Repository navigation
Expand file tree
/
Copy path.env.prod.example
More file actions
66 lines (47 loc) · 4.15 KB
/
Copy path.env.prod.example
File metadata and controls
66 lines (47 loc) · 4.15 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
# Generated by `bun scripts/generate-config-docs.ts` from the environment registries. Do not edit by hand.
# Companion file to compose.prod.yml. Copy to .env and fill in.
# compose.prod.yml wires infrastructure connections itself; only the values
# below are read from this file. Empty values are treated as unset.
# Set *_FILE alternatives in the container environment; compose.prod.yml
# does not forward them from this input file.
# Compose inputs
# Public hostname routed by Traefik to the gateway; also forms APP_URL.
CLOUD_HOST=cloud.example.com
# Immutable image tag from a successful full Docker release-set job.
CLOUD_IMAGE_TAG=sha-0123456789ab
# Postgres database name for the same connection.
POSTGRES_DB=cloud
# Postgres password for the same connection.
POSTGRES_PASSWORD=change-me
# Postgres user for every app's DATABASE_URL and the postgres service you define alongside the compose file.
POSTGRES_USER=cloud
# Secrets
# Core only: temporary first-administrator or recovery login token; remove it after normal administrator sign-in works.
ADMIN_LOGIN_TOKEN=
# Process-level file alternative (unset ADMIN_LOGIN_TOKEN): ADMIN_LOGIN_TOKEN_FILE=/run/secrets/ADMIN_LOGIN_TOKEN
# Deployment-wide secret for at-rest settings encryption and signed cursors; generate once with `openssl rand -hex 32` and never change it after data has been written.
APP_SECRET=
# Process-level file alternative (unset APP_SECRET): APP_SECRET_FILE=/run/secrets/APP_SECRET
# Core only: 64-hex KEK for platform identity signing keys stored in Postgres; generate once with `openssl rand -hex 32` and never distribute it to other apps.
CLOUD_IDENTITY_KEY_ENCRYPTION_KEY=
# Process-level file alternative (unset CLOUD_IDENTITY_KEY_ENCRYPTION_KEY): CLOUD_IDENTITY_KEY_ENCRYPTION_KEY_FILE=/run/secrets/CLOUD_IDENTITY_KEY_ENCRYPTION_KEY
# Core only: pre-distributed next KEK before promoting it to current; cannot be combined with `CLOUD_IDENTITY_PREVIOUS_KEY`.
CLOUD_IDENTITY_NEXT_KEY=
# Process-level file alternative (unset CLOUD_IDENTITY_NEXT_KEY): CLOUD_IDENTITY_NEXT_KEY_FILE=/run/secrets/CLOUD_IDENTITY_NEXT_KEY
# Core only: old KEK set during an explicit rolling rewrap of stored identity signing keys, then removed.
CLOUD_IDENTITY_PREVIOUS_KEY=
# Process-level file alternative (unset CLOUD_IDENTITY_PREVIOUS_KEY): CLOUD_IDENTITY_PREVIOUS_KEY_FILE=/run/secrets/CLOUD_IDENTITY_PREVIOUS_KEY
# Deprecated: Core and OAuth legacy 64-hex broker secret, used only when OAuth has no app key. Configure an OAuth app key instead; retained for this release.
CLOUD_OAUTH_BROKER_SECRET=
# Process-level file alternative (unset CLOUD_OAUTH_BROKER_SECRET): CLOUD_OAUTH_BROKER_SECRET_FILE=/run/secrets/CLOUD_OAUTH_BROKER_SECRET
# Optional runtime values (compose.prod.yml supplies defaults)
# Deprecated: bootstraps `gateway.trusted_proxies` once when no stored value exists; remove after `cld admin settings status --env` succeeds. Comma-separated IP addresses or CIDR ranges of the reverse proxies allowed to name the client in `X-Forwarded-For`; the default trusts loopback and private networks, which covers Traefik on a Docker network. Set the proxy's exact address or subnet when clients on private networks reach the gateway directly or through a proxy that appends to their `X-Forwarded-For`. Invalid bootstrap input with no stored row and invalid stored proxy lists stop gateway startup.
# GATEWAY_TRUSTED_PROXIES=
# Path to a mounted NATS `.creds` file (JWT and NKey); unset means server-side no-auth.
# NATS_CREDS_FILE=
# Path to a mounted CA certificate that enables TLS to NATS; unset means plain TCP.
# NATS_TLS_CA_FILE=
# Deprecated: bootstraps `outgoing_mail.allowed_targets` once when no stored value exists; remove after `cld admin settings status --env` succeeds. Comma-separated host names, IP addresses and CIDR ranges on internal networks allowed for outgoing mail SMTP and bounce IMAP connections; unset allows only public targets, an explicit value replaces this default, and invalid entries including `/0` are ignored with a bootstrap warning.
# OUTGOING_MAIL_ALLOWED_TARGETS=
# Sync namespace shared by every app of one installation; separates NATS resource names, not access. Use one NATS account per installation.
# SYNC_NAMESPACE=