Something went wrong. Try again.
Web frontend and supporting services for lance.blue
Something went wrong. Try again.
headquarters .env.example
3.4 kB · 69 lines
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970# Copy to .env for docker compose, or export by hand when running natively.# .env is git-ignored. Nothing in here is needed for ordinary loopback# development — the defaults are the development defaults.# Where the browser reaches the API. Read by the site at build/dev time.# VITE_API_ORIGIN=http://127.0.0.1:3000# The API's listen address. The compose file sets its own (0.0.0.0 inside the# container); natively the default of 127.0.0.1:3000 is correct.# BIND_ADDR=127.0.0.1:3000# Log filter for the API, standard tracing-subscriber EnvFilter syntax.# RUST_LOG=info# --- login (M2) --------------------------------------------------------------# All optional in development: unset, the API runs the loopback OAuth client# with a random per-boot cookie secret.# The site's origin — the one origin CORS admits and where the OAuth callback# redirects back to. Exact match, scheme and port included.# WEB_ORIGIN=http://127.0.0.1:5173# Where the sqlite file (OAuth sessions — a credential store) lives.# DB_PATH=./data/headquarters.sqlite# HMAC key for the session cookie, at least 32 bytes. Required in public mode;# without it in development, sessions do not survive a restart.# SESSION_SECRET=# The userinput.app space flares are filed to, as its at:// URI. Unset,# /api/flare answers that flares are not enabled.# FLARE_SPACE=at://did:plc:a2j2g42ai6v65qpbvb6hmubi/app.userinput.space/3msr5yrvtq22g# helm's index of MegaMek's unit library, which is what tells a match report# the picture each design is drawn with. Read once at startup; unset, or# unreachable, and a report draws each machine as its weight class instead.# The release and the address of its art both come out of the file, so this# names which index and nothing else.# UNIT_INDEX_URL=https://lance.blue/assets/helm/0.51.0/units.json# --- confidential client (public deployments only) ---------------------------# Setting PUBLIC_URL switches to the confidential client: metadata served at# PUBLIC_URL/oauth/client-metadata.json, keys at /.well-known/jwks.json,# Secure cookies. SESSION_SECRET and PRIVATE_KEY_JWK become required.# PUBLIC_URL=https://api.lance.blue# Where the public match reports are published, when that is not this service# itself. The pages live under /reports/, so a CDN in front of the site can# route that prefix here and a shared match is a lance.blue link; this is what# the page's og:url, its card and the link a player copies then say. Unset,# they say PUBLIC_URL.# SHARE_ORIGIN=https://lance.blue# Domain attribute for the session cookie. Set, the browser sends the cookie# to every subdomain, so sibling services holding SESSION_SECRET can verify a# player themselves — and anything proxying to a match container must strip# Cookie on the way through. Must cover PUBLIC_URL's host. Unset: host-only.# COOKIE_DOMAIN=lance.blue# ES256 private JWK — one object, or an array so a rotation can publish the# next key before the old one stops signing. Every key needs a "kid". One way# to mint one:# node -e 'const{generateKeyPairSync}=require("crypto");const j=generateKeyPairSync("ec",{namedCurve:"P-256"}).privateKey.export({format:"jwk"});j.kid=Date.now().toString(36);console.log(JSON.stringify(j))'# PRIVATE_KEY_JWK=# --- docker compose ----------------------------------------------------------# Only if your account is not uid/gid 1000.# HQ_UID=1000# HQ_GID=1000