-
Notifications
You must be signed in to change notification settings - Fork 12
Expand file tree
/
Copy path.env.example
More file actions
205 lines (189 loc) · 10.2 KB
/
Copy path.env.example
File metadata and controls
205 lines (189 loc) · 10.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
# =============================================================================
# Local development (copy to .env and edit)
# =============================================================================
# --- Database ---
# Owner role (DDL, migrations only). Used by scripts/deploy/migrate.sh.
MIGRATION_DATABASE_URL=postgresql://flashcards_owner:flashcards_owner@postgres:5432/flashcards
# Runtime role passwords applied by scripts/deploy/migrate.sh after migrations create the roles.
BACKEND_DB_PASSWORD=backend_app
AUTH_DB_PASSWORD=auth_app
REPORTING_DB_PASSWORD=reporting_readonly
# App role (DML only). Used by the backend Lambda / local Node server.
# Local Node uses localhost because it runs outside Docker.
DATABASE_URL=postgresql://app:app@localhost:5432/flashcards
REPORTING_DATABASE_URL=postgresql://reporting_readonly:reporting_readonly@localhost:5432/flashcards
# Password for the app role (used by migrate container to CREATE ROLE app).
APP_DB_PASSWORD=app
# --- Auth ---
# Auth mode is required: "cognito" for real auth, or "none" only for explicit
# insecure local development. There is no implicit default.
AUTH_MODE=cognito
# Required when AUTH_MODE=none. This opt-in exists only for localhost-style
# development and must never be relied on implicitly.
# ALLOW_INSECURE_LOCAL_AUTH=true
# Allowed browser origins for the local backend server.
BACKEND_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3001
# Public web-app origin used by catalog install links and public catalog CORS.
# Required outside explicit AUTH_MODE=none local development. Use an exact
# HTTP(S) origin without credentials, path, query, fragment, or wildcard.
PUBLIC_APP_BASE_URL=http://localhost:3000
# Auth service settings (used by apps/auth Docker container)
ALLOWED_REDIRECT_URIS=http://localhost:3000,http://localhost:3001
COOKIE_DOMAIN=localhost
# =============================================================================
# Overridable defaults (have sensible defaults, set only if you need to change)
# =============================================================================
# Cognito configuration (required when AUTH_MODE=cognito)
# COGNITO_USER_POOL_ID=eu-central-1_abc123
# COGNITO_CLIENT_ID=abc123def456
# COGNITO_REGION=eu-central-1
# OTP session encryption key (required when AUTH_MODE=cognito).
# 32 random bytes as hex (64 chars). Generate with: openssl rand -hex 32
# SESSION_ENCRYPTION_KEY=
#
# Intentionally insecure review account bypass for pre-created Cognito accounts.
# Anyone who knows one of these emails and the shared password can sign in
# without OTP, so use this only for review accounts.
# Every allowlisted DEMO_EMAIL_DOSTIP value must use @example.com. Non-example.com values
# are invalid and will fail auth startup.
# For deployed auth, keep this allowlist in root .env and sync it to GitHub
# Actions as CDK_DEMO_EMAIL_DOSTIP via scripts/setup/setup-github.sh.
# DEMO_EMAIL_DOSTIP=apple-for-review@example.com,google-for-review@example.com
# Keep DEMO_PASSWORD_DOSTIP only in local untracked config.
# Deployed auth should read the review account password from AWS Secrets Manager after
# scripts/setup/setup-auth-secrets.sh stores it there.
# DEMO_PASSWORD_DOSTIP=shared-insecure-demo-password
#
# Operator-only setup secret for Cognito custom email delivery through Resend.
