overslash/.env.example at dev · overfolder/overslash · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
DATABASE_URL=postgres://overslash:overslash@localhost:55432/overslash
HOST=0.0.0.0
PORT=3000
SECRETS_ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000
SIGNING_KEY=1111111111111111111111111111111111111111111111111111111111111111
# Deps stay at info; overslash crates emit debug for local development.
RUST_LOG=info,overslash_api=debug,overslash_core=debug,overslash_db=debug,overslash_mcp=debug,overslash_cli=debug
APPROVAL_EXPIRY_SECS=1800
# Upstream call timeouts (D56). CALL_TIMEOUT_MS is the default when neither the
# call, the action template, the service template, nor the org says otherwise.
# CALL_TIMEOUT_MAX_MS is the hard ceiling on any resolved value and should sit
# just under whatever request cap your proxy enforces (Cloud Run and the GCLB
# both cut at 120s), so a slow call fails with our own 504 and an audit row
# rather than an anonymous proxy timeout.
CALL_TIMEOUT_MS=30000
CALL_TIMEOUT_MAX_MS=110000
# Per-chunk idle timeout for `prefer_stream: true` responses. Streaming
# deliberately does not take the call timeout as a total deadline — that would
# fail a healthy large transfer at an arbitrary elapsed time — so slowness is
# allowed and only a stall is fatal.
CALL_STREAM_IDLE_TIMEOUT_MS=30000
# Display-param resolver cache (D64). A resolver turns an opaque argument into
# something a reviewer can read, at the cost of an authenticated round trip per
# call; this caches the answer. When REDIS_URL is set the cache is shared across
# replicas via Valkey, otherwise it is process-local. Cached values are
# encrypted with SECRETS_ENCRYPTION_KEY, because what a resolver returns is
# people's names, addresses and phone numbers.
#
# Keep RESOLVE_CACHE_TTL_SECS short. A resolver that declares `scope:` decides
# which permission *grant* matches, while the call itself still targets the
# caller's raw argument — so the TTL is how long a grant may be matched against
# a stale mapping. Templates that know their mapping is immutable raise it
# per-resolver with `cache_ttl:`. Set to 0 to disable the cache entirely.
RESOLVE_CACHE_TTL_SECS=300
# How long a *failed* lookup is remembered. Stops a down provider costing every
# call the full 3s resolver timeout, without keeping approvals unreadable long
# after it recovers.
RESOLVE_CACHE_NEGATIVE_TTL_SECS=30
# Ceiling on the effective TTL for `scope:`-bearing resolvers. A template sets a
# default; the deployment sets the cap; the tighter wins.
RESOLVE_CACHE_SCOPE_TTL_MAX_SECS=300
# Budget for the cache backend itself. Exceeding it is a miss, never an error —
# the call resolves live. Sits well inside the 3s resolver budget.
RESOLVE_CACHE_TIMEOUT_MS=100
# In-memory backend only: cap on resident entries, since resolver arguments are
# caller-supplied and would otherwise grow unboundedly between sweeps.
RESOLVE_CACHE_MAX_ENTRIES=10000
# Extra key-namespace segment. Leave unset in production; set it when two
# deployments share one Valkey.
# RESOLVE_CACHE_NAMESPACE=
# Optional Valkey/Redis. Backs rate-limit counters and, when set, the resolver
# cache above. Unset means both fall back to process-local in-memory stores,
# which is correct for a single replica.
# REDIS_URL=redis://localhost:6379
# Service-template variables (D44). Every `OVERSLASH_TEMPLATE_VAR_<NAME>` here
# supplies `${<NAME>}` to a service template in services/ — nothing else in the
# environment is reachable from a template, which is what makes it safe to let
# org-authored templates use the same syntax.
#
# NON-SECRET ONLY. Any tenant who can author a template can read these back by
# referencing them and reading the resolved definition. Hostnames, base URLs —
# never a key.
#
# MAILBOX_HOST is the overfwd Mailbox Gateway host that services/email.yaml
# resolves its `servers[0]` to. It has no default on purpose: a wrong host both
# sends mail through somebody else's gateway and silently loses the platform
# gateway key (which is only ever sent to OVERSLASH_PLATFORM_GATEWAY_HOST).
# Unset ⇒ the `email` template simply doesn't load.
#   dev  → mailbox.dev.overslash.com
#   prod → mailbox.overslash.com
# OVERSLASH_TEMPLATE_VAR_MAILBOX_HOST=mailbox.dev.overslash.com
# Self-hosted Metabase (services/metabase.yaml). Optional in a different sense
# from MAILBOX_HOST: the template writes `${METABASE_URL?}`, so leaving this
# unset does not drop the template — it ships with no host and each service
# instance is asked for its own URL instead. Set it to give every instance in
# the deployment the same default.
# OVERSLASH_TEMPLATE_VAR_METABASE_URL=http://localhost:3033
# Enables /auth/dev/token (returns a session cookie for dev@overslash.local).
# Required for the screenshot script and any non-OAuth local testing. Leave
# unset in production.
DEV_AUTH=1
# Overslash-managed sign-in (optional). When set, corp orgs that opt in via
# `allow_overslash_managed_signin` accept authentication through these
# shared OAuth apps — admission is still gated by their `org_invites`
# allowlist, so a verified email cannot admit a stranger. Leave unset to
# require every org to register its own OAuth app.
# GOOGLE_AUTH_CLIENT_ID=...
# GOOGLE_AUTH_CLIENT_SECRET=...
# GitHub sign-in: register an OAuth App (not a GitHub App — the login flow
# relies on the read:user / user:email scopes, which GitHub Apps ignore) under
# the `overfolder` org, one per environment for secret isolation. The callback
# URL is always `<PUBLIC_URL>/auth/callback/github`:
#   local → http://localhost:3000/auth/callback/github
#   dev   → https://api.dev.overslash.com/auth/callback/github
#   prod  → https://api.overslash.com/auth/callback/github
# GITHUB_AUTH_CLIENT_ID=...
# GITHUB_AUTH_CLIENT_SECRET=...
# Billing (optional — only needed when CLOUD_BILLING=true).
# Lookup keys default to overslash_seat_eur / overslash_seat_usd; set the same
# value on the matching Price in Stripe Dashboard so the server resolves the
# literal price_… ID at startup. Override only if you pick different names.
# CLOUD_BILLING=true
# STRIPE_SECRET_KEY=sk_test_...
# STRIPE_WEBHOOK_SECRET=whsec_...
# STRIPE_EUR_LOOKUP_KEY=overslash_seat_eur
# STRIPE_USD_LOOKUP_KEY=overslash_seat_usd
# Default trial length in days. Used by the instance-admin "start trial"
# endpoint (when no explicit duration is passed) and by the self-serve
# Stripe trial (subscription_data[trial_period_days]). Default 30.
# TRIAL_DEFAULT_DURATION_DAYS=30

# Transactional email (optional). Keep this block commented in dev — the API
# uses NoopMailer when EMAIL_PROVIDER is unset and boots cleanly. Setting
# EMAIL_PROVIDER without a real EMAIL_API_KEY + EMAIL_FROM trips validate_env
# and the CLI exits at startup.
# EMAIL_PROVIDER=resend
# EMAIL_FROM=no-reply@overslash.com
# EMAIL_REPLY_TO=support@overslash.com
# EMAIL_API_KEY=re_your_resend_api_key_here