From 1471fcbfb9c5771648e78b0db89cd833e9d350e1 Mon Sep 17 00:00:00 2001 From: Andrei Jiroh Eugenio Halili Date: Sun, 31 May 2026 20:46:59 +0800 Subject: [PATCH] chore: document configs alongside some major tweaks will set up the secrets locally after this --- .env.production | 99 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 82 insertions(+), 17 deletions(-) diff --git a/.env.production b/.env.production index 2f52083..6f73459 100644 --- a/.env.production +++ b/.env.production @@ -1,58 +1,123 @@ # This is the production configuration for our Tranquil PDS instance as environment variables. # Secrets are encrypted and loaded via the dotenvx cli (https://dotenvx.com) and its # DOTENV_PRIVATE_KEY_PRODUCTION are kept secure on 1Password and Doppler. +# +# See https://tangled.org/tranquil.farm/tranquil-pds/blob/main/example.toml for the full +# list of supported configuration and their docs on how to set up one. -# server +## server settings ## + +# Self-explainatory. Changing this requires manual intervention by either admins or +# account holders themselves to ensure Bluesky and other Atmosphere apps can still +# find their accounts and its data in the form of doing PDS host migrations. PDS_HOSTNAME=pds.recaptime.dev SERVER_PORT=4208 + +# Used for providing user handles for those w/o own domains PDS_USER_HANDLE_DOMAINS=rtdevatp.net.eu.org,rtdevatp.pp.ua,bsky.dino.icu + +# Bypass age assurance related check for now, although we'll reevaulate this as +# legistation regarding age verification go through in the Philippines. PDS_AGE_ASSURANCE_OVERRIDE=true + +# Enabled to prevent signup spam and service abuse. Request one at https://tally.so/r/J9X0dR. INVITE_CODE_REQUIRED=true + +# We maintain a list of banned/reserved words as an abuse prevention measure. +# If it is you, please use another username when using the default user handle suffix above. +# +# Sources for banned words: +# - reserved-usernames: https://github.com/shouldbee/reserved-usernames/blob/0302214e8c1363fc5877ce3343ef6262e8852e96/reserved-usernames.txt +# +# Be warned that this list is long to scroll through. +PDS_BANNED_WORDS="0,about,access,account,accounts,activate,activities,activity,ad,add,address,adm,admin,administration,administrator,ads,adult,advertising,affiliate,affiliates,ajax,all,alpha,analysis,analytics,android,anon,anonymous,api,app,apps,archive,archives,article,asct,asset,atom,auth,authentication,avatar,backup,balancer-manager,banner,banners,beta,billing,bin,blog,blogs,board,book,bookmark,bot,bots,bug,business,cache,cadastro,calendar,call,campaign,cancel,captcha,career,careers,cart,categories,category,cgi,cgi-bin,changelog,chat,check,checking,checkout,client,cliente,clients,code,codereview,comercial,comment,comments,communities,community,company,compare,compras,config,configuration,connect,contact,contact-us,contact_us,contactus,contest,contribute,corp,create,css,dashboard,data,db,default,delete,demo,design,designer,destroy,dev,devel,developer,developers,diagram,diary,dict,dictionary,die,dir,direct_messages,directory,dist,doc,docs,documentation,domain,download,downloads,ecommerce,edit,editor,edu,education,email,employment,empty,end,enterprise,entries,entry,error,errors,eval,event,everyone,exit,explore,facebook,faq,favorite,favorites,feature,features,feed,feedback,feeds,file,files,first,flash,fleet,fleets,flog,follow,followers,following,forgot,form,forum,forums,founder,free,friend,friends,ftp,gadget,gadgets,game,games,get,ghost,gift,gifts,gist,github,graph,group,groups,guest,guests,help,home,homepage,host,hosting,hostmaster,hostname,howto,hpg,html,http,httpd,https,i,iamges,icon,icons,id,idea,ideas,image,images,imap,img,index,indice,info,information,inquiry,instagram,intranet,invitations,invite,ipad,iphone,irc,is,issue,issues,it,item,items,java,javascript,job,jobs,join,js,json,jump,knowledgebase,language,languages,last,ldap-status,legal,license,link,links,linux,list,lists,log,log-in,log-out,log_in,log_out,login,logout,logs,m,mac,mail,mail1,mail2,mail3,mail4,mail5,mailer,mailing,maintenance,manager,manual,map,maps,marketing,master,me,media,member,members,message,messages,messenger,microblog,microblogs,mine,mis,mob,mobile,movie,movies,mp3,msg,msn,music,musicas,mx,my,mysql,name,named,nan,navi,navigation,net,network,new,news,newsletter,nick,nickname,notes,noticias,notification,notifications,notify,ns,ns1,ns10,ns2,ns3,ns4,ns5,ns6,ns7,ns8,ns9,null,oauth,oauth_clients,offer,offers,official,old,online,openid,operator,order,orders,organization