.env.example

# Repro environment configuration.
#
# For self-hosting with the bundled compose.yaml, the compose file reads this
# file as-is. Copy to .env, fill in the four REQUIRED values at the top, and
# `docker compose up -d`.
#
# For local development (cloning the repo), additionally set DATABASE_URL to
# point at the dev Postgres on port 5436.

# ═════════════════════════════════════════════════════════════════════
# REQUIRED — set these before first boot
# ═════════════════════════════════════════════════════════════════════

# Postgres password. Generate one with: openssl rand -hex 32
POSTGRES_PASSWORD=

# Base URL the dashboard is served at. Must be the same origin visitors use —
# session cookies depend on it. Use http://localhost:3000 for a local spin-up;
# switch to https://feedback.example.com when you put a reverse proxy in front.
BETTER_AUTH_URL=http://localhost:3000

# Session-cookie signing secret. Generate with: openssl rand -hex 32
BETTER_AUTH_SECRET=

# Secret for signing time-limited attachment download URLs. Generate with:
# openssl rand -hex 32
ATTACHMENT_URL_SECRET=


# ═════════════════════════════════════════════════════════════════════
# COMPOSE — optional overrides for the bundled docker-compose
# ═════════════════════════════════════════════════════════════════════

# Pin to a specific Repro release (defaults to `latest`). Recommended for
# production so you know exactly when you're upgrading.
# REPRO_VERSION=0.1.0

# Host port the dashboard binds to. Change if 3000 is in use.
# PORT=3000

# Postgres user / database name. Leave as defaults unless you have a reason.
# POSTGRES_USER=repro
# POSTGRES_DB=repro


# ═════════════════════════════════════════════════════════════════════
# LOCAL DEVELOPMENT ONLY — ignored when using compose.yaml
# ═════════════════════════════════════════════════════════════════════
# The compose file sets DATABASE_URL internally so it points at the postgres
# service. If you're NOT using compose (cloning the repo, `bun run dev`), set
# this to the dev Postgres from apps/dashboard/docker/docker-compose.dev.yml:
# DATABASE_URL=postgres://postgres:postgres@localhost:5436/repro


# ═════════════════════════════════════════════════════════════════════
# STORAGE — attachments (screenshots, logs, session replay)
# ═════════════════════════════════════════════════════════════════════
# `local` writes to a Docker volume (compose mounts it at /data/attachments).
# `s3`    writes to any S3-compatible endpoint.
# Switching after writes have landed is not supported — pick once.

STORAGE_DRIVER=local
STORAGE_LOCAL_ROOT=/data/attachments

# --- STORAGE_DRIVER=s3 only ---
# S3_BUCKET=repro-attachments
# S3_REGION=us-east-1
# S3_ACCESS_KEY_ID=
# S3_SECRET_ACCESS_KEY=
#
# Endpoint patterns per provider:
#   AWS S3:           leave S3_ENDPOINT empty; set S3_VIRTUAL_HOSTED=true
#   Cloudflare R2:    S3_ENDPOINT=https://<account>.r2.cloudflarestorage.com , S3_REGION=auto
#   Backblaze B2:     S3_ENDPOINT=https://s3.<region>.backblazeb2.com         , S3_REGION=<region>
#   Hetzner:          S3_ENDPOINT=https://<region>.your-objectstorage.com    , S3_REGION=<region>
#   MinIO / Garage:   S3_ENDPOINT=http://<host>:<port>                        , S3_REGION=anything
# S3_ENDPOINT=
# S3_VIRTUAL_HOSTED=false


# ═════════════════════════════════════════════════════════════════════
# EMAIL — magic-link sign-in + invite delivery
# ═════════════════════════════════════════════════════════════════════
# `console` prints the link to container logs — useful for first-boot smoke
# tests (you can copy/paste the URL) but NOT for real users.
# `smtp`    real email via SMTP.
# `ethereal` nodemailer's test SMTP with preview URLs.

