feat: scaffold app skeleton with config, ULID, health endpoints, compose stack (phase 1)

- internal .env loader (real env wins) + strictly validated config struct - ULID package: 48-bit ms timestamp + 80-bit crypto randomness, sortable - HTTP server with recovery/request-id/trusted-proxy/access-log middleware - /healthz, /readyz (pluggable checkers), /metricsz (counter registry) - multi-stage Dockerfile (alpine, non-root) + compose with healthchecks, app bound to 127.0.0.1:8787, mongo unpublished, graceful 15s shutdown Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-12 18:10:30 +02:00
commit 976f5238f8
26 changed files with 2478 additions and 0 deletions
@@ -0,0 +1,56 @@
+# --- core ---
+# Set APP_BASE_URL to the public https URL when behind the reverse proxy.
+APP_BASE_URL=http://localhost:8787
+# Comma-separated CIDRs of trusted reverse proxies, e.g. 172.16.0.0/12,10.0.0.0/8.
+# Empty = trust no proxy headers.
+TRUSTED_PROXY_CIDRS=
+APP_PORT=8787
+MONGO_URI=mongodb://mongo:27017
+MONGO_DB=bountyboard
+SESSION_SECRET=change-me-32-bytes-random
+# base64 of 32 random bytes; generate with: openssl rand -base64 32
+CREDENTIALS_ENC_KEY=
+MAX_UPLOAD_MB=25
+
+# --- bootstrap admin ---
+ADMIN_EMAIL=admin@example.com
+ADMIN_INITIAL_PASSWORD=change-me-now
+
+# --- external services (REQUIRED to be configurable here) ---
+# Two independent services — separate URLs, ports, and tokens.
+ATOMIZER_BASE_URL=http://atomizer-mock:8090
+ATOMIZER_TOKEN=change-me-atomizer
+ATOMIZER_TIMEOUT_SEC=120
+WORK_PERFORMER_BASE_URL=http://work-performer:8091
+WORK_PERFORMER_TOKEN=change-me-performer
+# Job submission/polling only; jobs themselves are async.
+WORK_PERFORMER_HTTP_TIMEOUT_SEC=30
+
+# --- SMTP (optional; enables forgot-password + email notifications when set) ---
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_FROM=bountyboard@example.com
+
+# --- hardening / tuning ---
+# auto: Secure cookie flag only when APP_BASE_URL is https. Or: true | false.
+COOKIE_SECURE=auto
+# Cap parallel LLM calls (cost + rate-limit control).
+ATOMIZE_MAX_CONCURRENCY=3
+# Optional; enable Mongo auth for non-local deploys.
+MONGO_USERNAME=
+MONGO_PASSWORD=
+
+# --- OIDC (optional; SSO hidden if empty) ---
+OIDC_ISSUER_URL=
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+
+# --- mock atomizer / work performer ---
+# Paste your key here; NEVER commit it.
+ANTHROPIC_API_KEY=
+ANTHROPIC_OPENAI_BASE_URL=https://api.anthropic.com/v1
+ANTHROPIC_MODEL=claude-sonnet-4-6
+# openai | anthropic (native /v1/messages fallback)
+LLM_API_STYLE=openai