# Keep this only in an untracked local .env or as an exported shell variable.
# Deploys use AWS Secrets Manager ARNs, not the raw key in repo config.
# RESEND_API_KEY=
#
# Local-only admin key for Resend domain setup scripts.
# This key must never be stored in AWS or in repo config.
# RESEND_ADMIN_API_KEY=
# AI chat configuration (required for /chat in local dev, and optionally used by
# scripts/setup/setup-ai-secrets.sh plus scripts/deploy/first-deploy.sh or
# scripts/deploy/bootstrap.sh when exported)
# Guest AI quota defaults to 0 when omitted, which disables guest AI fail-closed.
# GUEST_AI_WEIGHTED_MONTHLY_TOKEN_CAP=400000
# OPENAI_API_KEY=
# LANGFUSE_PUBLIC_KEY=
# LANGFUSE_SECRET_KEY=
# LANGFUSE_BASE_URL=https://cloud.langfuse.com
#
# Local operator / deploy setup. Keep these in root .env locally and let the
# setup scripts sync GitHub variables and AWS secrets from there.
# AWS_REGION=eu-central-1
# DOMAIN_NAME=flashcards-open-source-app.com
# ALERT_EMAIL=alerts@example.com
# GITHUB_REPO=kirill-markin/flashcards-open-source-app
# Backend Sentry is required for deployed AWS Lambda runtimes. Set SENTRY_DSN
# for bootstrap-created AWS Secrets Manager storage, or set
# SENTRY_DSN_SECRET_ARN to reuse an existing secret.
# SENTRY_DSN=
# SENTRY_DSN_SECRET_ARN=
# SENTRY_ENVIRONMENT=production
# SENTRY_RELEASE=<target commit sha for local/manual CDK context generation>
# SENTRY_TRACES_SAMPLE_RATE=0
# SENTRY_ORG=flashcards-open-source-app
# SENTRY_BACKEND_PROJECT=flashcards-backend
# SENTRY_AUTH_TOKEN=
# Optional web Sentry. scripts/setup/setup-github.sh syncs these to GitHub Actions variables;
# web source map uploads use the shared SENTRY_ORG and SENTRY_AUTH_TOKEN values.
# VITE_SENTRY_DSN=
# VITE_SENTRY_TRACES_SAMPLE_RATE=0
# SENTRY_WEB_PROJECT=flashcards-web
# Global metrics visibility for the deployed GET /v1/global/snapshot endpoint.
# Use the exact raw string true to expose it. Any other value, or leaving it
# unset, keeps the endpoint hidden. scripts/setup/setup-github.sh bootstraps this into the
# GitHub repository variable CDK_GLOBAL_METRICS_VISIBLE without overwriting an
# existing value there, so later deployed visibility changes must be made
# manually in GitHub (or by deleting that variable) before redeploying.
# GLOBAL_METRICS_VISIBLE=true
# ADMIN_EMAILS=admin@example.com
# Initial bootstrap input for local/manual deploy flows only.
# After scripts/setup/setup-github.sh creates CDK_ADMIN_EMAILS, change that GitHub variable
# manually for deployed-environment admin-list updates.
# CLOUDFLARE_API_TOKEN=
# CLOUDFLARE_ZONE_ID=
# scripts/setup/setup-mcp-registry-credential.sh also uses DOMAIN_NAME,
# GITHUB_REPO, and the Cloudflare values above to create the MCP Registry DNS
# TXT record and GitHub Actions MCP_PRIVATE_KEY secret. Do not store the
# MCP_PRIVATE_KEY value in .env.
# Analytical DB access bastion, reachable only through SSM Session Manager.
# Enabled by default, so leave this unset unless you want it removed. Only the
# exact strings true and false are accepted, and false deletes the bastion
# together with the only operator path into the private database.
# ANALYTICS_ACCESS_ENABLED=true
#
# Local iOS signed archive generation can reuse the same inputs as Xcode Cloud.
# Run `sh apps/ios/Flashcards/ci_scripts/ci_post_clone.sh` to regenerate
# `apps/ios/Flashcards/Config/Local.xcconfig` from these values.
