37 lines
1.8 KiB
Bash
37 lines
1.8 KiB
Bash
|
# FORGE — environment template. Copy to `.env` and fill in.
|
||
|
|
# `.env` is gitignored and never baked into a Docker image (compose reads it at runtime).
|
||
|
|
#
|
||
|
|
# LOCAL DEV: set DATABASE_URL + SESSION_SECRET + AUTH_USER/PASS below.
|
||
|
|
# PRODUCTION (Synology / docker compose): compose OVERRIDES DATABASE_URL, PORT and
|
||
|
|
# NODE_ENV itself; the .env on the NAS only needs the *** REQUIRED IN PROD *** vars:
|
||
|
|
# SESSION_SECRET, AUTH_USER, AUTH_PASS, POSTGRES_PASSWORD.
|
||
|
|
|
||
|
|
# --- Database -------------------------------------------------------------
|
||
|
|
# Postgres for the `forge` database. Schema self-bootstraps (initDB) + seeds on
|
||
|
|
# first run. LOCAL DEV only — in compose this is set to the bundled `db` service.
|
||
|
|
DATABASE_URL=postgresql://forge:forge@localhost:5432/forge
|
||
|
|
|
||
|
|
# HTTP port the server listens on (container-internal; compose maps it to host 3089).
|
||
|
|
PORT=3000
|
||
|
|
|
||
|
|
# development locally; compose sets production on the NAS.
|
||
|
|
NODE_ENV=development
|
||
|
|
|
||
|
|
# --- Read-API auth (*** SESSION_SECRET/AUTH_PASS REQUIRED IN PROD ***) -----
|
||
|
|
# Session signing secret. Generate with: openssl rand -base64 32
|
||
|
|
SESSION_SECRET=change_me_generate_with_openssl_rand_base64_32
|
||
|
|
|
||
|
|
# Bootstrap admin account, seeded into app_users on first boot (bcrypt-hashed, role
|
||
|
|
# admin). Changing AUTH_PASS later does NOT update an already-seeded account — manage
|
||
|
|
# users in the app (Admin → Users) instead.
|
||
|
|
AUTH_USER=admin
|
||
|
|
AUTH_PASS=change_me
|
||
|
|
|
||
|
|
# --- Postgres (compose bundled db — *** REQUIRED IN PROD ***) --------------
|
||
|
|
# The bundled Postgres password used by docker-compose. Use a strong value in prod.
|
||
|
|
POSTGRES_PASSWORD=change_me_strong_db_password
|
||
|
|
|
||
|
|
# Sync tokens for the Chrome extension are created in the app (Admin → API Tokens,
|
||
|
|
# admin only) or via the CLI: npx tsx server/mint-token.ts "my laptop"
|
||
|
|
# (The old ADMIN_KEY HTTP gate was removed — tokens are now admin-role gated.)
|