disclosure-bureau/infra/disclosure-stack/.env.example

129 lines
6.7 KiB
Text

# =============================================================================
# DISCLOSURE BUREAU — DEPLOYMENT CONFIG
# =============================================================================
# Copy this file to `.env`, fill in the values, never commit `.env`.
# When migrating to a different VPS, change ONLY the "VPS CONNECTION" block.
# Everything else stays portable.
#
# To regenerate the secrets block: `./scripts/gen-secrets.sh`
# =============================================================================
# ─── VPS CONNECTION ─────────────────────────────────────────────────────────
# The only block you change when moving to another VPS.
# scripts/ssh.sh, scripts/deploy.sh, scripts/logs.sh all read these.
VPS_HOST= # e.g., 187.77.40.19 OR disclosure.example.com
VPS_USER=root
VPS_PORT=22
VPS_AUTH=password # 'password' or 'key'
VPS_PASSWORD= # only if VPS_AUTH=password (kept ONLY in this gitignored .env)
VPS_SSH_KEY=~/.ssh/id_ed25519 # only if VPS_AUTH=key
VPS_DEPLOY_ROOT=/data/disclosure # where this stack lives on the VPS
# ─── PROJECT IDENTITY ───────────────────────────────────────────────────────
PROJECT_NAME=disclosure # docker-compose project name; prefixes all containers
STACK_PREFIX=disclosure- # matches the existing pattern on the VPS (unimed-, irmed-, ...)
# ─── DOMAINS ────────────────────────────────────────────────────────────────
# Set DNS A records pointing all of these to VPS_HOST before deploying.
DOMAIN_MAIN=disclosure.top # Next.js public app
DOMAIN_API=api.disclosure.top # Kong (Supabase API gateway)
DOMAIN_STUDIO=studio.disclosure.top # Supabase Studio (admin UI — protect with basic-auth)
DOMAIN_SEARCH=search.disclosure.top # Meilisearch
DOMAIN_IMG=img.disclosure.top # Imgproxy
ACME_EMAIL= # for Let's Encrypt cert notifications
# ─── HOST PORTS (must NOT collide with other projects on the VPS) ───────────
# Internal ports in containers stay default; these are the host-side mappings.
# Each stack on the VPS uses its own range. Pick free ones via `ss -tlnp`.
PORT_KONG_HTTP=18001 # Supabase API gateway HTTP
PORT_KONG_HTTPS=18444 # Supabase API gateway HTTPS
PORT_STUDIO=18002 # Studio UI
PORT_NEXT=18003 # Next.js app
PORT_MEILI=18004 # Meilisearch
PORT_IMGPROXY=18005 # Imgproxy
# Postgres NEVER exposed to host; reach it via internal network only.
# ─── SECRETS (auto-generated, regenerate per VPS) ───────────────────────────
# Generate fresh values with: ./scripts/gen-secrets.sh
POSTGRES_PASSWORD=
JWT_SECRET= # 64+ chars, used to sign ANON_KEY and SERVICE_ROLE_KEY
ANON_KEY= # JWT signed with role=anon (generated by gen-secrets.sh)
SERVICE_ROLE_KEY= # JWT signed with role=service_role
DASHBOARD_USERNAME=admin # Studio basic-auth
DASHBOARD_PASSWORD=
SECRET_KEY_BASE= # used by realtime + auth
VAULT_ENC_KEY= # 32-char hex for Supabase Vault
MEILI_MASTER_KEY=
IMGPROXY_KEY=
IMGPROXY_SALT=
# ─── CHAT AGENT — providers ─────────────────────────────────────────────────
# Primary: Claude Code SDK via OAuth (NEVER use ANTHROPIC_API_KEY in this project).
# The container ships the `claude` CLI and authenticates with CLAUDE_CODE_OAUTH_TOKEN.
# Get a long-lived OAuth token by running `claude setup-token` locally.
CLAUDE_CODE_OAUTH_TOKEN=
CLAUDE_CODE_MODEL=haiku # claude-haiku-4-5 alias; or 'sonnet' for harder cases
# Fallback: OpenRouter — free or paid models when Claude Code is rate-limited.
OPENROUTER_API_KEY=
OPENROUTER_MODEL=deepseek/deepseek-v4-flash:free # primary (free, supports tool calls)
OPENROUTER_FALLBACK_MODEL=nvidia/nemotron-3-super-120b-a12b:free
# Provider selection:
# 'openrouter' → tool calling + AG-UI streaming (Pattern C)
# 'claude-code' → simple Q&A via OAuth subprocess, no tools
# 'auto' → claude-code first, fallback OpenRouter on rate-limit
CHAT_PROVIDER=openrouter
# ─── EMAIL (for Supabase magic-link delivery) ───────────────────────────────
# Pick ONE:
# A) Resend (recommended — free tier 3k/mo)
SMTP_HOST=smtp.resend.com
SMTP_PORT=465
SMTP_USER=resend
SMTP_PASS=
SMTP_FROM=noreply@disclosure.top
SMTP_FROM_NAME="The Disclosure Bureau"
# ─── DATA PATHS (on the VPS) ────────────────────────────────────────────────
# These mount the wiki/, processing/, raw/ trees into the Next.js container.
# Sync via `./scripts/sync-data.sh` (rsync from your laptop).
DATA_WIKI=/data/disclosure/wiki
DATA_PROCESSING=/data/disclosure/processing
DATA_RAW=/data/disclosure/raw
# ─── RETRIEVAL (embed-service + pgvector) ───────────────────────────────────
# DATABASE_URL: Next.js connects to Postgres inside compose (service name `db`).
# For local indexing from your laptop, set this to a tunneled VPS port or local PG.
DATABASE_URL=postgres://postgres:${POSTGRES_PASSWORD}@db:5432/postgres
EMBED_SERVICE_URL=http://embed:8000
# ─── BACKUPS (optional but recommended) ─────────────────────────────────────
BACKUP_ENABLED=false
BACKUP_DESTINATION= # e.g., b2:my-bucket/disclosure or s3:bucket/path
BACKUP_PASSWORD= # restic repo encryption key
B2_ACCOUNT_ID=
B2_ACCOUNT_KEY=
BACKUP_CRON="0 3 * * *" # daily 3am UTC
# ─── RESOURCE LIMITS (tuned for 16GB/4cpu VPS) ──────────────────────────────
# Conservative — adjust upward when you see fit.
POSTGRES_SHARED_BUFFERS=256MB
POSTGRES_WORK_MEM=8MB
POSTGRES_MAINTENANCE_WORK_MEM=64MB
POSTGRES_MAX_CONNECTIONS=80
MEILI_MAX_INDEXING_MEMORY=512MB
NEXT_NODE_OPTIONS="--max-old-space-size=768"