mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 15:51:23 +00:00
Tomas DvorakandDevin
9ae1c22af0
Each invoke runs in an ephemeral locked-down container — no network, read-only rootfs, 128MiB/0.5CPU/64-pid caps, non-root, cap-drop ALL. Source travels as base64 in the container env and materializes in the tmpfs, so no bind mount is needed (Docker Desktop / remote daemons work). Timeout force-removes the named container. exec driver stays the default; the trust-model docs now describe both. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
101 lines
3.4 KiB
Bash
101 lines
3.4 KiB
Bash
NODE_ENV=development
|
|
|
|
POSTGRES_USER=primora
|
|
POSTGRES_PASSWORD=primora
|
|
POSTGRES_DB=primora
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
DATABASE_URL=postgres://primora:primora@postgres:5432/primora?sslmode=disable
|
|
|
|
DRAGONFLY_HOST=dragonfly
|
|
DRAGONFLY_PORT=6379
|
|
DRAGONFLY_URL=redis://dragonfly:6379/0
|
|
USER_RATE_LIMIT_PER_MINUTE=240
|
|
API_KEY_RATE_LIMIT_PER_MINUTE=600
|
|
|
|
JWT_ISSUER=primora-auth
|
|
JWT_AUDIENCE=primora-api
|
|
JWT_SECRET=change-me-super-long-jwt-secret
|
|
JWT_TTL_SECONDS=900
|
|
|
|
# AES-256 key (32 bytes, hex or base64) encrypting integration credentials and
|
|
# webhook secrets at rest. Required in production; dev falls back to this value.
|
|
PRIMORA_ENCRYPTION_KEY=3031323334353637383961626364656630313233343536373839616263646566
|
|
|
|
AUTH_PORT=3001
|
|
AUTH_BASE_URL=http://localhost/auth
|
|
AUTH_INTERNAL_BASE_URL=http://auth:3001
|
|
BETTER_AUTH_SECRET=change-me-super-long-better-auth-secret
|
|
BETTER_AUTH_URL=http://localhost/auth
|
|
# Comma-separated emails promoted to auth admin on boot (Authentication → Users panel)
|
|
AUTH_ADMIN_EMAILS=
|
|
# The first public sign-up always becomes the instance admin. With no users the
|
|
# login page shows only the sign-up form. After bootstrap, public sign-up is
|
|
# closed unless SIGNUP_ENABLED=true or the admin enables it in-app
|
|
# (Settings → Instance). In-app values override this file.
|
|
SIGNUP_ENABLED=false
|
|
# Managed tier flag — OAuth providers activate only when this is "true".
|
|
# Self-hosted instances are email/password regardless of the keys below.
|
|
PRIMORA_MANAGED=false
|
|
COOKIE_DOMAIN=localhost
|
|
|
|
FRONTEND_PORT=3000
|
|
VITE_APP_URL=http://localhost
|
|
VITE_AUTH_BASE_URL=http://localhost/auth
|
|
VITE_API_BASE_URL=http://localhost/api/v1
|
|
VITE_DEMO_MODE=false
|
|
|
|
BACKEND_PORT=8080
|
|
BACKEND_PUBLIC_URL=http://localhost/api/v1
|
|
BACKEND_INTERNAL_URL=http://backend:8080
|
|
BACKEND_STORAGE_ROOT=/data/storage
|
|
|
|
# Object storage driver: "local" (default, uses BACKEND_STORAGE_ROOT) or "s3".
|
|
# For s3, point S3_ENDPOINT at any S3-compatible API (AWS, MinIO, Garage, R2).
|
|
BACKEND_STORAGE_DRIVER=local
|
|
#S3_ENDPOINT=http://minio:9000
|
|
#S3_REGION=us-east-1
|
|
#S3_BUCKET=primora-objects
|
|
#S3_ACCESS_KEY_ID=
|
|
#S3_SECRET_ACCESS_KEY=
|
|
#S3_PREFIX=
|
|
#S3_PATH_STYLE=true
|
|
# Client-facing S3 endpoint for presigned URLs — set when S3_ENDPOINT is an
|
|
# internal address (e.g. http://minio:9000 inside compose) that browsers
|
|
# can't reach. Presigned URLs are valid only at the host they were minted for.
|
|
#S3_PUBLIC_ENDPOINT=https://objects.example.com
|
|
|
|
# Functions execution. "exec" runs the runtime binary (bun/deno) directly on
|
|
# the backend host — simple, but function code inherits backend privileges.
|
|
# "docker" runs each invoke in an ephemeral locked-down container (no
|
|
# network, read-only fs, 128 MiB mem, non-root) and requires the Docker
|
|
# socket mounted into the backend plus the runtime images pulled.
|
|
#FUNCTIONS_DRIVER=exec
|
|
#FUNCTIONS_RUNTIME=auto
|
|
#FUNCTIONS_TIMEOUT_SECONDS=30
|
|
#FUNCTIONS_MAX_OUTPUT_BYTES=65536
|
|
|
|
# Mail defaults — each is overridable in-app (Settings → Instance). In-app
|
|
# values win over these env vars; deleting the in-app value reverts here.
|
|
RESEND_API_KEY=
|
|
MAIL_FROM=Primora <[email protected]>
|
|
SMTP_HOST=mailpit
|
|
SMTP_PORT=1025
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_SECURE=false
|
|
|
|
# OAuth keys only take effect when PRIMORA_MANAGED=true (managed tier).
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
DISCORD_CLIENT_ID=
|
|
DISCORD_CLIENT_SECRET=
|
|
MICROSOFT_CLIENT_ID=
|
|
MICROSOFT_CLIENT_SECRET=
|
|
MICROSOFT_TENANT_ID=
|
|
|
|
NGINX_PORT=80
|
|
MAILPIT_HTTP_PORT=8025
|