178 lines
9.2 KiB
Bash
178 lines
9.2 KiB
Bash
# =============================================================================
|
|
# 0pt (edge plane) -- environment inventory / example environment
|
|
# =============================================================================
|
|
# Copy to `.env` (gitignored) and fill in real values. Never commit real values.
|
|
# Vercel env for the edge app; VPS .env (git-ignored) for infra/docker-compose.yml.
|
|
# See docs/08-infrastructure.md for the canonical description of each integration.
|
|
#
|
|
# Two provenance markers are used below and they mean different things:
|
|
# * "wired in code today" -- read via a `process.env.*` somewhere in
|
|
# this repo right now (grep-verified).
|
|
# * "documented target, not yet read" -- named in docs/08-infrastructure.md /
|
|
# docs/02-architecture.md but with no
|
|
# `process.env.*` read yet. Filling it in
|
|
# unblocks the integration; it does not by
|
|
# itself change behaviour.
|
|
#
|
|
# The app is designed to build and boot with all of these UNSET: lib/db.ts and
|
|
# lib/stripe.ts are lazy + env-guarded, and the storage/payment/doc routes return
|
|
# HTTP 501 ("not configured") until the relevant keys are provided.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Core / public
|
|
# ---------------------------------------------------------------------------
|
|
# Public base URL of this app (used for absolute links / callbacks).
|
|
NEXT_PUBLIC_APP_URL=http://localhost:3000
|
|
# Documented target (docs/08); no call site found reading it in this pass.
|
|
NEXT_PUBLIC_API_URL=https://api.0pt.app
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Database (Postgres) -- wired in code today: lib/db.ts, app/api/health
|
|
# ---------------------------------------------------------------------------
|
|
# Vercel Postgres sets POSTGRES_URL / POSTGRES_PRISMA_URL automatically when the
|
|
# integration is attached. First one set wins, in this order (lib/db.ts):
|
|
# DATABASE_URL -> POSTGRES_URL -> POSTGRES_PRISMA_URL.
|
|
DATABASE_URL=postgres://user:password@localhost:5432/opt
|
|
POSTGRES_URL=
|
|
POSTGRES_PRISMA_URL=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Cache / queue (Redis) -- app/api/health only checks presence; no other call
|
|
# site found reading it in this pass (worker queue usage, if any, lives in
|
|
# services/api, outside this repo's scope).
|
|
# ---------------------------------------------------------------------------
|
|
REDIS_URL=redis://localhost:6379
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Auth -- session / dev-login / service-token secrets (wired in code today)
|
|
# ---------------------------------------------------------------------------
|
|
# Session-signing secret (generate a long random string).
|
|
AUTH_SECRET=change-me-long-random-string
|
|
# AUTH_URL is documented (docs/08) but not yet read by any route in this pass.
|
|
AUTH_URL=https://0pt.app
|
|
# Optional dev-only login shortcut key (leave UNSET in production).
|
|
DEV_LOGIN_KEY=
|
|
# Shared token for internal/service-to-service calls; sent as X-Internal-Token
|
|
# on every engineFetch() call (lib/engine.ts).
|
|
INTERNAL_TOKEN=change-me-internal-token
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Zitadel / OIDC Bearer verification (Wave 2 hardening) -- wired in code today
