db5c1610b3
- Media (voice/video/image/file): private bucket, presigned PUT upload, reference-only publish, membership-gated presigned GET for viewing - Avatars: public bucket, presigned PUT + direct public URL, profile.update event - messages.media_key + media_meta (migration 1720000000005_media) - Explicit MinIO region on presigning client (avoids getBucketRegion network call) - Event type values sourced from EventType constants (no raw string literals) - Web: attach button, MediaView renderer, avatar upload in topbar Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BFRyKxkKEjfAgpXygzoNiD
69 lines
2.7 KiB
Text
69 lines
2.7 KiB
Text
# ============================================================================
|
|
# Altricade Messenger — environment template.
|
|
# Copy to `.env` (gitignored) and replace every value below.
|
|
# The values here are CLEARLY-FAKE dev placeholders — NEVER use in production.
|
|
# ============================================================================
|
|
|
|
# --- General ---
|
|
NODE_ENV=development
|
|
|
|
# --- Backend (Fastify) ---
|
|
BACKEND_PORT=4000
|
|
# Public base URL nginx exposes the API under (used for CORS, links).
|
|
PUBLIC_API_URL=http://localhost:8080
|
|
|
|
# --- App auth tokens (Phase 1) ---
|
|
# Signing key for short-lived access JWTs. Generate: `openssl rand -base64 48`
|
|
JWT_ACCESS_SECRET=dev-CHANGE-ME-access-secret-not-for-prod
|
|
ACCESS_TOKEN_TTL=15m
|
|
REFRESH_TOKEN_TTL=30d
|
|
|
|
# --- Centrifugo connection token (SEPARATE from app tokens) ---
|
|
# HMAC secret SHARED between backend (mints) and Centrifugo (verifies).
|
|
# Generate: `openssl rand -base64 48`
|
|
CENTRIFUGO_TOKEN_HMAC_SECRET=dev-CHANGE-ME-centrifugo-hmac-not-for-prod
|
|
# API key the backend uses to call Centrifugo's server HTTP API (publish, etc).
|
|
CENTRIFUGO_API_KEY=dev-CHANGE-ME-centrifugo-api-key
|
|
# Internal URL of the Centrifugo HTTP API (service name on the compose network).
|
|
CENTRIFUGO_API_URL=http://centrifugo:8000/api
|
|
# Lifetime of the Centrifugo connection token the backend mints.
|
|
CENTRIFUGO_TOKEN_TTL=1h
|
|
|
|
# --- CORS (comma-separated allowlist; credentials mode, no wildcard) ---
|
|
CORS_ORIGINS=http://localhost:5173,http://localhost:8080
|
|
|
|
# --- Postgres ---
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_DB=altricade
|
|
POSTGRES_USER=altricade
|
|
POSTGRES_PASSWORD=dev-CHANGE-ME-postgres-password
|
|
# Full URL derived from the above (used by backend + migrations).
|
|
DATABASE_URL=postgres://altricade:dev-CHANGE-ME-postgres-password@postgres:5432/altricade
|
|
|
|
# --- Redis (Centrifugo scaling + history/recovery; auth rate-limiting later) ---
|
|
REDIS_HOST=redis
|
|
REDIS_PORT=6379
|
|
REDIS_URL=redis://redis:6379
|
|
|
|
# --- MinIO (object storage: media messages + avatars) ---
|
|
MINIO_ROOT_USER=altricade
|
|
MINIO_ROOT_PASSWORD=dev-CHANGE-ME-minio-password
|
|
MINIO_ENDPOINT=minio
|
|
MINIO_PORT=9000
|
|
MINIO_USE_SSL=false
|
|
MINIO_BUCKET_MEDIA=media
|
|
MINIO_BUCKET_AVATARS=avatars
|
|
# Browser-facing MinIO URL — presigned upload/download URLs are signed for this
|
|
# host, so it must match what the browser uses (dev: the exposed host port).
|
|
MINIO_PUBLIC_URL=http://localhost:9000
|
|
# S3 region used for SigV4 presigning (MinIO default is us-east-1). Set explicitly
|
|
# so presigning never makes a network region-lookup call.
|
|
MINIO_REGION=us-east-1
|
|
|
|
# --- nginx (public entrypoint) ---
|
|
NGINX_HTTP_PORT=8080
|
|
|
|
# --- Web (Vite) ---
|
|
# Base URL the web client points at for REST + realtime.
|
|
VITE_API_URL=http://localhost:8080
|