etalon
976f5238f8
- internal .env loader (real env wins) + strictly validated config struct - ULID package: 48-bit ms timestamp + 80-bit crypto randomness, sortable - HTTP server with recovery/request-id/trusted-proxy/access-log middleware - /healthz, /readyz (pluggable checkers), /metricsz (counter registry) - multi-stage Dockerfile (alpine, non-root) + compose with healthchecks, app bound to 127.0.0.1:8787, mongo unpublished, graceful 15s shutdown Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
57 lines
1.8 KiB
Bash
57 lines
1.8 KiB
Bash
# --- core ---
|
|
# Set APP_BASE_URL to the public https URL when behind the reverse proxy.
|
|
APP_BASE_URL=http://localhost:8787
|
|
# Comma-separated CIDRs of trusted reverse proxies, e.g. 172.16.0.0/12,10.0.0.0/8.
|
|
# Empty = trust no proxy headers.
|
|
TRUSTED_PROXY_CIDRS=
|
|
APP_PORT=8787
|
|
MONGO_URI=mongodb://mongo:27017
|
|
MONGO_DB=bountyboard
|
|
SESSION_SECRET=change-me-32-bytes-random
|
|
# base64 of 32 random bytes; generate with: openssl rand -base64 32
|
|
CREDENTIALS_ENC_KEY=
|
|
MAX_UPLOAD_MB=25
|
|
|
|
# --- bootstrap admin ---
|
|
ADMIN_EMAIL=admin@example.com
|
|
ADMIN_INITIAL_PASSWORD=change-me-now
|
|
|
|
# --- external services (REQUIRED to be configurable here) ---
|
|
# Two independent services — separate URLs, ports, and tokens.
|
|
ATOMIZER_BASE_URL=http://atomizer-mock:8090
|
|
ATOMIZER_TOKEN=change-me-atomizer
|
|
ATOMIZER_TIMEOUT_SEC=120
|
|
WORK_PERFORMER_BASE_URL=http://work-performer:8091
|
|
WORK_PERFORMER_TOKEN=change-me-performer
|
|
# Job submission/polling only; jobs themselves are async.
|
|
WORK_PERFORMER_HTTP_TIMEOUT_SEC=30
|
|
|
|
# --- SMTP (optional; enables forgot-password + email notifications when set) ---
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM=bountyboard@example.com
|
|
|
|
# --- hardening / tuning ---
|
|
# auto: Secure cookie flag only when APP_BASE_URL is https. Or: true | false.
|
|
COOKIE_SECURE=auto
|
|
# Cap parallel LLM calls (cost + rate-limit control).
|
|
ATOMIZE_MAX_CONCURRENCY=3
|
|
# Optional; enable Mongo auth for non-local deploys.
|
|
MONGO_USERNAME=
|
|
MONGO_PASSWORD=
|
|
|
|
# --- OIDC (optional; SSO hidden if empty) ---
|
|
OIDC_ISSUER_URL=
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
|
|
# --- mock atomizer / work performer ---
|
|
# Paste your key here; NEVER commit it.
|
|
ANTHROPIC_API_KEY=
|
|
ANTHROPIC_OPENAI_BASE_URL=https://api.anthropic.com/v1
|
|
ANTHROPIC_MODEL=claude-sonnet-4-6
|
|
# openai | anthropic (native /v1/messages fallback)
|
|
LLM_API_STYLE=openai
|