titen/.env.example at develop · codecoradev/titen · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# Titen — Docker Compose environment
#
# Copy to .env and fill in:
#   cp .env.example .env
#
# All variables are optional for local dev. Production requires at least
# TITEN_API_KEY and OAuth credentials.

# ── Core ───────────────────────────────────────────────
# Public URL of the web frontend (used for OAuth redirect URIs).
APP_URL=http://localhost:3000

# Port published to the host for the web container.
WEB_PORT=3000

# Rust log level.
RUST_LOG=titen_api=info,tower_http=info

# SQLite database file path.
# Docker: /data/titen.db (matches the volume mount in docker-compose.yml)
# Native: ~/.codecora/titen/titen.db (default if unset)
TITEN_DB_PATH=/data/titen.db

# ── Auth ───────────────────────────────────────────────
# Set TITEN_API_KEY to require API key auth on all endpoints.
# Leave empty for local dev (no auth).
TITEN_API_KEY=

# Comma-separated CORS origins for cross-origin API access.
# Example: https://titen.azfirazka.com,https://titen.codecora.dev
TITEN_CORS_ORIGINS=

# ── OAuth Redirect URI ───────────────────────────────────────────────
# The redirect URI Meta uses after OAuth authorization.
# Resolution order (first non-empty wins):
#   1. TITEN_OAUTH_REDIRECT_URI (explicit, safest)
#   2. APP_URL + /auth/callback (auto-derived from APP_URL above)
#   3. Host header + /auth/callback (only if Host is in TITEN_ALLOWED_HOSTS)
#
# In most cases, setting APP_URL is sufficient.
# Only set TITEN_OAUTH_REDIRECT_URI if you need an explicit override.
#TITEN_OAUTH_REDIRECT_URI=

# Allowlist for deriving redirect URI from the Host header.
# Comma-separated list of trusted hostnames.
# Example: titen.azfirazka.com,localhost:7845
#TITEN_ALLOWED_HOSTS=

# ── Traefik (production reverse proxy) ─────────────────
# Set TRAEFIK_ENABLED=true when deploying behind Traefik.
# The web container will join an external Traefik network and expose
# itself via Host() rule + auto-HTTPS (Let's Encrypt).
TRAEFIK_ENABLED=false
TRAEFIK_EXTERNAL=false
TITEN_HOST=titen.azfirazka.com
CERTRESOLVER=myresolver
TRAEFIK_ENTRYPOINTS=websecure
TRAEFIK_NETWORK=traefik-public

# Security: Set to true in production (HTTPS) to add Secure flag to auth cookie.
# Auto-detected from X-Forwarded-Proto header when behind a reverse proxy.
# Set to true explicitly if you encounter issues.
TITEN_COOKIE_SECURE=false

# ── Production Mode ───────────────────────────────────────────────────
# Set to "prod" or "production" to enable strict security guards:
# - TITEN_API_KEY must be set (no auth bypass)
# - TITEN_ENCRYPTION_KEY must be set (no plaintext tokens)
# - Swagger UI disabled unless TITEN_ENABLE_SWAGGER=true
# Also auto-detected: TRAEFIK_ENABLED=true implies production mode.
#TITEN_ENV=prod

# Enable Swagger UI in production (disabled by default for security).
#TITEN_ENABLE_SWAGGER=false

# ── Token Encryption (PRODUCTION REQUIRED) ────────────────────────────
# AES-256-GCM encryption key for access_token and app_secret at rest.
# Generate with: openssl rand -hex 32
#
# WARNING: Without this, tokens are stored PLAINTEXT in SQLite.
# Leave empty for local dev (plaintext mode).
# In production mode (TITEN_ENV=prod or TRAEFIK_ENABLED=true), this is REQUIRED.
#
# IMPORTANT: If you change this key after accounts are already stored,
# existing encrypted tokens become undecryptable. Back up this key safely.
TITEN_ENCRYPTION_KEY=

# Set to true to PANIC on startup if TITEN_ENCRYPTION_KEY is missing or invalid.
# In production mode, encryption is enforced by default regardless of this setting.
# Set to false ONLY for local development.
TITEN_REQUIRE_ENCRYPTION=false

# ── S3 Storage (optional, for media uploads) ─────────────────────────
# All TITEN_S3_* variables are required to enable S3-backed media storage.
# If not set, media uploads fall back to local filesystem (see below).
#TITEN_S3_ENDPOINT=
#TITEN_S3_BUCKET=
#TITEN_S3_ACCESS_KEY=
#TITEN_S3_SECRET_KEY=
#TITEN_S3_REGION=us-east-1
# Optional: CDN or custom domain for public media URLs.
# If NOT set, URLs are built as {TITEN_S3_ENDPOINT}/{TITEN_S3_BUCKET}/{key}.
# If set, URLs are built as {TITEN_S3_PUBLIC_URL}/{key} (bucket name NOT included).
# WARNING: An empty string value (TITEN_S3_PUBLIC_URL=) is treated as unset.
#TITEN_S3_PUBLIC_URL=

# ── Local Storage Fallback ───────────────────────────────────────────
# When S3 is not configured, media files are stored on the local
# filesystem. Files are served at /media/ via the API server.
# In Docker, this persists via the ./data:/data bind mount.
#TITEN_LOCAL_STORAGE_DIR=/data/media
#TITEN_LOCAL_PUBLIC_URL=/media

# ── Scheduler ─────────────────────────────────────────────────────────
# Interval (seconds) between scheduler runs for scheduled posts and token refresh.
# Default: 60
TITEN_SCHEDULER_INTERVAL_SECS=60

# ── Docker images (production) ────────────────────────────────────────
# Uncomment after first release to pull pre-built images from GHCR:
# WEB_IMAGE=ghcr.io/codecoradev/titen:latest-web
# API_IMAGE=ghcr.io/codecoradev/titen:latest-api