openvibers/openvibe.services .env.example

.env.example

main 5.3 KB · 93 lines · plaintext

Raw HistoryBlame Repository
1# ═══════════════════════════════════════════════════════════════
2# openvibe.services — Environment Configuration
3# Copy to .env for development. In production this lives at /etc/openvibe/services.env (0600).
4# Names only here; never commit a value.
5# ═══════════════════════════════════════════════════════════════
6
7# Server
8PORT=4930
9HOST=127.0.0.1
10NODE_ENV=development
11BASE_URL=http://localhost:4930
12# Cloudflare and nginx sit in front in production.
13TRUST_PROXY=2
14
15# ── Data: PostgreSQL (ADR-035) ──────────────────────────────
16# Host's roles/add-service.sh writes both in production. Unset in development: an embedded PGlite
17# database in data/pglite (one process). Tests need neither.
18DATABASE_URL=
19DATABASE_DIRECT_URL=
20
21# ── Identity: OpenVibe.Network ──────────────────────────────
22OV_NETWORK_URL=https://openvibe.network
23# The origin Services asks about project membership (GET /api/v1/projects/:project, with the caller's
24# own user token) and reads the signing key from (GET /api/.well-known/jwks).
25OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
26#OV_NETWORK_ISSUER=https://openvibe.network
27# Audience Services answers for: incoming service tokens must carry it.
28SERVICES_AUDIENCE=openvibe.services
29# Services' own Network client `services`: sign-in (authorization code + PKCE, redirect
30# BASE_URL/auth/callback), the events relay, and one client-credentials token per authority audience
31# (openvibe.network, openvibe.media, …) for the index. Unset in development: nobody can sign in, events wait
32# in the outbox, and every authority that requires a token is reported partial (ADR-046 section 6).
33OV_OAUTH_CLIENT_ID=services
34OV_OAUTH_CLIENT_SECRET=
35#OV_OAUTH_REDIRECT_URI=https://openvibe.services/auth/callback
36COOKIE_SECURE=false
37# Signs the per-person form token (CSRF). Required in production; unset in development: a random key per process.
38SERVICES_FORM_SECRET=
39# Staff who set trust tiers (besides Network admins holding staff.site.configure): usr_ subjects, comma-separated.
40SERVICES_STAFF_SUBJECTS=
41
42# ── Valkey (ADR-035): per-actor limit counters; optional ────
43VALKEY_URL=
44VALKEY_PREFIX=ov:services:
45#SERVICES_LIMITS_MINUTE=120
46#SERVICES_LIMITS_HOUR=3000
47
48# ── Playgrounds and the project archive ─────────────────────
49# Playgrounds call Events and Media with the APP's own token; the defaults are the public origins in the
50# pinned contracts. The archive reads Media and Events on loopback with Network's read-only export tokens.
51#SERVICES_PLAYGROUND_EVENTS_URL=https://openvibe.events
52#SERVICES_PLAYGROUND_MEDIA_URL=https://openvibe.media
53#SERVICES_PLAYGROUND_MAX_UPLOAD_BYTES=1048576
54#SERVICES_PLAYGROUND_RUNS_PER_HOUR=60
55#SERVICES_EXPORT_MEDIA_URL=http://127.0.0.1:4100
56#SERVICES_EXPORT_EVENTS_URL=http://127.0.0.1:4300
57#SERVICES_REGISTRY_TTL_MS=30000
58
59# ── Search engines ──────────────────────────────────────────
60# IndexNow: with a key, public release changes ping the engines and /<key>.txt is served. Unset: off.
61INDEXNOW_KEY=
62
63# ── The authorities (plan T13 step 6) ───────────────────────
64# An authority is a service whose pinned openvibe-contracts manifest lists <id>.resource.read as
65# active; its loopback origin comes from that manifest. SERVICES_<ID>_URL overrides one for the
66# operator (the id uppercased, '-' -> '_'):
67#SERVICES_NETWORK_URL=http://127.0.0.1:4000
68#SERVICES_MEDIA_URL=http://127.0.0.1:4100
69#SERVICES_EVENTS_URL=http://127.0.0.1:4300
70#SERVICES_HOST_URL=http://127.0.0.1:4910
71
72# ── The resource index ──────────────────────────────────────
73# The per-authority page size the fan-out asks for, how many authorities are read at once, and how long
74# one authority may take before its rows are omitted and it is named in X-OpenVibe-Partial-Authorities.
75SERVICES_INDEX_PAGE_SIZE=100
76SERVICES_INDEX_CONCURRENCY=4
77SERVICES_INDEX_TIMEOUT_MS=5000
78# The caller-facing page size: default and ceiling.
79SERVICES_INDEX_DEFAULT_LIMIT=100
80SERVICES_INDEX_MAX_LIMIT=1000
81# How long the membership question to Network may take before the person-facing path answers 503.
82SERVICES_NETWORK_TIMEOUT_MS=5000
83
84# ── OpenVibe.Events ─────────────────────────────────────────
85# The outbox relay publishes services.app.published|deprecated|revoked and services.moderation.action with
86# Services' own service token. Without EVENTS_URL (or the OAuth secret) events wait in services_events_outbox.
87EVENTS_URL=
88#SERVICES_EVENTS_ENABLED=1
89#EVENTS_RELAY_INTERVAL_MS=2000
90# OpenVibe.Events → Services (ADR-033 account export and deletion): signs a delivery to POST /internal/events
91# (comma-separated for rotation, 32+ characters each). Unset: the route answers 503 and no subscription is created.
92#SERVICES_EVENTS_SECRET=
93