mirror of
https://github.com/BradGroux/veritas-kanban.git
synced 2026-08-28 02:44:59 +00:00
e69bfe8c14
* feat: broker scoped egress approvals * feat: add authenticated SOCKS5 egress * feat: support operator upstream egress proxies * test: hoist workflow service mocks
107 lines
5.2 KiB
Text
107 lines
5.2 KiB
Text
# ============================================================
|
|
# Veritas Kanban — Environment Variables
|
|
# ============================================================
|
|
# Copy this file to server/.env and fill in the values.
|
|
# cp .env.example server/.env
|
|
#
|
|
# Variables marked [REQUIRED] must be set or the server will
|
|
# refuse to start. All others have sensible defaults.
|
|
# ============================================================
|
|
|
|
# ── Server ───────────────────────────────────────────────────
|
|
# Port the HTTP server listens on (default: 3001)
|
|
# PORT=3001
|
|
|
|
# Node environment: development | production | test
|
|
# Controls CSP strictness, logging format, static file serving
|
|
# NODE_ENV=development
|
|
|
|
# ── Security [REQUIRED] ─────────────────────────────────────
|
|
# Admin API key — grants full access to all endpoints.
|
|
# Generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
VERITAS_ADMIN_KEY=
|
|
|
|
# JWT secret for auth token signing/verification.
|
|
# If omitted the server auto-generates one (tokens won't survive restarts).
|
|
# Generate one with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
|
|
# VERITAS_JWT_SECRET=
|
|
|
|
# Enable/disable authentication middleware (default: true)
|
|
# Set to "false" only for local development without auth
|
|
# VERITAS_AUTH_ENABLED=true
|
|
|
|
# Allow localhost requests to bypass authentication (default: false)
|
|
# SECURITY: Keep this disabled unless you explicitly need local bypass for development.
|
|
# VERITAS_AUTH_LOCALHOST_BYPASS=false
|
|
|
|
# Role assigned to localhost-bypass connections: admin | agent | read-only
|
|
# Recommended (if bypass is enabled): read-only
|
|
# VERITAS_AUTH_LOCALHOST_ROLE=read-only
|
|
|
|
# Additional API keys (comma-separated, format: name:key:role,name:key:role)
|
|
# Example: ci:vk_xxx:agent,readonly-bot:vk_yyy:read-only
|
|
# VERITAS_API_KEYS=
|
|
|
|
# ── Data ─────────────────────────────────────────────────────
|
|
# Root directory for persistent data (tasks, config, telemetry).
|
|
# Default: <cwd>/.veritas-kanban
|
|
# VERITAS_DATA_DIR=
|
|
|
|
# Storage backend and optional SQLite location.
|
|
# VERITAS_STORAGE=file
|
|
# VERITAS_SQLITE_PATH=
|
|
|
|
# Required only for governed SQLite DELETE compatibility or expert override mode.
|
|
# Use a stable, unique value for this host; do not reuse it on another machine.
|
|
# VERITAS_SQLITE_TOPOLOGY=single-host
|
|
# VERITAS_SQLITE_HOST_ID=replace-with-stable-host-identity
|
|
|
|
# ── CORS ─────────────────────────────────────────────────────
|
|
# Comma-separated list of allowed origins for CORS and WebSocket.
|
|
# Default (dev): http://localhost:5173,http://localhost:3000,
|
|
# http://127.0.0.1:5173,http://127.0.0.1:3000
|
|
# CORS_ORIGINS=http://localhost:5173,http://localhost:3000
|
|
|
|
# Optional operator HTTP proxy for selective run-scoped egress.
|
|
# Destination policy is still evaluated and the pinned IP is sent through CONNECT.
|
|
# Credentials are held in memory and are not persisted in launch or telemetry evidence.
|
|
# VERITAS_EGRESS_UPSTREAM_PROXY=http://proxy-user:proxy-password@proxy.internal:3128
|
|
|
|
# ── Logging ──────────────────────────────────────────────────
|
|
# Pino log level: fatal | error | warn | info | debug | trace | silent
|
|
# LOG_LEVEL=info
|
|
|
|
# ── Content Security Policy ─────────────────────────────────
|
|
# Use report-only mode (log violations without blocking)
|
|
# CSP_REPORT_ONLY=false
|
|
|
|
# URL to receive CSP violation reports (e.g., https://example.com/csp-report)
|
|
# CSP_REPORT_URI=
|
|
|
|
# ── Rate Limiting ────────────────────────────────────────────
|
|
# Maximum requests per rate-limit window (default: 300)
|
|
# RATE_LIMIT_MAX=300
|
|
|
|
# ── Telemetry ────────────────────────────────────────────────
|
|
# Days to retain raw telemetry events
|
|
# TELEMETRY_RETENTION_DAYS=30
|
|
|
|
# Days after which telemetry is compressed
|
|
# TELEMETRY_COMPRESS_DAYS=7
|
|
|
|
# Prometheus /metrics exposure
|
|
# In production, /metrics requires normal auth with telemetry:read unless one of these is set.
|
|
# PROMETHEUS_METRICS_TOKEN=
|
|
# PROMETHEUS_METRICS_PUBLIC=false
|
|
|
|
# ── External Services ────────────────────────────────────────
|
|
# OpenClaw gateway URL (default: http://127.0.0.1:18789) and optional bearer token.
|
|
# OPENCLAW_GATEWAY_URL=http://127.0.0.1:18789
|
|
# OPENCLAW_GATEWAY_TOKEN=
|
|
|
|
# Optional operator-declared OpenClaw version hint for provider runtime manifests.
|
|
# This does not count as runtime-verified evidence; host registration must verify it.
|
|
# OPENCLAW_GATEWAY_VERSION=
|
|
|
|
# Legacy gateway URL alias.
|
|
# CLAWDBOT_GATEWAY=http://127.0.0.1:18789
|