From 5cc60505dda4796ecb4faefd72ae8ecfdfb7d22a Mon Sep 17 00:00:00 2001 From: Andrei Jiroh Halili Date: Mon, 29 Jun 2026 15:03:01 +0000 Subject: [PATCH] chore(dotenvx): update configs behind the scenes We got dotenvx-powered encrytion, baby! Signed-off-by: Andrei Jiroh Halili --- .env.production | 56 ++++++++++++++++++++++++++++++++++++-------------------- 1 file(s) changed, 36 insertion(s)(+), 20 deletion(s)(-) diff --git a/.env.production b/.env.production --- a/.env.production +++ b/.env.production @@ -1,6 +1,13 @@ +#/-------------------[DOTENV_PUBLIC_KEY]--------------------/ +#/ public-key encryption for .env files / +#/ [how it works](https://dotenvx.com/encryption) / +#/----------------------------------------------------------/ +DOTENV_PUBLIC_KEY_PRODUCTION="0255654bcea210e7628432a2afeb5879eba3a3bfa9236b3f05bd6c5ef5dd16d3cd" + # This is the production configuration for our Tranquil PDS instance as environment variables. # Secrets are encrypted and loaded via the dotenvx cli (https://dotenvx.com) and its -# DOTENV_PRIVATE_KEY_PRODUCTION are kept secure on 1Password and Doppler. +# DOTENV_PRIVATE_KEY_PRODUCTION are kept secure on dotenvx armor (https://dotenvx.com/armor), +# alongside being backed up safely on Recap Time Squad's 1Password team account. # # See https://tangled.org/tranquil.farm/tranquil-pds/blob/main/example.toml for the full # list of supported configuration and their docs on how to set up one. @@ -49,37 +56,44 @@ ## pds frontend settings ## FRONTEND_ENABLED=true -#FRONTEND_DIR=/tbd +FRONTEND_DIR=/home/ajhalili/infra/recaptime-dev/pds/dist/frontend ## database settings ## # Tranquil PDS requires Postgres for data presistence, so we'll encrypting that via dotenvx -DATABASE_URL= +# Currently utilizing Uberspace 8 Beta's Postgres server for now :3 +POSTGRES_USER=ajhalili +POSTGRES_PASS=encrypted:BEww6ODHc4OT9Cv8HUETM+4u6qDEfWhewj9c2VGpUjH+ESaSIK/mW1SrCdzdiCzuSEXHlTvJiMuowNma74Hyyrdif/D4YGyFm4KU6kSUt/1x9fz58qx8Wy/kcaDvOHrRxLpVeqbDkeoufWfFTi0eUkFHuWhc2vMeJBBS+REoSBrWVMRwap7TR9Y= +POSTGRES_HOST=localhost +POSTGRES_PORT=5432 +POSTGRES_DATABASE=ajhalili +DATABASE_URL="postgres://${POSTGRES_USER}:${POSTGRES_PASS}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DATABASE}" ## secrets ## -JWT_SECRET= -DPOP_SECRET= -MASTER_KEY= -PLC_ROTATION_KEY= +JWT_SECRET=encrypted:BLmmqNPF739CN09NYhQTemuqv8EP7p6AMUgrSC0HG8QdBuzOmAyq+EqSuwqCjP3rz5En4E0YP8/zsevWELT3yblBVgnOJHfnrA7kDJeK2sWpTUe1dGz3RyLLru0lI/bI5Y/xtdHAlpdivXjpwnTTjC631eecT35OWCfJtG61E6RCSjawOkAwXKUjTjxp2RVAxPOeWOm0X+MlsfWKs//uOiE= +DPOP_SECRET=encrypted:BKb9/+03IzwKDxdcnRfBqiwez6xKovJeUdZxky0msxzALAKzr28Px4uzVQ5UKWwBjBLUixCuKcIfXJnyYDkCGfv8dpW+tPxsc+qArwkBRrLCkCmIsVFuDhA0DM6C8QQG7upwhduY2yXjOHWTNV25szhIHPy/ombxFUdc7JLi4pXKHdnO/R9gVA7hnYo/VxQh9Vt9EVkWVWAzxuiQMpaM2B4= +MASTER_KEY=encrypted:BLBGuUjUbaXdn4xAwdfGLdUYll+16X5pq1OLLTAMP/bjndIzE3oRtL1PCCRKsIRNzfv15FS1thgnrm9iXxOmVP0R0tysUV6YmlSghXO8IspMPGJtQeQD6x7uYbW1LB54b4icgnN490eyuUchF4p8o1Jo2FEMj674CXVbZ/AfnXhIE4P8Kqo9qqlfqi14DJx1DJHpBtW71Sebxp3PlWXqm54= +PLC_ROTATION_KEY=encrypted:BC9fwjGYDu/q+OjigXmar89AOgoSs3oNpQYLKGpjJFIxf/KKEHKQO+Jqye/MU9jNj7r/tb7D8vxEfKacRFEk96YF/27kehuIrpV0CNKy6y4pUjtF9H+XW0KYYW4BeFxoeI48FTuG6SbBw6BZTxeYjTItxhZm282HxxvTVHOxma2fC2DsLNTHYUnmb+NfL+yA ## caching ## CACHE_BACKEND=valkey -VALKEY_URL= +# manage infra: https://cloud.redis.io/#/databases/14421126/subscription/3320496/view-bdb/configuration +VALKEY_URL=encrypted:BKRyEJ1/flHm+3Avh9t1c9VmBQSYlmKHFPCaATn/IPk5KZmZ0Yi0C35r9va00QjoLp0FfN75JQb+9uVPMp7+O31JG+OIEYjbgYcYWRrt/+HYi+iU4h4TkswJjO5QvjsdZtvz4q8Ze4P7Kc51E+OikpYmsN3ytqjvXtkmbBhhYiberMHQMZDPp6IdcjwFJdu++Hz+08ScaaEGdynyUDOz8A/rhYd4+yMuylqsMwioa3lrF4KgHlFjzzOK03ddhKoGY3k= ## firehose -CRAWLERS=https://bsky.network,https://vsky.network,https://relay.fire.hose.cam,https://relay.fire.hose.cam +CRAWLERS=https://bsky.network,https://vsky.network ## email notifications ## -MAIL_FROM_ADDRESS=pds@notifications.recaptime.dev +MAIL_FROM_ADDRESS=notifications@pds.recaptime.dev MAIL_FROM_NAME="Recap Time Squad PDS" -MAIL_SMARTHOST_HOST=smtp.resend.com -MAIL_SMARTHOST_USERNAME=resend -MAIL_SMARTHOST_PASSWORD= +MAIL_SMARTHOST_HOST=smtp.atmos.email +MAIL_SMARTHOST_USERNAME=pds.recaptime.dev +MAIL_SMARTHOST_PASSWORD=encrypted:BIP4rkuwn0enR3WxKnZ2A7jc9PYmYh1/Czs1FoWbrdpm+CUWAdjG3PXp17PT4XyvsLKpgEDCPiDymM0w1PnR++sGCv+jNb7XVX8JsDnUy9euv4q2HURac7nPLQCre9supyimG/vrGfGDFuA/i5FFNgjCkouSrVXFWOAty3RiQgCXXAQw/WibnUzhdvld6PJAbSQ= MAIL_SMARTHOST_TLS=implicit MAIL_SMARTHOST_PORT=587 ## discord notification serivce ## -DISCORD_BOT_TOKEN= +DISCORD_BOT_TOKEN=encrypted:BMXfmgcx9gNutJ5xWx+ZwJK0qV5cpT9r8j9nzmcF7H+qjp+ZQ/SkuhHySHeNbaS1RDAaRo6T/3ucAqPeSbI97LNhJDn6KSU0zg7rBdMl3ORcfTdwxqZYx9s/vBIRz6k7M9fORhEoDbvvOpbr+7RE51Bq3Xa6ea7n1FCa+dnwm0iOZNAnKhNmtSR+VhhSCKIAh4eYNqXbJSyap9K82EcY5UqYcU7rtKYL8w== ## telegram notification service ## TELEGRAM_BOT_TOKEN= @@ -89,16 +103,18 @@ ## signal notification service ## SIGNAL_ENABLED=false ## SSO Toolkit ## +# If you setting up OAuth2/OIDC-based SSO for your Tranquil PDS instance, make +# sure the redirect_uri is set to 'http(s)://${PDS_HOSTNAME}/oauth/sso/callback'. # Discord auth SSO_DISCORD_ENABLED=true -SSO_DISCORD_CLIENT_ID= -SSO_DISCORD_CLIENT_SECRET= +SSO_DISCORD_CLIENT_ID=1508079226329239632 +SSO_DISCORD_CLIENT_SECRET=encrypted:BOetj4yYBA0rr8ZwkY+uY0R6lbPX4udhvT1pdlcw5WcQ+MqGp7/GPaLXkWhXdhShLXlpRn/k7P8b25t/yX+44/fOm4bT+OJvuo2zQ2ex5AVjqb5oPOwtHVdSDymq3e46MxP+WSZFRfaUslFxqdkjb/25gUDxx8YLs5qeXRJWfjz9 # GitHub auth SSO_GITHUB_ENABLED=true -SSO_GITHUB_CLIENT_ID= -SSO_GITHUB_CLIENT_SECRET= +SSO_GITHUB_CLIENT_ID=Ov23liR2x94VB0Wyo6Sk +SSO_GITHUB_CLIENT_SECRET=encrypted:BLnKTTmTC7pA2WXtnXC6i+uKLensaF+qVp6jnv81eXhiHBEn/tt5J6CGppDrSG1IlBzdSnJh9rAXiifnFQZ6j7NsYnwA97YM3F3KNV4iW3P6/ndBNVXUfmx0QxoYkscXg/0yx/iPEETmCBA0QTlxLYBLkgfFQ4CSarBKkbXHu9iPWwR1Yfy7K8c= # GitLab auth SSO_GITLAB_ENABLED=true @@ -108,7 +124,7 @@ SSO_GITLAB_CLIENT_ISSUER="https://gitlab.com" SSO_GITLAB_DISPLAY_NAME="GitLab.com" # Authentik as OIDC provider -SSO_OIDC_ENABLED=true +SSO_OIDC_ENABLED=false SSO_OIDC_CLIENT_ID= SSO_OIDC_CLIENT_SECRET= SSO_OIDC_ISSUER="https://accounts.recaptime.dev" @@ -120,4 +136,4 @@ REPORT_SERVICE_DID= ## account data imports ## ACCEPTING_REPO_IMPORTS=true -MAX_BLOB_SIZE=2147483648 \ No newline at end of file +MAX_BLOB_SIZE=2147483648 -- tangled.sh