-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
179 lines (147 loc) · 5.12 KB
/
Copy path.env.example
File metadata and controls
179 lines (147 loc) · 5.12 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
# FrontFuse Backend Environment Variables
# Copy this file to .env and fill in your actual values
# Server Configuration
NODE_ENV=
PORT=
# JWT Authentication
JWT_SECRET=
# Database Configuration - Uses FuzeInfra shared PostgreSQL
DB_HOST=
DB_PORT=
DB_NAME=
DB_USER=
DB_PASSWORD=
# PostgreSQL Configuration (Production)
USE_POSTGRES=
# Frontend Configuration
FRONTEND_URL=
# Authentik Configuration - Uses shared FuzeInfra PostgreSQL and Redis
AUTHENTIK_DB_NAME=
AUTHENTIK_SECRET_KEY=
AUTHENTIK_COOKIE_DOMAIN=
AUTHENTIK_PORT=
AUTHENTIK_SSL_PORT=
AUTHENTIK_CLIENT_ID=
AUTHENTIK_CLIENT_SECRET=
AUTHENTIK_ISSUER_URL=
AUTHENTIK_REDIRECT_URI=
AUTHENTIK_BOOTSTRAP_PASSWORD=
AUTHENTIK_BOOTSTRAP_TOKEN=
AUTHENTIK_BOOTSTRAP_EMAIL=
# Google OAuth2 — Sign in with Google via Authentik
# Create credentials at https://console.cloud.google.com/apis/credentials
# App type: Web application
# Authorized redirect URIs:
# Production: https://auth.fuzefront.com/source/oauth/callback/google/
# Dev tunnel: https://auth-dev.fuzefront.com/source/oauth/callback/google/
#
# IMPORTANT: Google rejects .dev.local and other non-public TLDs as redirect URIs.
# Production credentials (used in k8s via SealedSecret, sealed into fuzefront-secrets.yaml):
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
# Dev tunnel Google OAuth credentials — SEPARATE client from production.
# Used by docker-compose.e2e.yml and docker-compose.tunnel.yml.
# Create a second "Web application" client in Google Console and register:
# https://auth-dev.fuzefront.com/source/oauth/callback/google/
GOOGLE_DEV_CLIENT_ID=
GOOGLE_DEV_CLIENT_SECRET=
# Cloudflare tunnel — exposes local/CI Authentik at a real public domain.
# One-time setup:
# cloudflared tunnel login
# cloudflared tunnel create fuzefront-dev
# cloudflared tunnel route dns fuzefront-dev auth-dev.fuzefront.com
# cloudflared tunnel token fuzefront-dev → paste below
# The tunnel routes auth-dev.fuzefront.com → http://authentik-server:9000
CLOUDFLARE_TUNNEL_TOKEN=
TUNNEL_HOSTNAME=auth-dev.fuzefront.com
# Test Google account for E2E tests (GOOGLE_TEST_EMAIL must have NO 2FA).
# Used by frontend/tests/google-oauth-e2e.spec.ts and the google-oauth-e2e.yml CI job.
GOOGLE_TEST_EMAIL=
GOOGLE_TEST_PASSWORD=
# Authentik OIDC client secret for the E2E stack (docker-compose.e2e.yml).
# Must match the AUTHENTIK_OIDC_CLIENT_SECRET set on the Authentik worker.
# Default: e2e-oidc-client-secret (fine for non-prod E2E; set a real value in CI secrets).
AUTHENTIK_OIDC_CLIENT_SECRET=
# Permit.io Configuration
PERMIT_API_KEY=
PERMIT_PDP_URL=
PERMIT_DEBUG=
PERMIT_OFFLINE_MODE=
PERMIT_SYNC_INTERVAL=
# Permit.io PDP Configuration (Container)
PERMIT_PDP_PORT=
# NOTE: Permit.io PDP bundles OPA+OPAL internally
# No separate OPAL containers needed
# External Services (Optional)
SLACK_WEBHOOK_URL=
DISCORD_WEBHOOK_URL=
# Container Registry (for production deployment)
DOCKER_REGISTRY=
DOCKER_USERNAME=
DOCKER_PASSWORD=
# NPM Publishing
NPM_TOKEN=
# Security Tool API Keys
SNYK_TOKEN=
TRIVY_TOKEN=
TRUFFLEHOG_TOKEN=
# Monitoring & Alerting
SECURITY_WEBHOOK_URL=
SENTRY_DSN=
# Production Database (when moving away from SQLite)
PROD_DATABASE_URL=
REDIS_URL=
# Stytch Configuration (when ready)
STYTCH_PROJECT_ID=
STYTCH_SECRET=
# Legacy Permit.io Configuration
PERMIT_IO_PDP_URL_LEGACY=
# Session Configuration
SESSION_SECRET=
SESSION_MAX_AGE=
# WebSocket Configuration
WEBSOCKET_CORS_ORIGIN=
# PostgreSQL (from FuzeInfra)
POSTGRES_USER=
POSTGRES_PASSWORD=
POSTGRES_DB=
# Redis (from FuzeInfra)
# Used by: Authentik, general caching, sessions
# No additional Redis configuration needed
# ================================
# SECURITY NOTES
# ================================
# PRODUCTION REQUIREMENTS:
# 1. Generate strong random secrets for all *_SECRET_KEY variables
# 2. Use proper database credentials with limited privileges
# 3. Configure proper CORS origins
# 4. Set NODE_ENV=production
# 5. Use HTTPS in production (set AUTHENTIK_SSL_PORT)
# 6. Obtain real Permit.io API key from https://app.permit.io
# 7. Set PERMIT_DEBUG=False in production for performance
# AUTHENTIK SECURITY:
# - AUTHENTIK_SECRET_KEY should be at least 32 characters
# - Change default database credentials in production
# - Configure proper cookie domain for your domain
# - Review Authentik security settings in admin interface
# PERMIT.IO SECURITY:
# - Keep PERMIT_API_KEY secure and rotate regularly
# - Use environment-specific API keys
# - Enable offline mode in production for resilience
# - Monitor PDP performance and scaling needs
# Authentik Database Configuration (PostgreSQL)
PG_PASS=
PG_USER=
PG_DB=
# Additional PostgreSQL settings for Authentik
POSTGRES_USER=
POSTGRES_PASSWORD=
POSTGRES_DB=
# Billing-service — one-time payment-mode checkout (POST /payments/checkout)
# Consumer products allowed to create payment-mode Checkout Sessions.
# Comma-separated; empty/unset keeps the payment path DISABLED (fail closed).
BILLING_PRODUCT_KEYS=mendys-datasets
# Accepted ISO 4217 currencies (comma-separated, case-insensitive). Default: usd,eur
BILLING_PAYMENT_CURRENCIES=usd,eur
# Upper bound (cents) for each line total AND the order total. Default: 5000000
BILLING_PAYMENT_MAX_TOTAL_CENTS=5000000