pinnwand/.env.example at master · maikbasel/pinnwand · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# Production / deployment env template (docker-compose.coolify.yml).
#
# For LOCAL FRONTEND dev vars (VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY), see
# apps/web/.env.example — those live next to the Vite app, not here.

# ── GoTrue OAuth 2.1 Server ─────────────────────────────────────────────────
# The three knobs below enable GoTrue's built-in OAuth 2.1 authorization server,
# which implements RFC 6749 / RFC 7636 (PKCE). Set in all three compose files
# (docker-compose.yml, docker-compose.e2e.yml, docker-compose.coolify.yml).
#   GOTRUE_OAUTH_SERVER_ENABLED=true
#   GOTRUE_OAUTH_SERVER_ALLOW_DYNAMIC_REGISTRATION=true
#   GOTRUE_OAUTH_SERVER_AUTHORIZATION_PATH=/oauth/consent
# These are config-only; no secrets. Discovery endpoint: /.well-known/oauth-authorization-server.

# ── Production (Coolify) ─────────────────────────────────────────────────────
# docker-compose.coolify.yml gates these with ${VAR:?…}, so `docker compose
# config` fails fast if any is missing. Set them in the Coolify service env.
# Do NOT reuse the demo keys in apps/web/.env.example in production; generate real ones.
#
#   POSTGRES_PASSWORD=            # strong random password
#   JWT_SECRET=                   # ≥ 32 chars; the Supabase JWT signing secret
#   ANON_KEY=                     # anon JWT signed with JWT_SECRET
#   SERVICE_ROLE_KEY=             # service_role JWT signed with JWT_SECRET
#   REALTIME_ENC_KEY=             # exactly 16 bytes, `openssl rand -hex 8`
#   REALTIME_SECRET_KEY_BASE=     # at least 64 bytes, `openssl rand -hex 32`
#   SITE_URL=                     # public web origin, e.g. https://pinnwand.example.com
#   API_EXTERNAL_URL=             # public kong origin, e.g. https://api.pinnwand.example.com
#   SMTP_HOST=
#   SMTP_PORT=
#   SMTP_USER=
#   SMTP_PASS=
#   EMAIL_FROM=                   # sender address, e.g. no-reply@pinnwand.example.com

# ── MCP connector server (apps/mcp) ─────────────────────────────────────────
# A separate Coolify app on its own subdomain (docker-compose.coolify.yml's
# `mcp` service). It acts as the connecting user via a per-request
# user-scoped Supabase client — RLS is the only authorization boundary, and
# it only ever holds the anon key, never the service role key. See
# apps/mcp/src/env.ts for the full zod schema and docs/deployment.md for the
# client connect strings.
#
#   SUPABASE_URL=                 # public kong origin, same value as API_EXTERNAL_URL
#   SUPABASE_ANON_KEY=            # same value as ANON_KEY above
#   SUPABASE_JWT_SECRET=          # same value as JWT_SECRET above; verifies user JWTs. NOT SERVICE_ROLE_KEY.
#   MCP_PUBLIC_URL=               # public mcp origin, e.g. https://mcp.pinnwand.example.com
#   SUPABASE_AUTH_URL=            # optional; defaults to SUPABASE_URL + /auth/v1
#   LOG_LEVEL=                    # optional; fatal|error|warn|info|debug|trace, defaults to info
#   PORT=                         # optional; defaults to 8787