etalon
6265ffa894
- APP_INTERNAL_URL: in-network base URL for §5.2 callbacks and signed attachment URLs handed to the external services (compose: http://app:8787) - work-performer image runs as the node user with ~/.claude mounted into /home/node — the claude CLI refuses --dangerously-skip-permissions as root - scripts/acceptance.sh: re-run-safe live verification of the §13 checklist (demo import within one poll, subdivide sum=1 + editable, extend sibling, publish/bounty math, decline/claim/approve, changes-requested loop, approval award in metrics, unassign, AI job through real Claude Code with signed idempotent callback, breaker independence between the two services) - README/DECISIONS: sudo HOME gotcha, internal URL, non-root performer Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
60 lines
1.9 KiB
Bash
60 lines
1.9 KiB
Bash
# --- core ---
|
|
# Set APP_BASE_URL to the public https URL when behind the reverse proxy.
|
|
APP_BASE_URL=http://localhost:8787
|
|
# In-network address external services use to call back into the app.
|
|
# docker-compose.yml sets this to http://app:8787; defaults to APP_BASE_URL.
|
|
#APP_INTERNAL_URL=
|
|
# Comma-separated CIDRs of trusted reverse proxies, e.g. 172.16.0.0/12,10.0.0.0/8.
|
|
# Empty = trust no proxy headers.
|
|
TRUSTED_PROXY_CIDRS=
|
|
APP_PORT=8787
|
|
MONGO_URI=mongodb://mongo:27017
|
|
MONGO_DB=bountyboard
|
|
SESSION_SECRET=change-me-32-bytes-random
|
|
# base64 of 32 random bytes; generate with: openssl rand -base64 32
|
|
CREDENTIALS_ENC_KEY=
|
|
MAX_UPLOAD_MB=25
|
|
|
|
# --- bootstrap admin ---
|
|
ADMIN_EMAIL=admin@example.com
|
|
ADMIN_INITIAL_PASSWORD=change-me-now
|
|
|
|
# --- external services (REQUIRED to be configurable here) ---
|
|
# Two independent services — separate URLs, ports, and tokens.
|
|
ATOMIZER_BASE_URL=http://atomizer-mock:8090
|
|
ATOMIZER_TOKEN=change-me-atomizer
|
|
ATOMIZER_TIMEOUT_SEC=120
|
|
WORK_PERFORMER_BASE_URL=http://work-performer:8091
|
|
WORK_PERFORMER_TOKEN=change-me-performer
|
|
# Job submission/polling only; jobs themselves are async.
|
|
WORK_PERFORMER_HTTP_TIMEOUT_SEC=30
|
|
|
|
# --- SMTP (optional; enables forgot-password + email notifications when set) ---
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM=bountyboard@example.com
|
|
|
|
# --- hardening / tuning ---
|
|
# auto: Secure cookie flag only when APP_BASE_URL is https. Or: true | false.
|
|
COOKIE_SECURE=auto
|
|
# Cap parallel LLM calls (cost + rate-limit control).
|
|
ATOMIZE_MAX_CONCURRENCY=3
|
|
# Optional; enable Mongo auth for non-local deploys.
|
|
MONGO_USERNAME=
|
|
MONGO_PASSWORD=
|
|
|
|
# --- OIDC (optional; SSO hidden if empty) ---
|
|
OIDC_ISSUER_URL=
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
|
|
# --- mock atomizer / work performer ---
|
|
# Paste your key here; NEVER commit it.
|
|
ANTHROPIC_API_KEY=
|
|
ANTHROPIC_OPENAI_BASE_URL=https://api.anthropic.com/v1
|
|
ANTHROPIC_MODEL=claude-sonnet-4-6
|
|
# openai | anthropic (native /v1/messages fallback)
|
|
LLM_API_STYLE=openai
|