Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
115 lines (97 loc) · 5.52 KB
/
Copy path.env.example
File metadata and controls
115 lines (97 loc) · 5.52 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# Copy to .env and fill in. .env is gitignored — never commit real values.
# --- PostHog product analytics (spec 2026-08-02-08) ---------------------------
# Entirely inert unless SP_POSTHOG_PROJECT_API_KEY is set.
# Client key (phc_...). Public by design — it ships to every browser.
# PostHog: Settings -> Project -> Project API key
SP_POSTHOG_PROJECT_API_KEY=
# API host. EU cloud is the default; override for US cloud, self-hosted,
# or a reverse proxy.
SP_POSTHOG_HOST=https://eu.i.posthog.com
# Optional, SECRET. Only needed if backend capture should use a distinct key;
# otherwise the project key is used. PostHog shows this once at creation and
# never again — for anything beyond local dev, keep it in Passbolt / SSM /
# the OS keyring rather than on disk.
# PostHog: Settings -> Personal API keys -> Create personal API key
SP_POSTHOG_PERSONAL_API_KEY=
# Kill switch. Defaults to true; setting false disables analytics even when a
# key is present. It does not enable anything on its own.
SP_POSTHOG_ENABLED=true
# --- Telegram alerts (spec 2026-08-10-04) ------------------------------------
# SP_TELEGRAM_BOT_TOKEN ALONE IS SUFFICIENT. Everything else below is an
# optional override: the server derives the bot @username from getMe on its
# first boot, generates a webhook secret, and persists both as system
# parameters (telegram.bot_username, telegram.webhook_secret) so later boots
# make no network call.
#
# A Telegram bot can hold exactly ONE webhook URL, so dev and prod each need
# their own bot from @BotFather. Real values belong in
# telegram_bot_solidping_{dev,prod}.priv.json (gitignored) or your secret
# store — never here.
# SECRET, and the ONLY required variable. `123456789:AA…` from @BotFather
# (/newbot, or /token for an existing bot). Never logged, never returned by
# any API.
SP_TELEGRAM_BOT_TOKEN=
# Tri-state kill switch. LEAVE IT COMMENTED OUT — unset means auto: on iff a
# bot token is present, which is what you want. Set it to false to force the
# feature off whatever else is configured, or true to be explicit (it still
# needs a token). A bare `SP_TELEGRAM_ENABLED=` is treated as unset, not false.
#SP_TELEGRAM_ENABLED=
# OPTIONAL override. The bot's @username without the '@'. Derived from getMe
# and persisted on first boot; set it only to skip that call, or when running
# declarative/GitOps config.
SP_TELEGRAM_BOT_USERNAME=
# OPTIONAL override. SECRET, >= 32 random bytes (`openssl rand -hex 32`).
# Generated and persisted automatically when unset. Telegram does not sign its
# webhook payloads, so this shared secret is the ONLY authenticity gate on a
# public endpoint that creates paging contacts — set it by hand only when
# something else must know it too (e.g. a proxy in front of the webhook).
SP_TELEGRAM_WEBHOOK_SECRET=
# Overrides https://api.telegram.org. For an egress proxy or a test fake.
SP_TELEGRAM_BASE_URL=
# Per-org hourly runaway guard (default 60). Telegram messages are free, so
# there is deliberately no monthly quota — this only bounds a flapping check
# or a broken dispatch loop.
SP_ENTITLEMENTS_TELEGRAM_RUNAWAY_PER_HOUR=
# ---------------------------------------------------------------------------
# File storage (org logos, status-page assets, incident screenshots)
# ---------------------------------------------------------------------------
# Two backends: "local" (default) and "s3". Blobs are addressed by the scheme
# recorded at write time, so switching backends is backward compatible —
# existing file:// blobs keep resolving through the local backend after you
# move new writes to S3.
#
# WARNING for containers: "local" writes to SP_FILESTORAGE_LOCAL_ROOT
# (default ./data/files). If that path is not a mounted volume, every upload
# lives on the container's ephemeral layer and is destroyed by the next
# restart — silently, with no error until something reads the blob back. Either
# mount a volume there or use the S3 backend.
SP_FILESTORAGE_TYPE=local
SP_FILESTORAGE_LOCAL_ROOT=./data/files
# --- S3 backend (SP_FILESTORAGE_TYPE=s3) -------------------------------------
# Bucket is required. Region is required by the SDK even for stores that ignore
# it. Prefix is optional and lets several deployments share one bucket.
SP_FILESTORAGE_S3_BUCKET=
SP_FILESTORAGE_S3_REGION=
SP_FILESTORAGE_S3_PREFIX=
# Leave BOTH of these empty for AWS S3: the standard AWS credential chain
# (env, IAM role, shared config) is used. Set them to pin static credentials,
# which is what any S3-compatible store needs. SECRET — never logged.
SP_FILESTORAGE_S3_ACCESS_KEY=
SP_FILESTORAGE_S3_SECRET_KEY=
# Custom endpoint. Empty = AWS S3. Set it for MinIO, Garage, Ceph/RGW, R2,
# Backblaze B2, OVH, etc. Path-style addressing is required by MinIO/Garage/Ceph
# and optional elsewhere; it never needs per-bucket DNS, so it is the safe
# choice when unsure.
# MinIO : SP_FILESTORAGE_S3_ENDPOINT=http://localhost:9000 + USE_PATH_STYLE=true
# OVH : SP_FILESTORAGE_S3_ENDPOINT=https://s3.gra.io.cloud.ovh.net (region gra)
SP_FILESTORAGE_S3_ENDPOINT=
SP_FILESTORAGE_S3_USE_PATH_STYLE=
# ---------------------------------------------------------------------------
# Frontend dev server (web/dash0)
# ---------------------------------------------------------------------------
# Extra hostnames the Vite dev server will answer for, comma-separated. Only
# needed when you reach `make dev` through a tunnel or a remote hostname rather
# than localhost — Vite rejects unknown Host headers otherwise. Empty = only
# localhost, which is what most people want.
# VITE_DEV_ALLOWED_HOSTS=app.dev.example.com
VITE_DEV_ALLOWED_HOSTS=