|
|
# ---------------------------------------------------------------------------
|
|
# 0pt verifies inbound Bearer tokens against the fleet Zitadel IdP
|
|
# (src/auth/zitadel.ts, wired via middleware.ts). JWKS are discovered from
|
|
# <issuer>/.well-known/openid-configuration, falling back to <issuer>/oauth/v2/keys.
|
|
#
|
|
# Fleet Zitadel issuer (OIDC). Default when unset: https://id-customers.siax.io
|
|
ZITADEL_ISSUER=https://id-customers.siax.io
|
|
# Enforcement is FAIL-CLOSED. Leave this UNSET (or set it to "true") and a
|
|
# valid, verified Bearer token is REQUIRED on /api/0pt/* -- 401 on
|
|
# missing/invalid, 403 when X-Tenant-Id disagrees with the token tenant.
|
|
# ONLY the literal value "false" disables authentication, and that value is
|
|
# REFUSED when NODE_ENV=production: the app throws at startup instead of
|
|
# serving openly. Use "false" for local development only.
|
|
AUTH_ENFORCE=true
|
|
# Optional override for the claim key that carries the SIAX tenant id. When
|
|
# unset, tenant derivation uses the documented precedence:
|
|
# urn:zitadel:iam:org:id -> urn:zitadel:iam:user:resourceowner:id -> tenant_id -> tenant.
|
|
ZITADEL_TENANT_CLAIM=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Data engine bridge -- wired in code today: lib/engine.ts
|
|
# ---------------------------------------------------------------------------
|
|
# When set, edge route handlers defer to the FastAPI engine (services/api) as the
|
|
# single source of truth (orders/estimates/catalog/ai-parse). When unset, the edge
|
|
# computes locally / falls back to an honest heuristic -- see lib/engine.ts and
|
|
# app/api/ai/parse.
|
|
ENGINE_URL=http://localhost:8000
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# SIAX platform clients
|
|
# ---------------------------------------------------------------------------
|
|
# src/clients/{cl0ud,n0d,aud0}-client.ts currently only accept an optional
|
|
# constructor baseUrl and fall back to an in-memory mock / no-op -- none of these
|
|
# three vars is read via process.env yet (grep-verified). Setting them does
|
|
# nothing until those clients are wired to read them; a future pass should add
|
|
# that. See docs/ICEBERG_WRITE_BOUNDARY.md.
|
|
CL0UD_URL=
|
|
N0D_URL=
|
|
AUD0_URL=
|
|
# INF0 (AI OS) -- documented target, not yet read by any code in this repo.
|
|
# Route AI-parsning / model calls through the gateway instead of raw provider keys.
|
|
INF0_URL=
|
|
# ST0RE_URL is the convention name for src/clients/st0re-client.ts /
|
|
# st0re-lakehouse-client.ts and is read by the real-infra test suite
|
|
# (tests/p0/*.realinfra.test.ts). The lakehouse write path was live-verified
|
|
# against ST0RE on 2026-07-13 with this set; unset, the clients fall back to
|
|
# their deterministic in-memory mocks.
|
|
ST0RE_URL=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Payments (Stripe) -- wired in code today: app/api/payments/*,
|
|
# app/api/webhooks/stripe
|
|
# ---------------------------------------------------------------------------
|
|
STRIPE_SECRET_KEY=sk_test_xxx
|
|
STRIPE_WEBHOOK_SECRET=whsec_xxx
|
|
# Documented target (docs/08); not yet read by any route in this pass.
|
|
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Object storage -- Cloudflare R2 / S3-compatible
|
|
# ---------------------------------------------------------------------------
|
|
# R2_ENDPOINT / R2_BUCKET / R2_ACCESS_KEY_ID are read in code today; all three
|
|
# are required to enable /api/uploads, otherwise it returns 501.
|
|
# R2_ACCOUNT_ID and R2_SECRET_ACCESS_KEY are documented in docs/08 but were NOT
|
|
# found via a process.env.* read in this pass -- verify before assuming the R2
|
|
# client is fully wired.
|
|
R2_ENDPOINT=https://<accountid>.r2.cloudflarestorage.com
|
|
R2_BUCKET=opt-uploads
|
|
R2_ACCESS_KEY_ID=change-me
|
|
R2_ACCOUNT_ID=
|
|
R2_SECRET_ACCESS_KEY=
|
|
# Fallback local artifact store used when no object storage is configured
|
|
# (src/adapters/local-blob-store.ts). Leave unset in production.
|
|
OPT_LOCAL_BLOB_DIR=./.opt-blobs
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Document intelligence / OCR (Azure) -- wired in code today:
|
|
# src/services/document-extraction-service.ts. Unset => extraction
|
|
# "not configured".
|
|
# ---------------------------------------------------------------------------
|
|
DOC_INTELLIGENCE_ENDPOINT=https://<resource>.cognitiveservices.azure.com
|
|
DOC_INTELLIGENCE_KEY=change-me
|
|
DOC_INTELLIGENCE_API_VERSION=2024-11-30
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Customer DB-grant encryption -- wired in code today:
|
|
# /api/connections/db-grant
|
|
# ---------------------------------------------------------------------------
|
|
# 32-byte key, AES-GCM. Encrypts customer-supplied read-only connection strings
|
|
# at rest.
|
|
GRANT_ENC_KEY=change-me-32-byte-key
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# External write-back targets
|
|
# ---------------------------------------------------------------------------
|
|
# Odoo base URL for the bills/write-back adapter.
|
|
ODOO_BASE_URL=https://<your-odoo-host>
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Email -- Resend (documented target, docs/08; no Resend call site found in
|
|
# this pass -- treat as not-yet-implemented, not just unconfigured)
|
|
# ---------------------------------------------------------------------------
|
|
RESEND_API_KEY=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Embedded analytics (documented target, docs/08; no call site found in this
|
|
# pass)
|
|
# ---------------------------------------------------------------------------
|
|
METABASE_SITE_URL=
|
|
METABASE_SECRET_KEY=
|
|
NOCODB_BASE_URL=
|
|
NOCODB_API_TOKEN=
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Test-only (tests/p0 real-infra suite; not needed to run the app)
|
|
# ---------------------------------------------------------------------------
|
|
# ST0RE_TEST_TENANT_ID=
|