-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
134 lines (103 loc) · 5.27 KB
/
Copy path.env.example
File metadata and controls
134 lines (103 loc) · 5.27 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# ============================================
# CrewCaptain Environment Variables
# ============================================
# Copy this file to .env and fill in your values.
# Never commit .env to version control.
# ============================================
# Backend (API) Configuration
# ============================================
# PostgreSQL database connection URL (JDBC format)
DB_URL=jdbc:postgresql://localhost:5432/crewcaptain
# PostgreSQL database username
DB_USER=crewcaptain
# PostgreSQL database password
DB_PASSWORD=your-database-password-here
# OIDC issuer URI (e.g., authentik application provider URL)
OIDC_ISSUER_URI=your-oidc-issuer-url-here
# OIDC JWKS (JSON Web Key Set) endpoint URI
OIDC_JWKS_URI=your-oidc-jwks-url-here
# JWKS fetch HTTP timeouts in milliseconds (optional). Spring Security 7 defaults
# both to 500ms, which is too short for a remote OIDC provider and causes
# "Read timed out" on JWKS retrieval. Raise these if your provider is remote/slow.
# APP_SECURITY_JWKS_CONNECT_TIMEOUT_MS=5000
# APP_SECURITY_JWKS_READ_TIMEOUT_MS=10000
# Master encryption key for sensitive field encryption (optional)
# Must be exactly 32 bytes (256 bits) when Base64-decoded.
# Generate with: openssl rand -base64 32
# Without this key, sensitive content is stored in plaintext.
ENCRYPTION_KEY=your-encryption-key-here
# Bearer token for securing the /actuator/prometheus metrics endpoint.
# Prometheus scrape config must include this token in the Authorization header.
# Generate with: openssl rand -hex 32
# If not set, the metrics endpoint returns 403.
METRICS_TOKEN=your-metrics-token-here
# ============================================
# AI Team Defaults (Optional)
# ============================================
# Set these to provide a shared AI subscription for all users on this instance.
# Individual users can override with their own settings in the Settings page.
# Both BASE_URL and MODEL are required for defaults to activate.
# Base URL of the OpenAI-compatible API (e.g., Ollama, LiteLLM, vLLM, OpenAI)
# AI_DEFAULT_BASE_URL=http://ollama:11434/v1
# API key for the AI provider (leave empty for local models like Ollama)
# AI_DEFAULT_API_KEY=
# Model name to use (e.g., llama3, gpt-4o, mistral)
# AI_DEFAULT_MODEL=llama3
# ============================================
# Local LLM Overlay (Development Only)
# ============================================
# These are consumed ONLY by docker-compose.ai.yml, which runs a self-contained
# Ollama instance and auto-pulls a small model, then sets the AI_DEFAULT_* vars
# above for you. Both have safe defaults baked into the overlay — override only
# if you want a different model or image tag. No API key or secrets involved.
#
# See the "Local AI (Ollama)" section in README.md for setup.
# Model to auto-pull and use (default: qwen2.5:1.5b; try gemma3:1b for less RAM)
# OLLAMA_MODEL=qwen2.5:1.5b
# Ollama server image tag (pin to a specific release)
# OLLAMA_TAG=0.30.11
# Notification scheduler cron expression (default: every hour)
# Format: second minute hour day-of-month month day-of-week
NOTIFICATION_CRON=0 0 * * * *
# Number of days before due date to trigger "due soon" notifications (default: 3)
NOTIFICATION_DUE_SOON_DAYS=3
# Number of days to look ahead for upcoming work anniversaries (default: 7)
NOTIFICATION_ANNIVERSARY_LOOKAHEAD_DAYS=7
# ============================================
# Frontend Configuration
# ============================================
# Canonical URL of the frontend application
NEXTAUTH_URL=http://localhost:3000
# Auth.js session secret (generate with: openssl rand -base64 32)
NEXTAUTH_SECRET=your-nextauth-secret-here
# OIDC client ID from your identity provider
OIDC_CLIENT_ID=your-oidc-client-id-here
# OIDC client secret from your identity provider
OIDC_CLIENT_SECRET=your-oidc-client-secret-here
# OIDC issuer URL for the frontend (authentik provider URL)
OIDC_ISSUER=your-oidc-issuer-url-here
# Internal URL to the backend API service.
# ONLY used when running the frontend OUTSIDE Docker (e.g. `./dev.sh frontend`).
# When running via docker compose, the frontend container ignores this and always
# proxies to the in-network `api:8080` service (set in docker-compose.yml), so a
# `localhost` value here will NOT affect the Docker stack.
API_BASE_URL=http://localhost:8080
# ============================================
# Local OAuth Provider (Development Only)
# ============================================
# These are consumed ONLY by docker-compose.dev-auth.yml, which spins up a
# self-contained authentik instance preconfigured with a demo user and OIDC app.
# All values have safe defaults baked into the overlay — override only if needed.
# ⚠️ Never enable the dev-auth overlay in production. It ships well-known
# credentials (demo / demo12345) via a committed blueprint.
#
# See the "Local OAuth (Authentik)" section in README.md for setup.
# authentik server image tag (pin to a specific release)
# AUTHENTIK_TAG=2025.8
# Secret key for the local authentik instance (dev value is fine)
# Generate a stronger one with: openssl rand -base64 60
# AUTHENTIK_SECRET_KEY=dev-only-insecure-authentik-secret-key-change-me
# Password for the bootstrapped authentik admin (akadmin)
# AUTHENTIK_BOOTSTRAP_PASSWORD=admin12345
# Password for authentik's own PostgreSQL database
# AUTHENTIK_DB_PASSWORD=authentik-dev