openvibers/openvibe.coupons .env.example
.env.example
| 1 | # ═══════════════════════════════════════════════════════════════ |
| 2 | # openvibe.coupons — environment configuration (names only; never commit values) |
| 3 | # Copy to .env for development. Production: /etc/openvibe/coupons.env (0600). |
| 4 | # ═══════════════════════════════════════════════════════════════ |
| 5 | |
| 6 | # Server |
| 7 | PORT=4850 |
| 8 | HOST=127.0.0.1 |
| 9 | NODE_ENV=development |
| 10 | # Public origin: canonical URLs, feeds, sitemaps and JSON-LD are built from it |
| 11 | BASE_URL=http://localhost:4850 |
| 12 | # Proxy hops that set X-Forwarded-For (Cloudflare → nginx → Node = 2). Per-IP rate limits use it. |
| 13 | TRUST_PROXY=2 |
| 14 | |
| 15 | # PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh coupons: the runtime role through PgBouncer, |
| 16 | # the owner on a direct connection (boot migrations), and Valkey (shared limit counters). |
| 17 | # Without DATABASE_URL, development uses an embedded PGlite database in data/pglite. |
| 18 | # COUPONS_PGLITE_DIR (tests only) puts that embedded database in a directory of its own. |
| 19 | DATABASE_URL= |
| 20 | DATABASE_DIRECT_URL= |
| 21 | VALKEY_URL= |
| 22 | VALKEY_PREFIX= |
| 23 | |
| 24 | # OpenVibe.Network — SSO (OAuth2), JWKS, client-credentials tokens |
| 25 | OV_NETWORK_URL=https://openvibe.network |
| 26 | OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000 |
| 27 | # OAuth client `coupons` (redirect https://openvibe.coupons/auth/callback). The same client is the |
| 28 | # service principal svc:coupons for client-credentials grants (see README, "Grants"). |
| 29 | OV_OAUTH_CLIENT_ID=coupons |
| 30 | OV_OAUTH_CLIENT_SECRET= |
| 31 | # Production: https://openvibe.coupons/auth/callback (default: BASE_URL + /auth/callback) |
| 32 | #OV_OAUTH_REDIRECT_URI= |
| 33 | # Cookies: Secure by default in production; set false for plain-http local development |
| 34 | #COOKIE_SECURE=false |
| 35 | # Signs the form tokens (CSRF). Unset: random per process. |
| 36 | #COUPONS_FORM_SECRET= |
| 37 | # Keys the reporter column (HMAC of the person). Set it in production; changing it restarts |
| 38 | # same-day deduplication. Unset: a development key (and /api/ready says so). |
| 39 | #COUPONS_REPORTER_KEY_SECRET= |
| 40 | |
| 41 | # Staff (review, moderation): staff with staff.editorial.manage (Network admins), plus these subjects |
| 42 | # (usr_…, comma-separated; a product role, and the break-glass way in) |
| 43 | #COUPONS_STAFF_SUBJECTS= |
| 44 | |
| 45 | # Browser helper: extension origins allowed by CORS on the two lookup routes only. |
| 46 | # Exact origins (chrome-extension://<id>) or the literal moz-extension://* (Firefox install origins |
| 47 | # are random). Empty: no CORS; the helper still works through its host permission. |
| 48 | #COUPONS_EXTENSION_ORIGINS= |
| 49 | # Extension install tokens expire after this many days |
| 50 | #COUPONS_INSTALL_TTL_DAYS=365 |
| 51 | |
| 52 | # Rate limits |
| 53 | #COUPONS_LOOKUP_ANON_PER_MIN=30 |
| 54 | #COUPONS_LOOKUP_TOKEN_PER_MIN=120 |
| 55 | #COUPONS_LOOKUP_SERVICE_PER_MIN=600 |
| 56 | #COUPONS_REPORTS_PER_HOUR=20 |
| 57 | #COUPONS_REPORTS_PER_DAY=60 |
| 58 | #COUPONS_SUBMISSIONS_PER_HOUR=10 |
| 59 | #COUPONS_SUBMISSIONS_PER_DAY=30 |
| 60 | #COUPONS_INSTALLS_PER_SUBJECT=10 |
| 61 | # Per-actor limits (server/http/actor-limits.js): API reads one caller (a person, with every browser |
| 62 | # helper they connected together, a service or app acting as itself, else an address) may make per |
| 63 | # minute and per hour; past them 429 rate_limited with Retry-After. Writes have their own numbers (README). |
| 64 | #COUPONS_LIMITS_MINUTE=120 |
| 65 | #COUPONS_LIMITS_HOUR=3000 |
| 66 | |
| 67 | # OpenVibe.Sources — import the `coupons` category (runs when this and OV_OAUTH_CLIENT_SECRET are set) |
| 68 | #OV_SOURCES_INTERNAL_URL=http://127.0.0.1:4720 |
| 69 | # Only these source keys (comma-separated); empty: every coupons source. Others are held as not_selected. |
| 70 | #COUPONS_SOURCES_KEYS=staff-coupon-codes |
| 71 | #COUPONS_SOURCES_INTERVAL_MS=600000 |
| 72 | # true: imported codes are listed without staff review (still status unknown) |
| 73 | #COUPONS_SOURCES_AUTO_PUBLISH=false |
| 74 | |
| 75 | # OpenVibe.Events — the outbox relay runs only when EVENTS_URL and OV_OAUTH_CLIENT_SECRET are set |
| 76 | #EVENTS_URL=http://127.0.0.1:4300 |
| 77 | # Signs the /internal/events delivery (32+ characters); leave unset until the relay reads it |
| 78 | #COUPONS_EVENTS_SECRET= |
| 79 | #EVENTS_RELAY_INTERVAL_MS=2000 |
| 80 | |
| 81 | # Expiry / confidence-decay sweep (in-process); off: COUPONS_WORKER=off |
| 82 | #COUPONS_WORKER=on |
| 83 | #COUPONS_SWEEP_INTERVAL_MS=60000 |
| 84 | |
| 85 | # IndexNow: key file served at /<key>.txt; a publish/update/removal pings api.indexnow.org. |
| 86 | # Unset: off — no key file, no requests. Under a restore drill leave it unset/empty. |
| 87 | #INDEXNOW_KEY= |
| 88 | |
| 89 | # release.json (openvibe-shared/release): the deployed commit when git is not available |
| 90 | #RELEASE_COMMIT= |
| 91 | #MIN_CLIENT_RELEASE= |
| 92 |