mirror of
https://github.com/warmbly/warmbly.git
synced 2026-09-12 16:04:25 +00:00
87 lines
3.8 KiB
Bash
87 lines
3.8 KiB
Bash
# The control plane: backend, consumer, realtime, tracking, forms, web, admin.
|
|
#
|
|
# One region on a container host, with the database, the root key and the
|
|
# object store in the cloud region next to it. Every value here is also what a
|
|
# joining node inherits, which is why the addresses have to be ones another
|
|
# machine can reach: `warmbly join` renders a node's configuration from this
|
|
# environment, and 127.0.0.1 does not resolve to your control plane from a VPS.
|
|
|
|
APP_ENV=prod
|
|
DEPLOYMENT_MODE=self_hosted
|
|
|
|
# --- data -------------------------------------------------------------------
|
|
# Reached across the internet, so TLS is verified rather than merely offered.
|
|
# RDS chains to a root in no public trust store, so verification needs AWS's
|
|
# bundle, which the backend and consumer images ship at the path below.
|
|
PRIMARY_DB=postgres://warmbly:<password>@db.us-east-1.rds.amazonaws.com:5432/warmbly?sslmode=verify-full&sslrootcert=/etc/ssl/rds/global-bundle.pem
|
|
REDIS=rediss://:<password>@bus.example.com:6380
|
|
|
|
# --- event bus --------------------------------------------------------------
|
|
EVENTBUS_PROVIDER=nats
|
|
NATS_URL=tls://<token>@bus.example.com:4222
|
|
# json is required wherever workers are exercised: the worker command and
|
|
# result envelopes carry bodies Avro cannot serialize.
|
|
CODEC_PROVIDER=json
|
|
|
|
# --- encryption -------------------------------------------------------------
|
|
# Nodes are handed KMS_PROVIDER=brokered instead of this, so no machine in the
|
|
# fleet needs an AWS credential of its own.
|
|
KMS_PROVIDER=aws
|
|
KMS_AWS_KEY_ID=alias/warmbly
|
|
AWS_REGION=eu-central-1
|
|
AWS_ACCESS_KEY_ID=
|
|
AWS_SECRET_ACCESS_KEY=
|
|
|
|
# Back these two up before storing a single mailbox. Losing either is
|
|
# unrecoverable, and a database backup without them cannot be decrypted.
|
|
AUTH_SECRET=
|
|
CREDENTIALS_ENCRYPTION_KEY=
|
|
INTERNAL_API_TOKEN=
|
|
SECRET_KEY_BASE=
|
|
|
|
# The credential for the two routes that open a sealed key and sign a blob
|
|
# operation. Falls back to INTERNAL_API_TOKEN when unset; set it to its own
|
|
# value here, because the tracking and forms services are internet-facing and
|
|
# carry the shared one. Nodes receive this, the edge services do not.
|
|
NODE_BROKER_TOKEN=
|
|
|
|
# --- storage ----------------------------------------------------------------
|
|
# s3, not filesystem: a worker on another machine reads the message body the
|
|
# backend wrote, and it does not have your disk.
|
|
BLOB_PROVIDER=s3
|
|
BLOB_BUCKET=warmbly-blobs-<suffix>
|
|
BLOB_PUBLIC_BASE_URL=https://api.example.com/public
|
|
|
|
# --- addresses --------------------------------------------------------------
|
|
API_PUBLIC_URL=https://api.example.com
|
|
# What a node is told to call back on. It must be reachable from every machine
|
|
# in the fleet, not just from inside the container network.
|
|
ENCRYPTED_KEYS_BACKEND_URL=https://api.example.com
|
|
APP_URL=https://app.example.com
|
|
CORS_ALLOW_ORIGINS=https://app.example.com,https://admin.example.com
|
|
WEBSOCKET_URL=wss://rt.example.com/socket/websocket
|
|
PHX_HOST=rt.example.com
|
|
TRACKING_DOMAIN=track.example.com
|
|
FORMS_DOMAIN=forms.example.com
|
|
# The CIDRs your container host's proxy sends from. Without it every request
|
|
# looks like it came from the proxy and per-IP rate limiting protects nothing.
|
|
TRUSTED_PROXIES=
|
|
|
|
# --- platform mail ----------------------------------------------------------
|
|
# Login codes, invitations, resets and digests. NOT campaign mail, which goes
|
|
# out through the mailboxes your customers connect.
|
|
#
|
|
# SES needs a verified domain identity with published DKIM records, and
|
|
# production access: a sandboxed account only delivers to verified addresses.
|
|
# The consumer sends notification digests through the same transport, so it
|
|
# needs ses:SendEmail as well.
|
|
MAIL_TRANSPORT=ses
|
|
EMAIL_ADDRESS=noreply@example.com
|
|
EMAIL_NAME=Warmbly
|
|
|
|
# --- mailbox OAuth clients --------------------------------------------------
|
|
BOX_GOOGLE_CLIENT_ID=
|
|
BOX_GOOGLE_CLIENT_SECRET=
|
|
BOX_OUTLOOK_CLIENT_ID=
|
|
BOX_OUTLOOK_CLIENT_SECRET=
|