MAIL_PROVIDER=console
# SMTP_HOST=smtp.example.com
# SMTP_PORT=587
# SMTP_USER=
# SMTP_PASS=
SMTP_FROM="Repro <no-reply@localhost>"


# ═════════════════════════════════════════════════════════════════════
# OPTIONAL — OAuth sign-in providers (buttons hidden when blank)
# ═════════════════════════════════════════════════════════════════════
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=


# ═════════════════════════════════════════════════════════════════════
# OPTIONAL — GitHub Issues sync (GitHub App)
# ═════════════════════════════════════════════════════════════════════
# Two setup paths:
#   (a) In-app manifest wizard — sign in as admin, visit Settings → GitHub,
#       click "Create GitHub App". Credentials are stored encrypted in the
#       `github_app` table. Requires ENCRYPTION_KEY below.
#   (b) Legacy env vars — set the four variables below. The resolver prefers
#       env when all three secrets are present; otherwise falls back to DB.
GITHUB_APP_ID=
GITHUB_APP_PRIVATE_KEY=
GITHUB_APP_WEBHOOK_SECRET=
GITHUB_APP_SLUG=repro
GITHUB_APP_CLIENT_ID=
GITHUB_APP_CLIENT_SECRET=

# Base64-encoded 32-byte key used by encrypted-at-rest columns (currently
# the github_app singleton). Generate with: openssl rand -base64 32
# Required if you use the in-app GitHub App manifest wizard. Rotating this
# value invalidates existing encrypted rows — back up and re-encrypt first.
ENCRYPTION_KEY=


# ═════════════════════════════════════════════════════════════════════
# TUNING — safe defaults; override only if you know why
# ═════════════════════════════════════════════════════════════════════

# Postgres pool + timeouts
DB_POOL_MAX=10
DB_STATEMENT_TIMEOUT_MS=30000
DB_IDLE_TX_TIMEOUT_MS=10000

# SDK intake rate limits
INTAKE_RATE_PER_KEY=60
INTAKE_RATE_PER_IP=20
INTAKE_RATE_PER_KEY_ANON=10
INTAKE_MAX_BYTES=5242880
INTAKE_REQUIRE_DWELL=true
INTAKE_MIN_DWELL_MS=1500

# User-supplied attachment caps (per file, total per report, count per report)
INTAKE_USER_FILE_MAX_BYTES=10485760
INTAKE_USER_FILES_TOTAL_MAX_BYTES=26214400
INTAKE_USER_FILES_MAX_COUNT=5

# Virus scan via the bundled clamav sidecar. Off by default — flip to true
# AFTER `docker compose up -d` and the clamav service has finished pulling
# its signature DB (~500MB, watch with `docker compose logs -f clamav`
# until you see "Database correctly reloaded"). When enabled, infected or
# unscannable uploads fail with HTTP 422/503 and nothing is persisted.
# CLAMAV_HOST and CLAMAV_PORT are hardcoded in compose.yaml — no need to
# set them here.
INTAKE_USER_FILE_SCAN_ENABLED=false

# Session replay — flip to false to disable the feature platform-wide
REPLAY_FEATURE_ENABLED=true
INTAKE_REPLAY_MAX_BYTES=1048576

# Auth endpoint rate limits (sign-in, magic-link verify)
AUTH_RATE_PER_IP_PER_15MIN=5
# AUTH_RATE_LIMIT_ENABLED=            # override the production default
# RATE_LIMIT_STORE=postgres            # shared-across-workers; default is in-process

# Set TRUST_XFF=true ONLY when behind a trusted reverse proxy — otherwise
# clients can spoof X-Forwarded-For to bypass per-IP rate limits.
TRUST_XFF=false

# Webhook body cap before HMAC verification (GitHub integration)
GITHUB_WEBHOOK_MAX_BYTES=1048576


# ═════════════════════════════════════════════════════════════════════
# LOCAL DEV / TEST ERGONOMICS — unset in production
# ═════════════════════════════════════════════════════════════════════

# nuxt-security ships a per-IP rate-limiter. It's useful in production but
# triggers false 429s when the integration test suite makes many requests
# from one machine. Set to 1 for local dev + test runs; leave unset in prod.
# DISABLE_NUXT_SECURITY_RATE_LIMIT=1

# Placeholder GitHub App credentials that match the integration test suite's
# signing values. Uncomment all five together for local `bun test` runs; leave
# commented (or replace with real values) in production.
# GITHUB_APP_ID=12345
# GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\ntest\n-----END RSA PRIVATE KEY-----"
# GITHUB_APP_WEBHOOK_SECRET=test-webhook-secret
# GITHUB_APP_CLIENT_ID=rp-test-client-id
# GITHUB_APP_CLIENT_SECRET=rp-test-client-secret