ghostpost/.env.production.example at master · peterrauscher/ghostpost · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
# Production environment for docker-compose.prod.yml on the ghostpost VM.
# This file is the ALLOWLIST: scripts/deploy-htpc.sh ships only these keys
# from ~/.config/ghostpost/production.env to /opt/ghostpost/.env.production.
# Never put real values in this file.
#
# [USER]      you provide it (dashboard)
# [GENERATED] scripts/generate-production-secrets.sh creates it
# [FIXED]     same for every deploy; generated with these defaults

# --- Postgres ---------------------------------------------------------------
POSTGRES_SUPERUSER_PASSWORD=            # [GENERATED]
POSTGRES_MIGRATOR_PASSWORD=             # [GENERATED]
POSTGRES_APP_PASSWORD=                  # [GENERATED]

# --- WorkOS (production environment) ---------------------------------------
WORKOS_API_KEY=                         # [USER] Dashboard > API Keys > secret key
WORKOS_CLIENT_ID=                       # [USER] Dashboard > API Keys > Client ID (client_...)
WORKOS_WEBHOOK_SECRET=                  # [USER] Dashboard > Webhooks > endpoint signing secret
WORKOS_COOKIE_PASSWORD=                 # [GENERATED] >= 32 chars
APP_SESSION_KEYS=                       # [GENERATED] [{"id":"...","secret":"<base64 32 bytes>"}]

# --- Archive storage: Cloudflare R2 bucket ghostpost-archives --------------
R2_ACCOUNT_ID=                          # [USER] Cloudflare account id
R2_ARCHIVE_ACCESS_KEY_ID=               # [USER] R2 token scoped to ghostpost-archives (Object Read & Write)
R2_ARCHIVE_SECRET_ACCESS_KEY=           # [USER]
ARCHIVE_FINGERPRINT_KEYS=               # [GENERATED] [{"version":1,"secret":"<base64 32 bytes>"}]

# --- Scan provider ----------------------------------------------------------
SCAN_LLM_PROVIDER=jev                   # [FIXED]
TYPESAFE_API_KEY=                       # [USER]
SCAN_BATCH_HMAC_KEYS=                   # [GENERATED] [{"id":"...","secret":"<base64 32 bytes>"}]

# --- Edge ---------------------------------------------------------------------
CLOUDFLARE_TUNNEL_TOKEN=                # [USER] Zero Trust > Networks > Tunnels > ghostpost

# --- Backups: Cloudflare R2 bucket ghostpost-backups ------------------------
R2_BACKUP_ACCESS_KEY_ID=                # [USER] R2 token scoped to ghostpost-backups only
R2_BACKUP_SECRET_ACCESS_KEY=            # [USER]
BACKUP_AGE_RECIPIENT=                   # [GENERATED] age public key; private key stays on the laptop