openvibers/openvibe.watch .env.example

.env.example

main 6.7 KB · 131 lines · plaintext

Raw HistoryBlame Repository
1# ═══════════════════════════════════════════════════════════════
2# OpenVibe.Watch — Environment Configuration
3# Copy to .env and fill in values.
4# In production this lives at /etc/openvibe/watch.env (0600); the systemd unit sets
5# NODE_ENV and PORT itself.
6# ═══════════════════════════════════════════════════════════════
7
8# Server
9PORT=4730
10HOST=127.0.0.1
11NODE_ENV=development
12#BASE_URL=https://openvibe.watch
13# The public site sits behind nginx (and Cloudflare): trust one proxy hop for the real client address.
14#TRUST_PROXY=1
15
16# Identity — OpenVibe.Network signs the tokens this service verifies. Service tokens (svc:…) carry
17# capability grants (audience openvibe.watch); a person's bearer token (usr_…) is verified for the
18# same audience and acts on the watches it owns.
19OV_NETWORK_URL=https://openvibe.network
20OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
21#OV_NETWORK_ISSUER=https://openvibe.network
22# The JWKS the service verifies tokens against; by default Network's internal JWKS
23# (OV_NETWORK_INTERNAL_URL/api/.well-known/jwks). openvibe-sdk/auth caches it and keeps it fresh.
24#OV_NETWORK_JWKS_URL=https://openvibe.network/api/.well-known/jwks
25
26# Per-actor limits (server/api/actor-limits.js): API reads one app or module (app:…, mod:…) may make per
27# minute and per hour; past them 429 rate_limited with Retry-After. First-party services (svc:…) are not
28# counted on reads; writes have their own numbers (README).
29#WATCH_LIMITS_MINUTE=120
30#WATCH_LIMITS_HOUR=3000
31
32# This service's own principal (svc:watch) — publishes watch.* events (events.event.publish) — and
33# the public site's sign-in client. Keep OV_OAUTH_CLIENT_ID=watch and set the secret in
34# /etc/openvibe/watch.env (0600): the site exchanges a person's sign-in code for a Network token with it.
35OV_OAUTH_CLIENT_ID=watch
36OV_OAUTH_CLIENT_SECRET=
37
38# The site's sign-in callback (default BASE_URL + /auth/callback; register this exact URI on the
39# Network client), and the scope and session audience a person's Network token is verified for.
40#OV_OAUTH_REDIRECT_URI=https://openvibe.watch/auth/callback
41#OV_OAUTH_SCOPE=profile
42#OV_SESSION_AUDIENCE=openvibe.network
43
44# The site's session cookie is Secure in production (https) by default; set false only in development.
45#COOKIE_SECURE=true
46
47# Store (PostgreSQL, ADR-035), written by OpenVibe.Host roles/data/add-service.sh watch: the runtime role through
48# PgBouncer, the owner on a direct connection (migrations), and Valkey (shared limit counters).
49# Without DATABASE_URL, development uses an embedded PGlite database in data/pglite.
50DATABASE_URL=
51DATABASE_DIRECT_URL=
52VALKEY_URL=
53VALKEY_PREFIX=
54
55# OpenVibe.Events. The outbox relay runs only when EVENTS_URL is set.
56#EVENTS_URL=http://127.0.0.1:4300
57#EVENTS_RELAY_INTERVAL_MS=2000
58# OpenVibe.Events → Watch (ADR-033 account export and deletion): signs a delivery to POST /internal/events
59# (comma-separated for rotation, 32+ characters each). Unset: the route answers 503 and no subscription is created.
60#WATCH_EVENTS_SECRET=
61
62# Check worker (in-process scheduler)
63#WATCH_WORKER=on
64#WATCH_TICK_MS=5000
65#WATCH_MAX_CONCURRENT=8
66#WATCH_MAX_BACKOFF_MS=21600000
67
68# Fetching (the SSRF-guarded fetcher every carrier goes through)
69#WATCH_USER_AGENT=OpenVibeWatch/0.1.0 (+https://openvibe.watch; [email protected])
