openvibers/openvibe.blog .env.example
.env.example
| 1 | # ═══════════════════════════════════════════════════════════════ |
| 2 | # openvibe.blog — environment configuration (names only; never commit values) |
| 3 | # Copy to .env for development. Production: /etc/openvibe/blog.env (0600). |
| 4 | # ═══════════════════════════════════════════════════════════════ |
| 5 | |
| 6 | # Server |
| 7 | PORT=4810 |
| 8 | HOST=127.0.0.1 |
| 9 | NODE_ENV=development |
| 10 | # Public origin: canonical URLs, feeds, sitemaps and JSON-LD are built from it |
| 11 | BASE_URL=http://localhost:4810 |
| 12 | # Proxy hops that set X-Forwarded-For (Cloudflare → nginx → Node = 2) |
| 13 | TRUST_PROXY=2 |
| 14 | # Per-actor limits (server/http/actor-limits.js): API reads one caller (a person, a service or app |
| 15 | # acting as itself, else an address) may make per minute and per hour; past them 429 rate_limited with |
| 16 | # Retry-After. Writes have their own numbers (README). The per-address limits stay. |
| 17 | #BLOG_LIMITS_MINUTE=120 |
| 18 | #BLOG_LIMITS_HOUR=3000 |
| 19 | |
| 20 | # PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh blog: the runtime role through PgBouncer, |
| 21 | # the owner on a direct connection (migrations), and Valkey (shared limit counters). |
| 22 | # Without DATABASE_URL, development uses an embedded PGlite database in data/pglite (BLOG_PGLITE_DIR overrides it). |
| 23 | DATABASE_URL= |
| 24 | DATABASE_DIRECT_URL= |
| 25 | VALKEY_URL= |
| 26 | VALKEY_PREFIX= |
| 27 | |
| 28 | # OpenVibe.Network — SSO (OAuth2), JWKS, client-credentials tokens |
| 29 | OV_NETWORK_URL=https://openvibe.network |
| 30 | OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000 |
| 31 | # OAuth client `blog` (redirect https://openvibe.blog/auth/callback). The same client is Blog's |
| 32 | # service principal svc:blog for client-credentials grants (see README, "Grants"). |
| 33 | OV_OAUTH_CLIENT_ID=blog |
| 34 | OV_OAUTH_CLIENT_SECRET= |
| 35 | # Production: https://openvibe.blog/auth/callback (default: BASE_URL + /auth/callback) |
| 36 | #OV_OAUTH_REDIRECT_URI= |
| 37 | # Cookies: Secure by default in production; set false for plain-http local development |
| 38 | #COOKIE_SECURE=false |
| 39 | # Signs the editor/comment form tokens (CSRF). Unset: random per process. |
| 40 | #BLOG_FORM_SECRET= |
| 41 | |
| 42 | # The official blog (served at /): owners are Network subjects (usr_…), comma-separated |
| 43 | BLOG_OFFICIAL_OWNERS= |
| 44 | #BLOG_OFFICIAL_TITLE=The OpenVibe blog |
| 45 | #BLOG_OFFICIAL_DESCRIPTION=News and release notes from the OpenVibe network. |
| 46 | |
| 47 | # OpenVibe.Media — attachments are Media object ids; bytes are served by Media |
| 48 | OV_MEDIA_URL=https://openvibe.media |
| 49 | OV_MEDIA_INTERNAL_URL=http://127.0.0.1:4100 |
| 50 | # Media tenant/namespace for Blog's objects (media.object.read is granted for it) |
| 51 | # optional: defaults to 'blog' |
| 52 | # BLOG_MEDIA_APP=blog |
| 53 | #BLOG_MEDIA_VERIFY_INTERVAL_MS=600000 |
| 54 | |
| 55 | # OpenVibe.Community — comment threads (referenced, never copied) |
| 56 | # optional: defaults to https://openvibe.community |
| 57 | # OV_COMMUNITY_URL=https://openvibe.community |
| 58 | OV_COMMUNITY_INTERNAL_URL=http://127.0.0.1:4200 |
| 59 | |
| 60 | # OpenVibe.Events — the outbox relay runs only when EVENTS_URL and OV_OAUTH_CLIENT_SECRET are set |
| 61 | #EVENTS_URL=http://127.0.0.1:4300 |
| 62 | # OpenVibe.Events → Blog (ADR-033 account export and deletion): signs a delivery to POST /internal/events |
| 63 | # (comma-separated for rotation, 32+ characters each). Unset: the route answers 503 and no subscription is created. |
| 64 | #BLOG_EVENTS_SECRET= |
| 65 | #EVENTS_RELAY_INTERVAL_MS=2000 |
| 66 | |
| 67 | # Scheduled publication worker (in-process); off: BLOG_WORKER=off |
| 68 | #BLOG_WORKER=on |
| 69 | #BLOG_SCHEDULE_INTERVAL_MS=15000 |
| 70 | #BLOG_WORKER_ID= |
| 71 | |
| 72 | # Members-only posts: 'vip' (default when OV_OAUTH_CLIENT_SECRET is set) asks OpenVibe.VIP |
| 73 | # (grant vip.resource.policy.evaluate on openvibe.vip); 'none' admits only the blog's members and |
| 74 | # staff. Every doubt (VIP down, no grant, no owner) is a refusal. |
| 75 | #BLOG_ENTITLEMENTS_PROVIDER=vip |
| 76 | #OV_VIP_INTERNAL_URL=http://127.0.0.1:4620 |
| 77 | #OV_VIP_URL=https://openvibe.vip |
| 78 | #BLOG_VIP_TIMEOUT_MS=2000 |
| 79 | # A cached "yes" lives at most this long (the convergence bound after VIP stops granting) |
| 80 | #BLOG_VIP_CACHE_TTL_MS=30000 |
| 81 | #BLOG_VIP_CACHE_DENY_TTL_MS=10000 |
| 82 | #BLOG_VIP_CACHE_UNAVAILABLE_TTL_MS=2000 |
| 83 | |
| 84 | # Browser origins that may call /api/v1 with a Bearer Network JWT |
| 85 | #API_CORS_ORIGINS=https://openvibe.network,https://openvibe.live,https://openvibe.community,https://openvibe.media |
| 86 | |
| 87 | # IndexNow (openvibe-shared/indexnow): with a key, search engines are told the moment a public page |
| 88 | # appears, changes or leaves the index (the key file is served at /<key>.txt). Unset: off. |
| 89 | #INDEXNOW_KEY= |
| 90 | |
| 91 | # release.json (openvibe-shared/release): the deployed commit when git is not available |
| 92 | #RELEASE_COMMIT= |
| 93 | #MIN_CLIENT_RELEASE= |
| 94 |