Jakob Wennberg
523fba0419
SmtpEmailService (nodemailer 9.0.5, exact-pinned) behind the existing EmailService seam. Provider resolution: EMAIL_PROVIDER wins, else RESEND_API_KEY selects Resend (hosted byte-identical), else SMTP_HOST selects SMTP. From header is built exactly like the Resend service after #1956 (no 'via <app>', fromAddress honored, platform-sender retry). STARTTLS is required by default (requireTLS) with SMTP_REQUIRE_TLS=false as an explicit opt-out for a plaintext LAN relay. Docs, env examples and the generated extension registry updated.
56 lines
2.6 KiB
Bash
56 lines
2.6 KiB
Bash
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
|
|
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
|
|
NEXT_PUBLIC_APP_URL=https://your-domain.com
|
|
CRON_SECRET=generate-a-random-secret
|
|
|
|
# Self-hosted (Docker) flag: disables application-side MFA enforcement.
|
|
NEXT_PUBLIC_SELF_HOSTED=true
|
|
|
|
# Session timeouts are also disabled by default for self-hosted deployments.
|
|
# Uncomment to opt into hosted-style banking-app limits (milliseconds).
|
|
# Automatic logout is additionally opt-in per user (Settings > Security);
|
|
# set NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true to enforce it for everyone.
|
|
# NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS=1800000
|
|
# NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS=43200000
|
|
# NEXT_PUBLIC_SESSION_WARNING_MS=120000
|
|
# NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=false
|
|
# Optional dedicated HMAC secret; otherwise SUPABASE_SERVICE_ROLE_KEY is used.
|
|
# SESSION_TIMEOUT_SECRET=
|
|
|
|
# Optional Cloudflare Turnstile site key for Supabase Auth bot protection.
|
|
# The matching secret is configured in GoTrue/Supabase Auth, never here.
|
|
# Enable provider-side enforcement only after this public key is deployed.
|
|
# NEXT_PUBLIC_TURNSTILE_SITE_KEY=
|
|
|
|
# Set to true when public signup is turned off in your GoTrue/Supabase auth
|
|
# config (GOTRUE_DISABLE_SIGNUP / "Allow new users to sign up" off). GoTrue
|
|
# offers no clean server-side read of that setting, so this flag mirrors it.
|
|
# When true, inviting a teammate who has no account provisions the account
|
|
# server-side via the auth admin invite API (GoTrue must have SMTP configured
|
|
# to deliver that mail) instead of relying on public /register, which GoTrue
|
|
# would reject with "Signups not allowed".
|
|
# The GoTrue redirect URI allow-list (URI Allow List / GOTRUE_URI_ALLOW_LIST)
|
|
# must include /invite/* or the invite email's redirect silently falls back
|
|
# to SITE_URL.
|
|
# AUTH_SIGNUPS_DISABLED=false
|
|
|
|
# Optional: WebSocket origin allowed for Supabase Realtime in the CSP.
|
|
# Defaults to NEXT_PUBLIC_SUPABASE_URL with https:// replaced by wss://
|
|
# (http:// by ws://). Set only if Realtime is served from another origin.
|
|
# NEXT_PUBLIC_SUPABASE_WS_URL=wss://your-project.supabase.co
|
|
|
|
# Optional: outbound email (invoices, reminders). Pick one provider.
|
|
# 1. Resend (what hosted runs):
|
|
# RESEND_API_KEY=
|
|
# RESEND_FROM_EMAIL=
|
|
# 2. Your own SMTP relay (Swedish mail provider, M365/Workspace relay, Postfix):
|
|
# EMAIL_PROVIDER=smtp
|
|
# SMTP_HOST=
|
|
# SMTP_PORT=587
|
|
# SMTP_SECURE=false # true = implicit TLS on 465, false = STARTTLS required (set SMTP_REQUIRE_TLS=false only for a plaintext LAN relay)
|
|
# SMTP_USER=
|
|
# SMTP_PASS=
|
|
# SMTP_FROM_EMAIL=
|
|
# SMTP_REQUIRE_TLS=true # false only for a plaintext relay on a trusted LAN
|