70#WATCH_FETCH_TIMEOUT_MS=20000
71#WATCH_MAX_BYTES=5242880
72#WATCH_MAX_REDIRECTS=5
73# Least time between two requests to one host, whatever a watch says.
74#WATCH_HOST_MIN_INTERVAL_MS=1000
75#WATCH_ALLOWED_PORTS=80,443
76# Exact hosts/IPs allowed to resolve to private/loopback addresses. Leave EMPTY in production.
77#WATCH_ALLOW_PRIVATE_HOSTS=
78
79# Observations
80#WATCH_OBSERVATIONS_MAX_PER_CHECK=100
81#WATCH_RETENTION_DEFAULT_DAYS=90
82
83# Registry: how many watches one owner (a person, an agent or a service) may hold. The cadence floor
84# (15 minutes) is fixed in the registry.
85#WATCH_MAX_PER_OWNER=50
86
87# OpenVibe.Run — the expensive checks (browser/code), step 6. Never used until then: a run source
88# answers watch.carrier_unavailable and nothing is executed.
89#WATCH_RUN_URL=http://127.0.0.1:4920
90#WATCH_RUN_OAUTH_CLIENT_SECRET=
91
92# Source credentials: a watch's source.auth names the variable (auth.env), never the value. Names
93# must start with WATCH_CRED_. Read at fetch time, never stored, never logged.
94#WATCH_CRED_EXAMPLE_API_KEY=
95
96# Webhook keys: a webhook action signs its delivery with the variable its secret_env names. Names must
97# start with WATCH_HOOK_ and the value hold at least 32 characters.
98#WATCH_HOOK_EXAMPLE_SECRET=
99# A receiver answers within this, or the attempt is retried on the backoff.
100#WATCH_WEBHOOK_TIMEOUT_MS=10000
101# Email in (agent plan A3): a webhook watch may have an address at WATCH_MAIL_DOMAIN. Cloudflare Email Routing hands each
102# message to the mail Worker (edge/mail-worker.mjs, deployed by deploy/mail-worker.js), which posts it to /hooks/email
103# signed with this secret (at least 32 characters; the Worker's INGRESS_SECRET). Unset: no email in.
104#WATCH_MAIL_INGRESS_SECRET=
105#WATCH_MAIL_DOMAIN=openvibe.watch
106# OpenVibe.Actor's internal address, for actor-task and actor-agent actions (Watch needs actor.task.create and actor.agent.run grants).
107#WATCH_ACTOR_URL=http://127.0.0.1:4950
108
109# Who may use which named secret (server/secret-grants.js). A name is not a capability: without a grant
110# nobody can use it. A credential needs owners and the origins it may be sent to; a webhook key, owners.
111# Owners are usr_ or agt_ subjects; origins are scheme://host[:port].
112#WATCH_SECRET_GRANTS={"WATCH_CRED_EXAMPLE_API_KEY":{"owners":["usr_..."],"origins":["https://api.example.com"]},"WATCH_HOOK_EXAMPLE_SECRET":{"owners":["usr_..."]}}
113
114# Usage readings → OpenVibe.Billing (server/billing.js): one check-operation reading per completed check, relayed
115# every WATCH_BILLING_INTERVAL_MS (0, the default, is off: nothing is queued) with this service's client credentials
116# (OV_OAUTH_CLIENT_ID/OV_OAUTH_CLIENT_SECRET above; Network grants billing.usage.record). Without the URL or the
117# secret, readings are queued and stay local.
118#OV_BILLING_INTERNAL_URL=
119#OV_BILLING_AUDIENCE=
120#WATCH_BILLING_TIMEOUT_MS=
121#WATCH_BILLING_INTERVAL_MS=
122
123# Provider-rate evidence (server/provider-rates.js, plan P6). 0 (the default) is off: the module is not
124# created, no route is mounted and nothing is seeded. 1 mounts the API and the worker, but a source still
125# starts disabled until a person reads its terms/robots notes and enables it (PATCH .../sources/:key).
126#WATCH_PROVIDER_RATES=0
127#WATCH_PROVIDER_RATES_TICK_MS=60000
128#WATCH_PROVIDER_RATES_MAX_BYTES=8388608
129#WATCH_PROVIDER_RATES_POLL_SEC=21600
130#WATCH_PROVIDER_RATES_STALE_SEC=43200
131