Rocky
034a3e8745
Allow one server-audited onboarding polish request without credits and make the certificate gate temporarily reversible while preserving application authentication.
86 lines
3.4 KiB
Bash
86 lines
3.4 KiB
Bash
# Copy to an untracked .env. Every secret below is a placeholder.
|
|
APP_ENV=development
|
|
PORT=8080
|
|
PUBLIC_BASE_URL=https://account.osglab.com
|
|
INVITE_BASE_URL=https://osglab.com/i
|
|
APP_STORE_URL=https://apps.apple.com/app/id0000000000
|
|
ACCOUNT_IMAGE=ghcr.io/hkgood/osg-account-server
|
|
IMAGE_TAG=main
|
|
ACCOUNT_BIND_PORT=18080
|
|
ACCOUNT_DOCKER_NETWORK=account-backend
|
|
|
|
# Existing isolated MySQL 8.4 database.
|
|
DATABASE_URL=jdbc:mysql://mysql:3306/osg_account?useUnicode=true&characterEncoding=utf8&connectionTimeZone=UTC&forceConnectionTimeZoneToSession=true
|
|
DATABASE_USER=osg_account
|
|
DATABASE_PASSWORD=replace-with-a-random-password
|
|
DATABASE_POOL_SIZE=10
|
|
DATABASE_MIGRATION_USER=osg_account_migrator
|
|
DATABASE_MIGRATION_PASSWORD=replace-with-a-separate-migration-password
|
|
|
|
# Generate three independent secrets. Never reuse any of them.
|
|
JWT_ISSUER=https://account.osglab.com
|
|
JWT_AUDIENCE=osgkeyboard-ios
|
|
JWT_SECRET=replace-with-at-least-32-random-bytes
|
|
ACCESS_TOKEN_MINUTES=15
|
|
REFRESH_TOKEN_DAYS=30
|
|
GATEWAY_GRANT_DAYS=30
|
|
FIELD_ENCRYPTION_KEY=replace-with-exactly-32-random-bytes-as-base64
|
|
IDENTITY_HMAC_KEY=replace-with-a-distinct-32-random-bytes-as-base64
|
|
IDENTITY_TOMBSTONE_RETENTION_DAYS=365
|
|
|
|
# Admin console. Enable bootstrap for the first successful startup only, then
|
|
# set it back to false and remove all four ADMIN_BOOTSTRAP_* credential values.
|
|
ADMIN_ENABLED=false
|
|
# Keep true by default. Set false only for a deliberate temporary mTLS bypass.
|
|
ADMIN_MTLS_REQUIRED=true
|
|
ADMIN_BOOTSTRAP_ENABLED=false
|
|
ADMIN_BOOTSTRAP_OPERATOR_ID=replace-with-random-uuid
|
|
ADMIN_BOOTSTRAP_USERNAME=owner
|
|
ADMIN_BOOTSTRAP_PASSWORD_HASH=replace-with-argon2id-phc-hash
|
|
ADMIN_BOOTSTRAP_TOTP_SECRET_BASE32=replace-with-random-base32-secret
|
|
ADMIN_SESSION_HOURS=8
|
|
ADMIN_MAXIMUM_MANUAL_GRANT=100000
|
|
|
|
# Apple identifiers are not secrets, but use the values from your own developer account.
|
|
APPLE_TEAM_ID=replace-with-apple-team-id
|
|
APPLE_KEY_ID=replace-with-apple-key-id
|
|
APPLE_CLIENT_ID=replace.with.your.bundle.id
|
|
# Encode PEM newlines as literal \n when supplied through Compose/1Panel.
|
|
APPLE_PRIVATE_KEY_PEM=replace-with-p8-content-using-literal-backslash-n
|
|
APPLE_JWKS_URL=https://appleid.apple.com/auth/keys
|
|
APPLE_TOKEN_URL=https://appleid.apple.com/auth/token
|
|
APPLE_REVOKE_URL=https://appleid.apple.com/auth/revoke
|
|
APPLE_INTEGRITY_ENVIRONMENT=development
|
|
APP_ATTEST_CHALLENGE_TTL_SECONDS=300
|
|
# DeviceCheck reuses the configured Apple Team ID, Key ID and ES256 private key.
|
|
|
|
# Prefer the newer Volcengine API key. The legacy app ID/access token pair is optional.
|
|
VOLCENGINE_API_KEY=replace-with-volcengine-api-key
|
|
VOLCENGINE_APP_ID=
|
|
VOLCENGINE_ACCESS_TOKEN=
|
|
VOLCENGINE_RESOURCE_ID=volc.seedasr.sauc.duration
|
|
VOLCENGINE_ASR_ENDPOINT=wss://openspeech.bytedance.com/api/v3/sauc/bigmodel
|
|
|
|
DEEPSEEK_API_KEY=replace-with-deepseek-api-key
|
|
DEEPSEEK_MODEL=deepseek-v4-flash
|
|
# Optional; defaults to DEEPSEEK_MODEL when omitted.
|
|
DEEPSEEK_REASONING_MODEL=
|
|
DEEPSEEK_ENDPOINT=https://api.deepseek.com/v1
|
|
|
|
SIGNUP_TRIAL_CREDITS=1000
|
|
REFERRAL_INVITER_CREDITS=1000
|
|
REFERRAL_INVITEE_CREDITS=1000
|
|
REFERRAL_BINDING_DAYS=7
|
|
|
|
# Keep voluntary tips separate. Every entry must be a dedicated consumable in
|
|
# productId:credits format and use an appAccountToken supplied by the app.
|
|
STOREKIT_ENABLED=false
|
|
STOREKIT_BUNDLE_ID=com.osgkeyboard.ios
|
|
STOREKIT_APP_APPLE_ID=6781553267
|
|
STOREKIT_PRODUCTS=500tks:500,1500tks:1500,3000tks:3000
|
|
|
|
# Production startup requires both flags and the production Apple environment.
|
|
ENFORCE_DEVICE_CHECK=false
|
|
ENFORCE_APP_ATTEST=false
|
|
LOG_LEVEL=INFO
|