economy-os/.env.example at main · ildrm/economy-os · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
NODE_ENV=development
HOST=127.0.0.1
PORT=4000
# Local runtime identities are created on the migrated local database by `pnpm db:setup:local`;
# they are non-owner roles and cannot bypass RLS.
DATABASE_URL=postgresql://economyos_app_local:economyos-app-local-only@127.0.0.1:55432/economyos
# Owner credentials are only for migrations and local verification, never the API/worker runtime.
MIGRATION_DATABASE_URL=postgresql://economyos:economyos-local-only@127.0.0.1:55432/economyos
ECONOMYOS_MIGRATION_CONFIRM_DATABASE=economyos
ECONOMYOS_LOCAL_BOOTSTRAP_CONFIRM=local-only
INGESTION_DATABASE_URL=postgresql://economyos_ingest_local:economyos-ingest-local-only@127.0.0.1:55432/economyos
# Integration verification requires all three values, an absent economyos_verify_* database,
# and `pnpm db:prepare` before `pnpm db:verify`. The ownership token makes cleanup fail closed.
# ECONOMYOS_VERIFY_DATABASE=economyos_verify_<unique>
# ECONOMYOS_BENCHMARK_DATABASE=economyos_verify_<same_unique>
# ECONOMYOS_VERIFY_RUN_ID=<non-secret-unique-run-id>
OIDC_ISSUER=https://identity.example.invalid/
OIDC_AUDIENCE=economyos-api
OIDC_SUBJECT_CLAIM=https://economyos.dev/subject_id
OIDC_TENANT_CLAIM=https://economyos.dev/tenant_id
OIDC_WORKSPACE_CLAIM=https://economyos.dev/workspaces
OIDC_JWKS_URI=https://identity.example.invalid/.well-known/jwks.json
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=http://127.0.0.1:4318/v1/traces
S3_REGION=us-east-1
S3_BUCKET=economyos-local
# Local integration uses the pinned S3Mock profile; production must use an approved HTTPS service.
S3_ENDPOINT=http://127.0.0.1:59090
S3_FORCE_PATH_STYLE=true
S3_MAXIMUM_OBJECT_BYTES=50000000
S3_REQUEST_TIMEOUT_MS=30000
AWS_ACCESS_KEY_ID=economyos-local
AWS_SECRET_ACCESS_KEY=economyos-local-only
TEMPORAL_ADDRESS=127.0.0.1:7233
TEMPORAL_NAMESPACE=default
TEMPORAL_TASK_QUEUE=economyos-ingestion-v1
TEMPORAL_TLS=false
# Plaintext Temporal is restricted to an explicit development/test loopback opt-in.
TEMPORAL_ALLOW_INSECURE_LOCAL=true
# Comma-separated key-id:base64url-secret entries permit verification during key rotation.
# Production signing and worker verification keys must be provisioned through the secret manager.
INGESTION_AUTHORIZATION_KEYS=local-v1:ZWNvbm9teW9zLWxvY2FsLWF1dGhvcml6YXRpb24ta2V5LW9ubHk
INGESTION_AUTHORIZATION_MAXIMUM_TTL_MS=900000
INGESTION_AUTHORIZATION_CLOCK_SKEW_MS=30000
INGESTION_AUTHORIZATION_REPLAY_CAPACITY=10000
# Production also requires either TEMPORAL_API_KEY or both mTLS paths below.
# TEMPORAL_API_KEY=
# TEMPORAL_MTLS_CLIENT_CERTIFICATE_PATH=/run/secrets/temporal-client.crt
# TEMPORAL_MTLS_CLIENT_KEY_PATH=/run/secrets/temporal-client.key
# TEMPORAL_SERVER_ROOT_CA_PATH=/run/secrets/temporal-ca.crt
# TEMPORAL_SERVER_NAME_OVERRIDE=namespace.account.tmprl.cloud