# XCODE_CLOUD_DEVELOPMENT_TEAM=ABCDE12345
# XCODE_CLOUD_APP_BUNDLE_IDENTIFIER=com.flashcards-open-source-app.app
# XCODE_CLOUD_API_BASE_URL=https:/$()/api.flashcards-open-source-app.com/v1
# XCODE_CLOUD_AUTH_BASE_URL=https:/$()/auth.flashcards-open-source-app.com
# XCODE_CLOUD_PRIVACY_POLICY_URL=https:/$()/flashcards-open-source-app.com/privacy/
# XCODE_CLOUD_TERMS_OF_SERVICE_URL=https:/$()/flashcards-open-source-app.com/terms/
# XCODE_CLOUD_SUPPORT_URL=https:/$()/flashcards-open-source-app.com/support/
# XCODE_CLOUD_SUPPORT_EMAIL_ADDRESS=kirill+flashcards@kirill-markin.com
# XCODE_CLOUD_SENTRY_DSN=
# XCODE_CLOUD_SENTRY_ENVIRONMENT=production
# XCODE_CLOUD_SENTRY_TRACES_SAMPLE_RATE=0.0
# iOS dSYM uploads also reuse SENTRY_ORG and SENTRY_AUTH_TOKEN from above.
# SENTRY_IOS_PROJECT=flashcards-ios
# Optional for self-hosted Sentry or pinned CLI checksum overrides.
# SENTRY_URL=
# SENTRY_CLI_EXPECTED_SHA256=
# FLASHCARDS_LIVE_REVIEW_EMAIL=apple-review@example.com
#
# Google Cloud / Firebase Test Lab Android CI
# GCP_PROJECT_ID=flashcards-open-source-app
# GCP_WORKLOAD_IDENTITY_PROVIDER=projects/123456789/locations/global/workloadIdentityPools/github/providers/flashcards-open-source-app
# GCP_SERVICE_ACCOUNT_EMAIL=github-android-ci@flashcards-open-source-app.iam.gserviceaccount.com
# GCP_PLAY_SERVICE_ACCOUNT_EMAIL=github-android-play@flashcards-open-source-app.iam.gserviceaccount.com
# GCP_FTL_READER_SERVICE_ACCOUNT=codex-ftl-reader@flashcards-open-source-app.iam.gserviceaccount.com
# ANDROID_FTL_DEVICE_MODEL=your-supported-test-lab-device
# ANDROID_FTL_DEVICE_VERSION=36
# ANDROID_FTL_RESULTS_BUCKET=gs://flashcards-open-source-app-test-lab-results
# ANDROID_FTL_RESULTS_DIR=github-actions/android
# ANDROID_PLAY_PACKAGE_NAME=com.flashcardsopensourceapp.app
# ANDROID_UPLOAD_KEYSTORE_BASE64=
# ANDROID_UPLOAD_KEYSTORE_PASSWORD=
# ANDROID_UPLOAD_KEY_ALIAS=
# ANDROID_UPLOAD_KEY_PASSWORD=
# =============================================================================
# AWS Lambda environment (auto-injected by CDK — do NOT set manually)
#
# Source of truth: infra/aws/lib/gateways/api-gateway.ts (environment blocks)
#
# CDK resolves these from CloudFormation refs at deploy time.
# Listed here for reference when debugging a running Lambda.
# =============================================================================
#
# --- Backend Lambda ---
# AUTH_MODE=cognito
# COGNITO_USER_POOL_ID=<from CDK: authResult.userPool.userPoolId>
# COGNITO_CLIENT_ID=<from CDK: authResult.userPoolClient.userPoolClientId>
# COGNITO_REGION=<AWS::Region>
# DB_SECRET_ARN=<from Secrets Manager>
# REPORTING_DB_SECRET_ARN=<from Secrets Manager>
# DB_HOST=<RDS endpoint>
# DB_NAME=flashcards
# NODE_EXTRA_CA_CERTS=/var/task/rds-global-bundle.pem
# GUEST_AI_WEIGHTED_MONTHLY_TOKEN_CAP=<optional: defaults to 0 when omitted>
# OPENAI_API_KEY=<optional: from Secrets Manager when configured>
# LANGFUSE_PUBLIC_KEY=<optional: from Secrets Manager when configured>
# LANGFUSE_SECRET_KEY=<optional: from Secrets Manager when configured>
# LANGFUSE_BASE_URL=<optional: defaults to https://cloud.langfuse.com when Langfuse secrets are configured>
#
# --- Auth Lambda ---
# COGNITO_USER_POOL_ID=<from CDK: authResult.userPool.userPoolId>
# COGNITO_CLIENT_ID=<from CDK>
# COGNITO_REGION=<AWS::Region>
# SESSION_ENCRYPTION_KEY=<from Secrets Manager>
# ALLOWED_REDIRECT_URIS=https://example.com,https://app.example.com,https://admin.example.com
# COOKIE_DOMAIN=example.com
# DEMO_EMAIL_DOSTIP=<optional comma-separated insecure review account allowlist in @example.com only>
# DEMO_PASSWORD_SECRET_ARN=<optional Secrets Manager ARN for the shared insecure review account password>