harbur/.env.example at master · imxade/harbur · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# Google OAuth and Drive setup
#
# 1. Create or select a Google Cloud project:
#    https://console.cloud.google.com/
# 2. Enable the Google Drive API for that project:
#    APIs & Services -> Library -> Google Drive API -> Enable.
# 3. Configure the OAuth consent screen:
#    APIs & Services -> OAuth consent screen.
#    Add your app name, support email, developer contact email, and the Drive
#    scopes used by this app:
#    - https://www.googleapis.com/auth/drive.file
#    - https://www.googleapis.com/auth/drive.appdata
# 4. Create a Web application OAuth client:
#    APIs & Services -> Credentials -> Create credentials -> OAuth client ID.
# 5. Add authorized JavaScript origins:
#    - http://localhost:3000
#    - your Vercel preview/production origin
#    - any custom production domain
# 6. Add the same app origins as authorized redirect URIs without trailing
#    slashes. Google Identity Services popup code flow uses the app origin as
#    the redirect value during the server-side code exchange:
#    - http://localhost:3000
#    - your Vercel preview/production origin
#    - any custom production domain
# 7. Copy the OAuth client ID into GOOGLE_DRIVE_CLIENT_ID below.
#    This value is safe to expose because the app serves it to the browser for
#    Google sign-in.
GOOGLE_DRIVE_CLIENT_ID=your-google-oauth-client-id.apps.googleusercontent.com

# Server-side secrets
#
# 8. Copy the OAuth client secret into GOOGLE_DRIVE_CLIENT_SECRET below.
#    Do not expose this value to browser code.
GOOGLE_DRIVE_CLIENT_SECRET=your-google-oauth-client-secret

# 9. Get the owner Drive refresh token.
#    Recommended local flow:
#    - Fill GOOGLE_DRIVE_CLIENT_ID, GOOGLE_DRIVE_CLIENT_SECRET,
#      and APP_ADMIN_EMAILS in your local .env file.
#    - Start the app and sign in with a Google account listed in
#      APP_ADMIN_EMAILS.
#    - Open /settings.
#    - Click "Connect owner Drive" and approve the Google Drive consent prompt.
#    - In local development, the server writes GOOGLE_DRIVE_REFRESH_TOKEN to
#      .env.local. Copy that value here if you want one complete env file.
#
#    Production note:
#    - The settings flow can connect the owner Drive for the current running
#      server instance, but production deployments still need this refresh token
#      saved as a server-side environment variable so it survives redeploys and
#      cold starts.
GOOGLE_DRIVE_REFRESH_TOKEN=your-owner-drive-refresh-token

# 10. Required for ZIP downloads and browser-side PR/merge ZIP operations.
#     Exact Google Cloud Console steps:
#     - Open https://console.cloud.google.com/ and select the same project used
#       for GOOGLE_DRIVE_CLIENT_ID and GOOGLE_DRIVE_CLIENT_SECRET.
#     - Go to APIs & Services -> Library, search "Google Drive API", and make
#       sure it is enabled.
#     - Go to APIs & Services -> Credentials.
#     - Click Create credentials -> API key.
#     - Copy the generated key, then click Edit API key.
#     - Name it "Harbur browser Drive media key" or similar.
#     - Under Application restrictions, select Websites.
#     - Add every app origin as an allowed HTTP referrer, including wildcards:
#       http://localhost:3000/*
#       https://your-production-domain.example/*
#       https://your-vercel-project.vercel.app/*
#       https://*.your-preview-domain.example/*
#     - Under API restrictions, select Restrict key.
#     - Select only Google Drive API.
#     - Save, then paste the key below.
#     This is used only to fetch temporary public ZIP copies with CORS; it is
#     not a Drive credential and cannot access private files without the
#     temporary link permission.
GOOGLE_DRIVE_BROWSER_API_KEY=your-referrer-restricted-drive-api-key

# 11. List the exact admin emails allowed to create repositories and connect
#     the owner Drive. Use comma-separated addresses. Domain wildcards and
#     partial matches are intentionally not supported.
APP_ADMIN_EMAILS=admin@example.com,ops@example.com

# Optional read-only deployment integration. Generate with `openssl rand -base64 48`.
# Treat this as a server secret; changing it immediately revokes existing consumers.
INTEGRATION_READ_TOKEN=

# Optional: set to 1 to log all server-side timing spans. Slow spans are logged
# automatically even when this is unset.
# HARBUR_TIMING=1