,organizations,overview,owner,owners,page,pager,pages,panel,password,payment,perl,phone,photo,photoalbum,photos,php,phpmyadmin,phppgadmin,phpredisadmin,pic,pics,ping,plan,plans,plugin,plugins,policy,pop,pop3,popular,portal,post,postfix,postmaster,posts,pr,premium,press,price,pricing,privacy,privacy-policy,privacy_policy,privacypolicy,private,product,products,profile,project,projects,promo,pub,public,purpose,put,python,query,random,ranking,read,readme,recent,recruit,recruitment,register,registration,release,remove,replies,report,reports,repositories,repository,req,request,requests,reset,roc,root,rss,ruby,rule,sag,sale,sales,sample,samples,save,school,script,scripts,search,secure,security,self,send,server,server-info,server-status,service,services,session,sessions,setting,settings,setup,share,shop,show,sign-in,sign-up,sign_in,sign_up,signin,signout,signup,site,sitemap,sites,smartphone,smtp,soporte,source,spec,special,sql,src,ssh,ssl,ssladmin,ssladministrator,sslwebmaster,staff,stage,staging,start,stat,state,static,stats,status,store,stores,stories,style,styleguide,stylesheet,stylesheets,subdomain,subscribe,subscriptions,suporte,support,svn,swf,sys,sysadmin,sysadministrator,system,tablet,tablets,tag,talk,task,tasks,team,teams,tech,telnet,term,terms,terms-of-service,terms_of_service,termsofservice,test,test1,test2,test3,teste,testing,tests,theme,themes,thread,threads,tmp,todo,tool,tools,top,topic,topics,tos,tour,translations,trends,tutorial,tux,tv,twitter,undef,unfollow,unsubscribe,update,upload,uploads,url,usage,user,username,users,usuario,vendas,ver,version,video,videos,visitor,watch,weather,web,webhook,webhooks,webmail,webmaster,website,websites,welcome,widget,widgets,wiki,win,windows,word,work,works,workshop,ww,wws,www,www1,www2,www3,www4,www5,www6,www7,wwws,wwww,xfn,xml,xmpp,xpg,xxx,yaml,year,yml,you,yourdomain,yourname,yoursite,yourusername" + +# Legalese docs PRIVACY_POLICY_URL=https://policies.recaptime.dev/hosted-services/pds/privacy TERMS_OF_SERVICE_URL=https://policies.recaptime.dev/hosted-services/pds/terms -CONTACT_EMAIL=support@pds.recaptime.dev + +# Emails sent here are forwarded by Cloudflare Email Routing to GitLab Service Desk +# as confidential issuess. Note that +CONTACT_EMAIL=support@rtdevatp.net.eu.org + +# We limit the max blob size to 2 GB to avoid spiraling costs. MAX_BLOB_SIZE=2147483648 -# frontend stuff +# Required since we're behind Cloudflare proxy (aka Traefik/Caddy if we do spilt-horizion networking with Tailscale) +TRUSTED_PROXY_COUNT=1 + +## pds frontend settings ## + FRONTEND_ENABLED=true #FRONTEND_DIR=/tbd -# database +## database settings ## + +# Tranquil PDS requires Postgres for data presistence, so we'll encrypting that via dotenvx DATABASE_URL= -# secrets +## secrets ## JWT_SECRET= DPOP_SECRET= MASTER_KEY= PLC_ROTATION_KEY= -# caching +## caching ## CACHE_BACKEND=valkey VALKEY_URL= -# email -MAIL_FROM_ADDRESS=support@pds.recaptime.dev +## firehose +CRAWLERS=https://bsky.network,https://vsky.network,https://relay.fire.hose.cam,https://relay.fire.hose.cam + +## email notifications ## +MAIL_FROM_ADDRESS=pds@notifications.recaptime.dev MAIL_FROM_NAME="Recap Time Squad PDS" -MAIL_SMARTHOST_HOST=janus.uberspace.de -MAIL_SMARTHOST_USERNAME=support@pds.recaptime.dev +MAIL_SMARTHOST_HOST=smtp.resend.com +MAIL_SMARTHOST_USERNAME=resend +MAIL_SMARTHOST_PASSWORD= +MAIL_SMARTHOST_TLS=implicit +MAIL_SMARTHOST_PORT=587 -# discord integration +## discord notification serivce ## DISCORD_BOT_TOKEN= -# telegram bot token +## telegram notification service ## TELEGRAM_BOT_TOKEN= TELEGRAM_WEBHOOK_SECRET= -# signal integration +## signal notification service ## SIGNAL_ENABLED=false -# SSO Toolkit -# TBD +## SSO Toolkit ## + +# Discord auth +SSO_DISCORD_ENABLED=true +SSO_DISCORD_CLIENT_ID= +SSO_DISCORD_CLIENT_SECRET= + +# GitHub auth +SSO_GITHUB_ENABLED=true +SSO_GITHUB_CLIENT_ID= +SSO_GITHUB_CLIENT_SECRET= + +# GitLab auth +SSO_GITLAB_ENABLED=true +SSO_GITLAB_CLIENT_ID= +SSO_GITLAB_CLIENT_SECRET= +SSO_GITLAB_CLIENT_ISSUER="https://gitlab.com" +SSO_GITLAB_DISPLAY_NAME="GitLab.com" + +# Authentik as OIDC provider +SSO_OIDC_ENABLED=true +SSO_OIDC_CLIENT_ID= +SSO_OIDC_CLIENT_SECRET= +SSO_OIDC_ISSUER="https://accounts.recaptime.dev" +SSO_OIDC_DISPLAY_NAME="Recap Time Squad Community SSO" -# moderations ervices +## moderation services ## REPORT_SERVICE_URL= REPORT_SERVICE_DID= -# imports +## account data imports ## ACCEPTING_REPO_IMPORTS=true MAX_BLOB_SIZE=2147483648 \ No newline at end of file -- 2.51.2