mirror of
https://github.com/warmbly/warmbly.git
synced 2026-08-19 16:01:16 +00:00
Matthew Meszaros
125 lines
4.6 KiB
Plaintext
125 lines
4.6 KiB
Plaintext
# ============================================
|
|
# Warmbly Environment Variables Reference
|
|
# ============================================
|
|
# This file documents all environment variables.
|
|
#
|
|
# Configuration Priority Order:
|
|
# 1. Environment variables (direct)
|
|
# 2. AWS SSM/Secrets Manager (if AWS_CONFIG_ENABLED=true)
|
|
#
|
|
# In production with Kubernetes:
|
|
# - ConfigMaps provide non-sensitive env vars
|
|
# - External Secrets Operator syncs secrets from AWS
|
|
# ============================================
|
|
|
|
# === General ===
|
|
APP_ENV=dev # dev | prod
|
|
AWS_CONFIG_ENABLED=false # Set to "true" to enable AWS SSM/Secrets fallback
|
|
|
|
# === AWS (only needed when AWS_CONFIG_ENABLED=true or using AWS services) ===
|
|
AWS_REGION=us-east-1
|
|
AWS_ACCESS_KEY_ID= # Only for local dev
|
|
AWS_SECRET_ACCESS_KEY= # Only for local dev
|
|
|
|
# === Database ===
|
|
PRIMARY_DB=postgres://user:pass@localhost:5432/warmbly_dev
|
|
REDIS=redis://localhost:6379
|
|
|
|
# === Cassandra/Astra ===
|
|
ASTRA_DB_ID=your-db-id
|
|
ASTRA_DB_REGION=us-east-1
|
|
ASTRA_KEYSPACE_NAME=warmbly
|
|
ASTRA_APPLICATION_TOKEN=your-token
|
|
|
|
# === Kafka ===
|
|
KAFKA_BOOTSTRAP_SERVERS=localhost:9092
|
|
KAFKA_SASL_USERNAME= # Optional - leave empty for local dev
|
|
KAFKA_SASL_PASSWORD= # Optional - leave empty for local dev
|
|
KAFKA_CONSUMER_GROUP=consumer-group
|
|
KAFKA_TRACKING_TOPIC=tracking-events
|
|
|
|
# === Schema Registry ===
|
|
SCHEMA_REGISTRY_URL=http://localhost:8081
|
|
SCHEMA_REGISTRY_KEY= # Optional - leave empty for local dev
|
|
SCHEMA_REGISTRY_SECRET= # Optional - leave empty for local dev
|
|
|
|
# === Backend API ===
|
|
API_HOST=0.0.0.0:8080
|
|
API_PORT=8080
|
|
GIN_MODE=debug # debug | release
|
|
WEBSOCKET_URL=ws://localhost:4000/socket
|
|
GEODB_PATH=/path/to/GeoLite2-City.mmdb
|
|
|
|
# === Auth ===
|
|
AUTH_SECRET=your-auth-secret-minimum-32-characters
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
GOOGLE_REDIRECT_URI=http://localhost:3000/auth/google/callback
|
|
APPLE_APP_ID=
|
|
APPLE_TEAM_ID=
|
|
APPLE_KEY_ID=
|
|
APPLE_KEY_SECRET=
|
|
TURNSTILE_SECRET=
|
|
|
|
# Passkeys (WebAuthn). Optional — derived from APP_URL / CORS_ALLOW_ORIGINS
|
|
# when unset (localhost in dev). Override for self-hosting. Changing the RP
|
|
# ID invalidates every enrolled passkey, so keep it stable per deployment.
|
|
# WEBAUTHN_RP_ID=app.warmbly.com
|
|
# WEBAUTHN_RP_ORIGINS=https://app.warmbly.com
|
|
# WEBAUTHN_RP_DISPLAY_NAME=Warmbly
|
|
|
|
# === Stripe ===
|
|
STRIPE_SECRET_KEY=sk_test_...
|
|
STRIPE_WEBHOOK_SECRET=whsec_...
|
|
STRIPE_PUBLISHABLE_KEY=pk_test_...
|
|
|
|
# === Email ===
|
|
EMAIL_NAME=Warmbly
|
|
EMAIL_ADDRESS=notifications@warmbly.com
|
|
TRACKING_DOMAIN=track.warmbly.com
|
|
|
|
# === Tracking Service ===
|
|
TRACKING_HOST=0.0.0.0
|
|
TRACKING_PORT=3000
|
|
# Click-ticket resolution (REQUIRED, tracking service): emails carry only an
|
|
# opaque /c/<id> ticket; the service resolves destinations via the backend
|
|
# internal API. Same INTERNAL_API_TOKEN as the workers use.
|
|
BACKEND_INTERNAL_URL=http://backend:8080
|
|
# Per-source request budget for the tracking endpoints (default 300/min)
|
|
TRACKING_RATE_LIMIT_PER_MIN=300
|
|
|
|
# === Realtime Service (Elixir/Phoenix) ===
|
|
PHX_HOST=localhost
|
|
PORT=4000
|
|
JWT_SECRET=your-64-char-minimum-jwt-secret-for-websocket-authentication
|
|
SECRET_KEY_BASE=your-64-char-minimum-phoenix-secret-key-base
|
|
DATABASE_URL=postgres://user:pass@localhost:5432/warmbly_dev
|
|
DATABASE_POOL_SIZE=10
|
|
REDIS_URL=redis://localhost:6379
|
|
# Realtime transport switch. Read IDENTICALLY by the Go backend, the Go consumer,
|
|
# AND the Elixir realtime service, so the three can never split-brain (publisher
|
|
# on Pub/Sub while the subscriber listens on Redis = every realtime event silently
|
|
# dropped). false (default) => Redis bridge over REDIS_URL, works out of the box.
|
|
# true => Google Pub/Sub: ALSO set GCP_PROJECT_ID + GOOGLE_APPLICATION_CREDENTIALS_JSON
|
|
# below, on every service. Never set this true on one side only.
|
|
PUBSUB_ENABLED=false
|
|
CHECK_ORIGIN=false
|
|
MAX_CONNECTIONS_PER_USER=10
|
|
MAX_CONNECTIONS_PER_IP=50
|
|
MAX_CONNECTIONS_GLOBAL=100000
|
|
RATE_LIMIT_WS_MESSAGE=120
|
|
RATE_LIMIT_WS_JOIN=30
|
|
RATE_LIMIT_WS_EVENT=60
|
|
|
|
# === GCP (required when PUBSUB_ENABLED=true; leave blank for the Redis bridge) ===
|
|
# When PUBSUB_ENABLED=true the backend/consumer auto-provision the realtime topics
|
|
# and their "<topic>-sub" pull subscriptions on boot, so no manual gcloud step is
|
|
# needed. The service account needs roles/pubsub.editor (create topics + subs).
|
|
GCP_PROJECT_ID= # required when PUBSUB_ENABLED=true
|
|
GOOGLE_APPLICATION_CREDENTIALS_JSON= # JSON string - GCP auth (Go client + Elixir Goth)
|
|
|
|
# === Observability ===
|
|
SENTRY_DSN= # Optional
|
|
SENTRY_DSN_API= # Optional - separate DSN for API
|
|
LOG_DISCORD_WEBHOOK_URL= # Optional
|