.env.example

# ── REQUIRED ──────────────────────────────────────────────────────────────────
# Set these in your deployment platform. That's it — nothing else is needed.

DB_USER=
DB_PASSWORD=
DB_NAME=

JOB_SECRET_KEY=        # openssl rand -hex 32  (Fernet key for stored tokens)
AUTH_SECRET=           # openssl rand -hex 32  (JWT signing secret)

NEXT_PUBLIC_API_BASE=  # e.g. https://api.yourdomain.com

# REDIS_PASSWORD: issue #191/S3 -- auths the webhook ingestion queue (Redis
# Streams). apps/api/entrypoint.sh and apps/worker/entrypoint.sh (issue #191/S4 --
# the event consumer reading that queue) both build REDIS_URL from this at container
# start (same pattern as DB_USER/DB_PASSWORD/DB_NAME -> DATABASE_URL below). No safe
# default: without it the redis service won't start (--requirepass) and neither the
# webhook receiver nor the worker's consumer has a queue to reach. Generate with:
# openssl rand -hex 32
REDIS_PASSWORD=

# ── DEPLOY-TIME CONFIG (optional, safe defaults in code) ──────────────────────
# Set per environment/install. Omit to use the code default.
#
# CORS_ORIGINS: allowed browser origins. Must be a JSON array (double quotes).
# Defaults to ["http://localhost:3000"]; set your real UI domain in production.
CORS_ORIGINS=["http://localhost:3000"]
#
# GITHUB_API_BASE: defaults to https://api.github.com; set for GitHub Enterprise,
# e.g. https://github.yourco.com/api/v3
GITHUB_API_BASE=https://api.github.com

# ── GITHUB APP (S1 — SaaS auth; optional until the App is registered) ─────────
# From the GitHub App settings page. app_id / client_id are public; the rest are
# secrets — do not commit real values.
GITHUB_APP_ID=
GITHUB_APP_CLIENT_ID=
GITHUB_APP_CLIENT_SECRET=
GITHUB_APP_WEBHOOK_SECRET=
# Private key PEM (contents of the .pem you downloaded from GitHub).
GITHUB_APP_PRIVATE_KEY=
# Public App slug (from the App's public page URL) — powers the "Install GitHub App"
# button in the UI. Must be NEXT_PUBLIC_* so it's available to the browser bundle.
NEXT_PUBLIC_GITHUB_APP_SLUG=

# ── WORKER DB CREDENTIAL (issue #190 prerequisite; optional) ──────────────────
# When set, the worker connects to Postgres as its own "clevis_worker" role instead
# of sharing the API's DB_USER/DB_PASSWORD credential. This is a prerequisite for
# eventually enabling Postgres Row-Level Security (a future migration would grant
# clevis_worker BYPASSRLS, which must not also apply to the API's role). Only takes
# effect on a fresh `db` data volume (docker-entrypoint-initdb.d runs once); existing
# deployments must create the role manually — see docs/self-hosting.md.
WORKER_DB_PASSWORD=

# ── API DB CREDENTIAL (issue #330 prerequisite; optional) ─────────────────────
# When set, a "clevis_api" Postgres role is created (mirroring WORKER_DB_PASSWORD's
# clevis_worker role above). This is a prerequisite for the API's runtime connection
# to eventually stop using the DB_USER superuser role -- superusers unconditionally
# bypass Row-Level Security, so migrations 0030/0031's RLS policies currently
# enforce nothing in production. Setting this alone does NOT yet change which role
# the API connects as; it only creates the role and grants it privileges (see
# migration 0032). Only takes effect on a fresh `db` data volume
# (docker-entrypoint-initdb.d runs once); existing deployments must create the role
# manually — see docs/self-hosting.md.
API_DB_PASSWORD=

# ── SMTP (issue #217 — email verification; optional) ──────────────────────────
# Without these, self-registered accounts are still created successfully but stay
# unverified and can't accept org invitations until an operator sets these (or the
# user links a GitHub account instead, which verifies immediately).
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=

# ── LOCAL DEV ONLY ────────────────────────────────────────────────────────────
# DATABASE_URL is only needed when running apps/api or apps/worker outside Docker.
# Format: postgresql+psycopg://user:pass@localhost:5432/db
DATABASE_URL=
#
# REDIS_URL is only needed when running apps/api outside Docker (inside Docker,
# entrypoint.sh builds it from REDIS_PASSWORD above). Format for a local Redis with
# no password: redis://localhost:6379/0 (add :password@ before the host if yours has one).
REDIS_URL=

# ── CONFIGURED VIA SETTINGS PAGE (not env vars) ───────────────────────────────
# Lives in the app_config DB table and can be changed in the Settings page
# (owner only) without redeploying. Default value is seeded by the migration.
#
#   worker_poll_seconds   default: 5