Rocky
0af35d44f4
Provide the production foundation for Apple identity, immutable credits, referrals, integrity checks, managed providers, and hardened Docker deployment.
63 lines
2.5 KiB
Bash
63 lines
2.5 KiB
Bash
# Copy to an untracked .env. Every secret below is a placeholder.
|
|
APP_ENV=development
|
|
PORT=8080
|
|
PUBLIC_BASE_URL=https://account.osglab.com
|
|
INVITE_BASE_URL=https://osglab.com/i
|
|
APP_STORE_URL=https://apps.apple.com/app/id0000000000
|
|
IMAGE_TAG=local
|
|
ACCOUNT_BIND_PORT=18080
|
|
ACCOUNT_DOCKER_NETWORK=account-backend
|
|
|
|
# Existing isolated MySQL 8.4 database.
|
|
DATABASE_URL=jdbc:mysql://mysql:3306/osg_account?useUnicode=true&characterEncoding=utf8&connectionTimeZone=UTC&forceConnectionTimeZoneToSession=true
|
|
DATABASE_USER=osg_account
|
|
DATABASE_PASSWORD=replace-with-a-random-password
|
|
DATABASE_POOL_SIZE=10
|
|
DATABASE_MIGRATION_USER=osg_account_migrator
|
|
DATABASE_MIGRATION_PASSWORD=replace-with-a-separate-migration-password
|
|
|
|
# Generate three independent secrets. Never reuse any of them.
|
|
JWT_ISSUER=https://account.osglab.com
|
|
JWT_AUDIENCE=osgkeyboard-ios
|
|
JWT_SECRET=replace-with-at-least-32-random-bytes
|
|
ACCESS_TOKEN_MINUTES=15
|
|
REFRESH_TOKEN_DAYS=30
|
|
GATEWAY_GRANT_DAYS=30
|
|
FIELD_ENCRYPTION_KEY=replace-with-exactly-32-random-bytes-as-base64
|
|
IDENTITY_HMAC_KEY=replace-with-a-distinct-32-random-bytes-as-base64
|
|
IDENTITY_TOMBSTONE_RETENTION_DAYS=365
|
|
|
|
# Apple identifiers are not secrets, but use the values from your own developer account.
|
|
APPLE_TEAM_ID=replace-with-apple-team-id
|
|
APPLE_KEY_ID=replace-with-apple-key-id
|
|
APPLE_CLIENT_ID=replace.with.your.bundle.id
|
|
# Encode PEM newlines as literal \n when supplied through Compose/1Panel.
|
|
APPLE_PRIVATE_KEY_PEM=replace-with-p8-content-using-literal-backslash-n
|
|
APPLE_JWKS_URL=https://appleid.apple.com/auth/keys
|
|
APPLE_TOKEN_URL=https://appleid.apple.com/auth/token
|
|
APPLE_REVOKE_URL=https://appleid.apple.com/auth/revoke
|
|
APPLE_INTEGRITY_ENVIRONMENT=development
|
|
APP_ATTEST_CHALLENGE_TTL_SECONDS=300
|
|
# DeviceCheck reuses the configured Apple Team ID, Key ID and ES256 private key.
|
|
|
|
# Prefer the newer Volcengine API key. The legacy app ID/access token pair is optional.
|
|
VOLCENGINE_API_KEY=replace-with-volcengine-api-key
|
|
VOLCENGINE_APP_ID=
|
|
VOLCENGINE_ACCESS_TOKEN=
|
|
VOLCENGINE_RESOURCE_ID=volc.seedasr.sauc.duration
|
|
VOLCENGINE_ASR_ENDPOINT=wss://openspeech.bytedance.com/api/v3/sauc/bigmodel_async
|
|
|
|
DEEPSEEK_API_KEY=replace-with-deepseek-api-key
|
|
DEEPSEEK_MODEL=deepseek-v4-flash
|
|
DEEPSEEK_ENDPOINT=https://api.deepseek.com/v1
|
|
|
|
SIGNUP_TRIAL_CREDITS=1000
|
|
REFERRAL_INVITER_CREDITS=3000
|
|
REFERRAL_INVITEE_CREDITS=3000
|
|
REFERRAL_BINDING_DAYS=7
|
|
|
|
# Production startup requires both flags and the production Apple environment.
|
|
ENFORCE_DEVICE_CHECK=false
|
|
ENFORCE_APP_ATTEST=false
|
|
LOG_LEVEL=INFO
|