mirror of
https://github.com/oxynote/oxynote.git
synced 2026-10-17 10:59:20 +02:00
44 lines
2.1 KiB
Bash
44 lines
2.1 KiB
Bash
# every variable auth-realtime reads is listed here explicitly, even when
|
|
# empty. `make setup` copies this template to auth-realtime.local.env
|
|
# (gitignored) when missing; the dev compose reads only the .local.env
|
|
# file — put secrets and local tweaks there.
|
|
|
|
# infrastructure wiring (compose service hostnames)
|
|
OXYNOTE_AUTH_REALTIME_BACKEND_URL=http://core:8080
|
|
OXYNOTE_AUTH_REALTIME_DB_DSN=postgresql://devuser:devpass@postgres/devdb?sslmode=disable
|
|
# an empty URL disables valkey: better-auth runs with no secondary
|
|
# storage, reading sessions from the database and counting rate limits
|
|
# in memory.
|
|
OXYNOTE_AUTH_REALTIME_VALKEY_DSN=redis://valkey:6379
|
|
|
|
# server
|
|
# the listen address as host:port; empty binds all interfaces on 8081.
|
|
OXYNOTE_AUTH_REALTIME_ADDRESS=
|
|
|
|
# public URLs (the caddy front door)
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_BASE_URL=http://localhost:8080/auth-realtime
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_COOKIE_DOMAIN=localhost
|
|
OXYNOTE_AUTH_REALTIME_FRONTEND_URL=http://localhost:8080
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_ORGANIZATION_INVITATION_URL=http://localhost:8080/accept-invite
|
|
OXYNOTE_AUTH_REALTIME_TRUSTED_ORIGINS=http://localhost:8080,http://localhost:3000,oxynote://,oxynote:/
|
|
OXYNOTE_AUTH_REALTIME_MCP_RESOURCE=http://localhost:8080/core/api/mcp
|
|
|
|
# auth
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_SECRET=sup3rs3cr3t
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_GITHUB_CLIENT_ID=
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_GITHUB_CLIENT_SECRET=
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_GOOGLE_CLIENT_ID=
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_GOOGLE_CLIENT_SECRET=
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_SLACK_CLIENT_ID=
|
|
OXYNOTE_AUTH_REALTIME_BETTER_AUTH_SLACK_CLIENT_SECRET=
|
|
|
|
# limits
|
|
OXYNOTE_AUTH_REALTIME_MAX_ORGANIZATION_MEMBERS=5
|
|
OXYNOTE_AUTH_REALTIME_MAX_ORGANIZATIONS=50
|
|
# better-auth's own rate limiter is on unless this is set to "true". It
|
|
# buckets by client IP and lets sign-in and sign-up share three requests
|
|
# per ten seconds, so switch it off where one address fronts many users
|
|
# (a test run, or a proxy that hides the original IP) and rate-limit
|
|
# upstream instead.
|
|
OXYNOTE_AUTH_REALTIME_RATE_LIMIT_DISABLED=false
|