mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 15:51:23 +00:00
Tomas DvorakandDevin
c6166de886
Self-hosted instances are now email/password only — OAuth providers (GitHub/Google/Discord/Microsoft) activate solely when PRIMORA_MANAGED=true, reserved for the future hosted tier. Sign-up lifecycle: the first public sign-up becomes the instance admin; after bootstrap, sign-up closes by default. A better-auth databaseHook gates only /sign-up/email, so admin-created users and OAuth flows bypass it. The login page reads GET /instance/public to hide the sign-up tab, show the bootstrap notice, and render only the providers the instance offers. Instance settings live in core.settings (migration 00010) and resolve in-app > env > built-in default, cached 15s. Platform admins (better-auth user.role) manage sign-up, mail transport, and rate limits via GET/PUT/DELETE /instance/settings or the new Settings → Instance tab. Secret values are AES-256-GCM encrypted at rest with PRIMORA_ENCRYPTION_KEY, never returned by the API, and decrypted by the auth service at send time. Auth service reads the same settings table for the sign-up gate and mail config, so in-app changes take effect without a restart. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
76 lines
2.3 KiB
Bash
76 lines
2.3 KiB
Bash
NODE_ENV=development
|
|
|
|
POSTGRES_USER=primora
|
|
POSTGRES_PASSWORD=primora
|
|
POSTGRES_DB=primora
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
DATABASE_URL=postgres://primora:primora@postgres:5432/primora?sslmode=disable
|
|
|
|
DRAGONFLY_HOST=dragonfly
|
|
DRAGONFLY_PORT=6379
|
|
DRAGONFLY_URL=redis://dragonfly:6379/0
|
|
USER_RATE_LIMIT_PER_MINUTE=240
|
|
API_KEY_RATE_LIMIT_PER_MINUTE=600
|
|
|
|
JWT_ISSUER=primora-auth
|
|
JWT_AUDIENCE=primora-api
|
|
JWT_SECRET=change-me-super-long-jwt-secret
|
|
JWT_TTL_SECONDS=900
|
|
|
|
# AES-256 key (32 bytes, hex or base64) encrypting integration credentials and
|
|
# webhook secrets at rest. Required in production; dev falls back to this value.
|
|
PRIMORA_ENCRYPTION_KEY=3031323334353637383961626364656630313233343536373839616263646566
|
|
|
|
AUTH_PORT=3001
|
|
AUTH_BASE_URL=http://localhost/auth
|
|
AUTH_INTERNAL_BASE_URL=http://auth:3001
|
|
BETTER_AUTH_SECRET=change-me-super-long-better-auth-secret
|
|
BETTER_AUTH_URL=http://localhost/auth
|
|
# Comma-separated emails promoted to auth admin on boot (Authentication → Users panel)
|
|
AUTH_ADMIN_EMAILS=
|
|
# The first public sign-up always becomes the instance admin. With no users the
|
|
# login page shows only the sign-up form. After bootstrap, public sign-up is
|
|
# closed unless SIGNUP_ENABLED=true or the admin enables it in-app
|
|
# (Settings → Instance). In-app values override this file.
|
|
SIGNUP_ENABLED=false
|
|
# Managed tier flag — OAuth providers activate only when this is "true".
|
|
# Self-hosted instances are email/password regardless of the keys below.
|
|
PRIMORA_MANAGED=false
|
|
COOKIE_DOMAIN=localhost
|
|
|
|
FRONTEND_PORT=3000
|
|
VITE_APP_URL=http://localhost
|
|
VITE_AUTH_BASE_URL=http://localhost/auth
|
|
VITE_API_BASE_URL=http://localhost/api/v1
|
|
VITE_DEMO_MODE=false
|
|
|
|
BACKEND_PORT=8080
|
|
BACKEND_PUBLIC_URL=http://localhost/api/v1
|
|
BACKEND_INTERNAL_URL=http://backend:8080
|
|
BACKEND_STORAGE_ROOT=/data/storage
|
|
|
|
# Mail defaults — each is overridable in-app (Settings → Instance). In-app
|
|
# values win over these env vars; deleting the in-app value reverts here.
|
|
RESEND_API_KEY=
|
|
MAIL_FROM=Primora <[email protected]>
|
|
SMTP_HOST=mailpit
|
|
SMTP_PORT=1025
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_SECURE=false
|
|
|
|
# OAuth keys only take effect when PRIMORA_MANAGED=true (managed tier).
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
DISCORD_CLIENT_ID=
|
|
DISCORD_CLIENT_SECRET=
|
|
MICROSOFT_CLIENT_ID=
|
|
MICROSOFT_CLIENT_SECRET=
|
|
MICROSOFT_TENANT_ID=
|
|
|
|
NGINX_PORT=80
|
|
MAILPIT_HTTP_PORT=8025
|