7224e43bfb
- .env.example lists the keys the scripts actually read (NAS_HOST/NAS_USER/ NAS_SSH_PORT/NAS_DEPLOY_PATH, web build args, Supabase access token and project ref, CRON_SECRET, Cloudflare token/account/zone/tunnel) and drops unused ones (DSM_HOST, NAS_DEPLOY_ROOT, NAS_ADMIN_PORT, NAS_LANDING_PORT, APP_DOMAIN, ADMIN_DOMAIN). - docs/map/02-infrastructure.md gains a credentials map (names only) with the matching Forgejo/Supabase/NAS copies, plus the public routing summary. - Deploy scripts no longer point to the removed /admin static page or portal.
111 lines
3.8 KiB
Text
111 lines
3.8 KiB
Text
# Copy this file to .env for local operations only. Never commit populated values.
|
|
|
|
# NAS deployment target (scripts/deploy-nas.ps1, scripts/deploy-nas.sh)
|
|
NAS_HOST=
|
|
NAS_USER=
|
|
NAS_SSH_PORT=22
|
|
NAS_DEPLOY_PATH=/volume1/docker/d3ro
|
|
DSM_SSH_USER=
|
|
DSM_SSH_PASSWORD=
|
|
|
|
# Git/Forgejo operations
|
|
GIT_SERVER_URL=https://git.example.invalid
|
|
GIT_USERNAME=
|
|
GIT_PASSWORD=
|
|
GIT_REPO_NAME=d3ro-voice
|
|
FORGEJO_TOKEN=
|
|
FORGEJO_USERNAME=
|
|
FORGEJO_PASSWORD=
|
|
|
|
# Public service addresses. The canonical values live in packages/core/src/web-urls.ts;
|
|
# the NAS compose needs API_SERVER_URL for the admin login backend (https only).
|
|
API_SERVER_URL=https://voice.example.invalid
|
|
SITE_URL=https://voice.example.invalid
|
|
CORS_ALLOWED_ORIGINS=https://voice.example.invalid,https://admin.voice.example.invalid
|
|
ALLOWED_HOSTS=voice.example.invalid;admin.voice.example.invalid
|
|
|
|
# API authentication. Generate unique random values for every environment.
|
|
# JWT_SECRET and ADMIN_SESSION_SECRET must each be at least 32 UTF-8 bytes.
|
|
JWT_SECRET=
|
|
JWT_ISSUER=https://voice.example.invalid
|
|
JWT_AUDIENCE=d3ro-admin
|
|
ADMIN_BOOTSTRAP_TOKEN=
|
|
ADMIN_SESSION_SECRET=
|
|
# TLS 없이 LAN HTTP(예: http://NAS_IP:3001)로 직접 접속하는 배포에서만 false로 설정.
|
|
# Secure 쿠키는 HTTP에서 브라우저가 버려 로그인이 유지되지 않는다. 기본값 true 유지 권장.
|
|
ADMIN_COOKIE_SECURE=true
|
|
# Shared only between Supabase stt-proxy and the .NET provider orchestrator.
|
|
# Use a distinct random value with at least 32 UTF-8 bytes.
|
|
D3RO_API_TOKEN=
|
|
|
|
# Offline Ed25519 license keys. Keep the private key on the admin server only.
|
|
# The matching public key is committed at apps/desktop/resources/license/production-public.pem.
|
|
# Multiline private PEM values may use escaped \n characters. Legacy fixture keys are development-only.
|
|
ADMIN_LICENSE_PRIVATE_KEY=
|
|
D3RO_ALLOW_LEGACY_DEV_LICENSES=false
|
|
|
|
# Supabase
|
|
SUPABASE_URL=
|
|
SUPABASE_SERVICE_ROLE_KEY=
|
|
|
|
# Google OAuth and browser automation
|
|
GOOGLE_OAUTH_CLIENT_ID=
|
|
GOOGLE_OAUTH_SECRET=
|
|
D3RO_PORTAL_OPERATOR_EMAIL=
|
|
|
|
# Android release signing. Prefer Gradle properties or a protected CI secret store.
|
|
D3RO_RELEASE_STORE_FILE=
|
|
D3RO_RELEASE_STORE_PASSWORD=
|
|
D3RO_RELEASE_KEY_ALIAS=
|
|
D3RO_RELEASE_KEY_PASSWORD=
|
|
|
|
# Google Mobile Ads production identifiers. These are identifiers, not secrets,
|
|
# but release builds intentionally fail when they are absent or use test IDs.
|
|
D3RO_ADMOB_APP_ID=
|
|
D3RO_ADMOB_BANNER_UNIT_ID=
|
|
D3RO_ADMOB_REWARDED_UNIT_ID=
|
|
|
|
# Email and push providers
|
|
RESEND_FROM=
|
|
RESEND_API_KEY=
|
|
# Android push transport (Firebase Cloud Messaging). Required only for Android.
|
|
FCM_SERVICE_ACCOUNT_JSON=
|
|
FCM_PROJECT_ID=
|
|
# Web Push transport (Firebase-free). VAPID keys; subject must be mailto: or https:.
|
|
WEBPUSH_VAPID_PUBLIC_KEY=
|
|
WEBPUSH_VAPID_PRIVATE_KEY=
|
|
WEBPUSH_SUBJECT=
|
|
# Apple Push Notification service transport (Firebase-free). Token-based .p8 auth.
|
|
APNS_KEY_ID=
|
|
APNS_TEAM_ID=
|
|
APNS_PRIVATE_KEY=
|
|
APNS_TOPIC=com.d3ro.voice
|
|
APNS_ENVIRONMENT=production
|
|
|
|
# Cloudflare Worker push-outbox cron drain. Set SUPABASE_SERVICE_ROLE_KEY as a
|
|
# worker secret (`wrangler secret put`), never in this file.
|
|
D3RO_WORKER_SUPABASE_URL=
|
|
D3RO_WORKER_SUPABASE_SERVICE_ROLE_KEY=
|
|
D3RO_WORKER_PUSH_DRAIN_BATCH_LIMIT=20
|
|
|
|
# Optional authenticated mobile E2E account, stored only in CI secrets or local .env.
|
|
MOBILE_E2E_EMAIL=
|
|
MOBILE_E2E_PASSWORD=
|
|
|
|
# Web app image build (apps/web/Dockerfile build args; public values baked into the bundle)
|
|
NEXT_PUBLIC_SUPABASE_URL=
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=
|
|
NEXT_PUBLIC_PAYPLE_CLIENT_KEY=
|
|
|
|
# Supabase management (CLI / Management API without an interactive login)
|
|
SUPABASE_PROJECT_REF=
|
|
SUPABASE_ACCESS_TOKEN=
|
|
|
|
# Payple renewal cron: same value as the Supabase function secret and the Forgejo secret
|
|
CRON_SECRET=
|
|
|
|
# Cloudflare (tunnel ingress, DNS, Pages and the site bridge worker)
|
|
CLOUDFLARE_API_TOKEN=
|
|
CLOUDFLARE_ACCOUNT_ID=
|
|
CLOUDFLARE_ZONE_ID=
|
|
CLOUDFLARE_TUNNEL_ID=
|