SECRET=

# GitHub
# consumed by services: authentication
AUTH_GITHUB_CLIENT_SECRET=

# consumed by: scrapers
# optional, comment out if not available, should be of the form username:token
# obtain the secret from GITHUB dashboard
API_CREDENTIALS_GITHUB=

# consumed by: scrapers
# obtain the secret from ZENODO dashboard
ZENODO_ACCESS_TOKEN=

# consumed by: scrapers, frontend api (node)
# email address that Crossref can contact you with to comply with their "polite" policy
# leave blank or use a real email address that you will respond to
CROSSREF_CONTACT_EMAIL=

# consumed by: scrapers
# (optional) your OpenAlex API key
# See https://developers.openalex.org/guides/authentication for more information
OPENALEX_API_KEY=

# consumed by: frontend
# URL (should end with a trailing slash) and ID for Matomo Tracking Code
MATOMO_URL=
MATOMO_ID=

# consumed by: scrapers
LIBRARIES_IO_ACCESS_TOKEN=