plane/.env.prod.example at oidc-on-master · walzen-group/plane · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# Production environment for docker-compose.prod.yml.
# Copy to `.env` on the prod host (same dir as the compose file) and fill in.
# Variables marked REQUIRED have no default — the compose will refuse to start
# without them. Variables marked OPTIONAL have sensible defaults.

# ============================================================================
# REQUIRED — public domain + TLS
# ============================================================================

# Public domain Plane is served at (no scheme, no trailing slash).
APP_DOMAIN=plane.example.com


# ============================================================================
# REQUIRED — secrets (generate fresh, unique, long random strings)
# ============================================================================

# Django SECRET_KEY. Generate:  openssl rand -hex 32
SECRET_KEY=

# Postgres password.
POSTGRES_PASSWORD=

# RabbitMQ password.
RABBITMQ_PASSWORD=

# Live (collaborative editing) server secret. Generate:  openssl rand -hex 32
LIVE_SERVER_SECRET_KEY=

# Object-storage credentials. If you use the bundled MinIO, these are MinIO's
# root creds. If you use external S3 (AWS / Cloudflare R2 / etc.), set them to
# your S3 access key + secret AND set AWS_S3_ENDPOINT_URL below.
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=

# ============================================================================
# IMAGE TAGS — pin for prod, leave `:latest` for "always roll forward"
# ============================================================================

# Tag for your GHCR-published images (api/worker/migrator/web/admin).
# Recommended for prod: pin to a short SHA tag from a successful build.
# Find these in: GitHub → your fork → Packages → plane-backend → tags.
IMAGE_TAG=latest

# Channel for unchanged upstream images (live / space / proxy).
APP_RELEASE=stable

# ============================================================================
# OPTIONAL — OIDC seed (or configure via God-mode after first boot)
# ============================================================================

# Issuer URL (no trailing /.well-known/...). Example for Authentik:
# OIDC_URL=https://authentik.example.com/application/o/plane
OIDC_URL=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
# Set to 1 to enable OIDC sign-in immediately on first boot.
IS_OIDC_ENABLED=0
# Set to 1 to re-pull name/avatar from the IdP on every login.
ENABLE_OIDC_SYNC=0

# ============================================================================
# OPTIONAL — DB / queue / storage defaults
# ============================================================================

POSTGRES_USER=plane
POSTGRES_DB=plane
RABBITMQ_USER=plane
RABBITMQ_VHOST=plane

# Storage bucket name (auto-created in MinIO on first run).
AWS_S3_BUCKET_NAME=uploads

# Set to your S3 endpoint if NOT using the bundled MinIO.
# Examples:
#   AWS region: leave AWS_S3_ENDPOINT_URL unset
#   Cloudflare R2: https://<account>.r2.cloudflarestorage.com
AWS_S3_ENDPOINT_URL=http://plane-minio:9000
AWS_REGION=
USE_MINIO=1
MINIO_ENDPOINT_SSL=0

# ============================================================================
# OPTIONAL — tuning + misc
# ============================================================================

# Gunicorn worker processes for the api container. Rule of thumb: 2 × CPU + 1.
GUNICORN_WORKERS=2

# Listen ports for the bundled proxy. Change only if 80/443 are taken.
LISTEN_HTTP_PORT=80
LISTEN_HTTPS_PORT=443

# Max upload size in bytes (default 5 MiB).
FILE_SIZE_LIMIT=5242880

# Webhook outbound allowlist (CSV). Leave blank for "block all internal IPs"
# (default safe behavior).
WEBHOOK_ALLOWED_IPS=
WEBHOOK_ALLOWED_HOSTS=

# API key rate limit.
API_KEY_RATE_LIMIT=60/minute

# Set DEBUG=1 only when debugging — exposes traces, never in real prod.
DEBUG=0