97 lines
3.4 KiB
Bash
97 lines
3.4 KiB
Bash
# Required core
|
|
APP_NAME=ToolCTRL
|
|
# DATABASE_URL points at PgBouncer (port 6432) for application traffic.
|
|
# Append `?pgbouncer=true&connection_limit=10` so Prisma disables prepared-
|
|
# statement caching (transaction-mode pooling cannot keep them). DIRECT_URL
|
|
# below is the unpooled link used by Prisma Migrate. See docs/ops/pgbouncer.md.
|
|
DATABASE_URL="postgres://{USER}:{PASSWORD}@{POOL_HOST}:6432/{DATABASE}?pgbouncer=true&connection_limit=10"
|
|
SESSION_SECRET=
|
|
CRYPTO_SECRET=
|
|
APP_BASE_DOMAIN=your-domain.invalid
|
|
WEB_APP_HOST=app.your-domain.invalid
|
|
ADMIN_APP_HOST=admin.your-domain.invalid
|
|
API_HOST=api.your-domain.invalid
|
|
APP_PROTOCOL=https
|
|
|
|
# Required for current legacy API/auth endpoints
|
|
API_ACCESS_TOKEN=
|
|
JWT_SECRET=
|
|
API_KEY_LEGACY_PLAINTEXT_FALLBACK=false
|
|
|
|
# Required if public analytics ingestion is enabled
|
|
ANALYTICS_TOKEN=
|
|
|
|
# Production/runtime platform
|
|
NODE_ENV=production
|
|
# DIRECT_URL: unpooled Postgres URL (port 5432, bypasses PgBouncer). Required
|
|
# so Prisma Migrate keeps prepared statements alive. See docs/ops/pgbouncer.md.
|
|
DIRECT_URL="postgres://{USER}:{PASSWORD}@{POSTGRES_HOST}:5432/{DATABASE}"
|
|
# Optional Postgres read-replica for hot-read paths (CRM/KB listings,
|
|
# dashboards, public sites/portals). Falls back to DATABASE_URL when
|
|
# unset — single-DB deploys keep working unchanged. Use a read-only DB
|
|
# user (GRANT SELECT) and ideally a PgBouncer-fronted replica endpoint.
|
|
# Replication is eventually consistent. See docs/architecture/rw-split.md.
|
|
# DATABASE_READ_URL="postgres://{READ_USER}:{PASSWORD}@{REPLICA_HOST}:6432/{DATABASE}?pgbouncer=true&connection_limit=10"
|
|
# SERVER_URL=https://app.example.com
|
|
|
|
# Production seed bootstrap. Set in Coolify before first migration/seed run; blank values are rejected.
|
|
# SEED_ADMIN_EMAIL=owner@example.com
|
|
# SEED_ADMIN_PASSWORD=replace-with-a-strong-one-time-bootstrap-password
|
|
|
|
# Optional providers; MailerSend is the default transactional runtime provider
|
|
STORAGE_ENDPOINT=
|
|
STORAGE_REGION=
|
|
STORAGE_BUCKET=
|
|
STORAGE_ACCESS_KEY_ID=
|
|
STORAGE_SECRET_ACCESS_KEY=
|
|
STORAGE_SESSION_TOKEN=
|
|
STORAGE_PUBLIC_BASE_URL=
|
|
STORAGE_FORCE_PATH_STYLE=false
|
|
STRIPE_SK=
|
|
STRIPE_WEBHOOK_SIGNING_SECRET=
|
|
STRIPE_ACCOUNT_COUNTRY=US
|
|
MAILJET_API_KEY=
|
|
MAILJET_SECRET_KEY=
|
|
MAILJET_FROM_EMAIL=
|
|
# MAILJET_FROM_NAME=
|
|
MAILJET_WEBHOOK_SECRET=
|
|
SUPPORT_EMAIL=
|
|
COMPANY_NAME=
|
|
COMPANY_ADDRESS=
|
|
INTEGRATIONS_CONTACT_FORMSPREE=
|
|
MCAPTCHA_INSTANCE_URL=
|
|
MCAPTCHA_ACCOUNT_SECRET=
|
|
MCAPTCHA_SITEKEY_LOGIN=
|
|
MCAPTCHA_SITEKEY_FORMS=
|
|
MCAPTCHA_SITEKEY_BOOKING=
|
|
CAPTCHA_FAIL_OPEN=true
|
|
AUTH_MAGIC_LINK_ENABLED=false
|
|
AUTH_MAGIC_LINK_TOKEN_TTL_MINUTES=15
|
|
NOTIFICATIONS_NOVU_API_KEY=
|
|
# Set WORKER_ENABLED=true only on the worker resource. Leave it unset for web/API resources.
|
|
# WORKER_ENABLED=false
|
|
EXPORT_RETENTION_QUEUE_ENABLED=false
|
|
IMPORT_QUEUE_ENABLED=false
|
|
# Set this on worker resources only.
|
|
# BULLMQ_REDIS_URL=redis://default:<redis-password>@redis.your-domain.invalid:6379/0
|
|
# REDIS_URL is a fallback only when BULLMQ_REDIS_URL is absent; keep it commented if a platform injects it.
|
|
# REDIS_URL=redis://localhost:6379/0
|
|
|
|
# Plugin worker runtime. Set these on WORKER_QUEUE_GROUP=plugin resources.
|
|
# PLUGIN_TRUSTED_PUBLIC_KEYS=
|
|
PLUGIN_MAX_FUEL=1000000
|
|
PLUGIN_MAX_MEMORY_MB=64
|
|
PLUGIN_MAX_WALL_CLOCK_MS=5000
|
|
PLUGIN_RATE_LIMIT_PER_MINUTE=100
|
|
PLUGIN_RATE_LIMIT_WINDOW_SECONDS=60
|
|
PLUGIN_OUTPUT_SANITIZATION_STRICTNESS=moderate
|
|
|
|
BROWSER_RUNTIME_URL=
|
|
BROWSER_RUNTIME_API_KEY=
|
|
BROWSER_SESSION_TIMEOUT_MS=60000
|
|
IPSTACK_API_KEY=
|
|
IPAPIIS_API_KEY=
|
|
PORTAL_SERVER_URL=
|
|
PORTAL_SERVER_FLY_TOKEN=
|
|
# SITE_KEY_EXAMPLE_SITE=
|