f89e074dd1
Governed substrate for autonomous agents: scoped identity (passports), audited actions, MCP workspace. Infra IPs and secrets redacted for public release.
98 lines
4.1 KiB
Text
98 lines
4.1 KiB
Text
# GOD CRM Backend Environment Configuration
|
|
# Copy this file to .env and fill in your actual values.
|
|
# NEVER commit .env or .env.prod to git (ADR-064).
|
|
#
|
|
# After D14 (2026-05-18) cutover (ADR-0040), the keys marked
|
|
# "[VAULT-MIGRATED]" below are read from the encrypted `_secrets` registry
|
|
# instead of process.env. On first owner login, add them via:
|
|
# Settings → Secrets (only the space-11 owner can access this tab)
|
|
# For local dev or self-hosters, populating the env values still works
|
|
# as a transitional fallback until D14; after that the env reads are
|
|
# removed from consumer code (see backend/services/secrets/registry.js).
|
|
|
|
# =============================================
|
|
# Core Settings
|
|
# =============================================
|
|
PORT=5000
|
|
NODE_ENV=development
|
|
|
|
# =============================================
|
|
# Bootstrap Secrets — must be in env (never in vault).
|
|
# =============================================
|
|
# AES-256-GCM master key for the SecretsVault — generate with:
|
|
# openssl rand -base64 32
|
|
# Must be set on every host. Production fails-fast if missing.
|
|
SECRETS_MASTER_KEY=your_secrets_master_key_base64_here
|
|
|
|
# JWT / sessions / column-level encryption — bootstrap-only (vault depends on them).
|
|
JWT_SECRET=your_jwt_secret_here_change_in_production
|
|
ENCRYPTION_KEY=your_32_char_encryption_key_here
|
|
MASTER_ENCRYPTION_KEY=your_64_char_hex_master_key_here
|
|
|
|
# =============================================
|
|
# Database Configuration (ADR-017)
|
|
# Options: sqlite | postgres
|
|
# =============================================
|
|
DATABASE_TYPE=postgres
|
|
DATABASE_PATH=/var/lib/business-crm-data/crm.db
|
|
POSTGRES_HOST=localhost
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_DB=godcrm
|
|
POSTGRES_USER=godcrm
|
|
POSTGRES_PASSWORD=your_postgres_password_here
|
|
|
|
# =============================================
|
|
# Application URL
|
|
# =============================================
|
|
APP_URL=http://localhost:5000
|
|
|
|
# =============================================
|
|
# Non-secret integration config (always in env, never in vault).
|
|
# =============================================
|
|
SMTP_HOST=smtp.gmail.com
|
|
SMTP_PORT=587
|
|
SMTP_SECURE=false
|
|
SMTP_FROM=your_email@gmail.com
|
|
|
|
OPENCODE_SERVER_URL=http://localhost:4096
|
|
OPENCODE_SERVER_USERNAME=opencode
|
|
|
|
GOOGLE_OAUTH_REDIRECT_URI=http://localhost:5000/auth/google/callback
|
|
TELEGRAM_ADMIN_CHAT_ID=your_telegram_user_id_here
|
|
NIKITRON_CHAT_ID=your_telegram_user_id_here
|
|
NIKITRON_BOT_NAME=NikitronBot
|
|
WA_DEFAULT_MAP_URL=/maps/office/main.json
|
|
WA_URL=https://wa.hltrn.cc
|
|
LIVEKIT_URL=ws://<RELAY_IP>:7880
|
|
|
|
# =============================================
|
|
# Code Execution Engines (ADR-032)
|
|
# =============================================
|
|
JUDGE0_URL=http://localhost:2358
|
|
PISTON_URL=http://localhost:2000
|
|
BACKEND_URL=http://localhost:5000
|
|
|
|
# =============================================
|
|
# Tier-1 Secrets — moved to Settings → Secrets (ADR-0040).
|
|
# =============================================
|
|
# Adding these to .env is OPTIONAL during the transition (auto-seeded on
|
|
# `node backend/scripts/seed-secrets-from-env.js`). After D14 (2026-05-18)
|
|
# they are read exclusively from the vault and these env lines are deleted
|
|
# from the consumer code paths.
|
|
#
|
|
# [VAULT-MIGRATED] vault_key envName
|
|
# openai_api_key OPENAI_API_KEY
|
|
# anthropic_api_key ANTHROPIC_API_KEY
|
|
# gemini_api_key GEMINI_API_KEY | GOOGLE_AI_API_KEY | GOOGLE_API_KEY
|
|
# replicate_api_key REPLICATE_API_KEY
|
|
# firecrawl_api_key FIRECRAWL_API_KEY
|
|
# telegram_bot_token TELEGRAM_BOT_TOKEN
|
|
# nikitron_bot_token NIKITRON_BOT_TOKEN
|
|
# livekit_api_key LIVEKIT_API_KEY
|
|
# livekit_api_secret LIVEKIT_API_SECRET
|
|
# wa_webhook_secret WA_WEBHOOK_SECRET
|
|
# smtp_user SMTP_USER
|
|
# smtp_pass SMTP_PASS
|
|
# hcaptcha_secret HCAPTCHA_SECRET
|
|
# google_oauth_client_secret GOOGLE_CLIENT_SECRET
|
|
# opencode_server_password OPENCODE_SERVER_PASSWORD
|