mirror of
https://github.com/BradGroux/veritas-kanban.git
synced 2026-08-28 02:44:59 +00:00
e69bfe8c14
* feat: broker scoped egress approvals * feat: add authenticated SOCKS5 egress * feat: support operator upstream egress proxies * test: hoist workflow service mocks
138 lines
8.5 KiB
Text
138 lines
8.5 KiB
Text
# Veritas Kanban Server - Environment Variables
|
|
# Copy to .env and customize:
|
|
# cp .env.example .env
|
|
|
|
# Server port
|
|
PORT=3001
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# LOGGING
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Log level: trace | debug | info | warn | error | fatal (default: info)
|
|
# Set to 'debug' for verbose output, 'warn' for quieter logs
|
|
LOG_LEVEL=info
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# AUTHENTICATION SETTINGS
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Enable/disable authentication (default: true)
|
|
# Set to "false" to disable auth (NOT recommended for production)
|
|
VERITAS_AUTH_ENABLED=true
|
|
|
|
# Allow unauthenticated requests from localhost (default: false)
|
|
# Useful for local development while keeping auth enabled for remote
|
|
# When enabled, localhost gets the role specified by VERITAS_AUTH_LOCALHOST_ROLE
|
|
VERITAS_AUTH_LOCALHOST_BYPASS=true
|
|
|
|
# Role assigned to unauthenticated localhost connections (default: read-only)
|
|
# Options: read-only, agent, admin
|
|
# ⚠️ WARNING: "admin" grants full access to any local process without credentials
|
|
VERITAS_AUTH_LOCALHOST_ROLE=read-only
|
|
|
|
# Admin API key - has full access to all endpoints
|
|
# Generate a secure key: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
# ⚠️ Key MUST be at least 32 characters. Weak keys like "dev-admin-key" will trigger a startup warning.
|
|
VERITAS_ADMIN_KEY=your-secret-admin-key-here
|
|
|
|
# API keys for agents and services
|
|
# Format: name:key:role,name2:key2:role2
|
|
# Roles: admin, agent, read-only
|
|
# Example:
|
|
VERITAS_API_KEYS=veritas-agent:vk_agent123:agent,dashboard:vk_dashboard456:read-only
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# JWT / SESSION SECRET
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# JWT signing secret for user sessions (password auth).
|
|
# If set, the secret is NEVER written to security.json on disk.
|
|
# If unset, a secret is auto-generated and stored in security.json (legacy)
|
|
# or generated at runtime (ephemeral — sessions won't survive restart).
|
|
# Generate a secure secret: openssl rand -hex 64
|
|
# VERITAS_JWT_SECRET=
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# CORS & NETWORKING
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Allowed CORS origins (comma-separated)
|
|
CORS_ORIGINS=http://localhost:3000,http://localhost:5173,http://127.0.0.1:3000,http://127.0.0.1:5173
|
|
|
|
# Reverse proxy support (set when behind nginx, Caddy, Traefik, etc.)
|
|
# TRUST_PROXY=1
|
|
|
|
# Optional operator HTTP proxy for selective run-scoped egress.
|
|
# The gateway tunnels only policy-approved, DNS-pinned destinations through it.
|
|
# Credentials remain memory-only and are excluded from durable evidence.
|
|
# VERITAS_EGRESS_UPSTREAM_PROXY=http://proxy-user:proxy-password@proxy.internal:3128
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# DATA & STORAGE
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Data directory for tasks, config, logs (default: .veritas-kanban in project root)
|
|
# VERITAS_DATA_DIR=.veritas-kanban
|
|
|
|
# Storage backend: file | sqlite (default: file)
|
|
# VERITAS_STORAGE=file
|
|
|
|
# SQLite database path when VERITAS_STORAGE=sqlite (default: runtime dir / veritas.db)
|
|
# VERITAS_SQLITE_PATH=.veritas-kanban/veritas.db
|
|
|
|
# Telemetry retention: days to keep event files before deletion (default: 30)
|
|
# TELEMETRY_RETENTION_DAYS=30
|
|
|
|
# Telemetry compression: days after which NDJSON files are gzip-compressed (default: 7, 0 = disabled)
|
|
# TELEMETRY_COMPRESS_DAYS=7
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# INTEGRATION
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Clawdbot gateway URL for AI agent orchestration
|
|
# CLAWDBOT_GATEWAY=http://127.0.0.1:18789
|
|
|
|
# Webhook URL for pushing task/chat events to an external service (e.g. Clawdbot Gateway).
|
|
# Overrides the webhookUrl value in notification settings if set.
|
|
# VERITAS_WEBHOOK_URL=http://127.0.0.1:18789/webhook
|
|
|
|
# Secret for signing webhook payloads (HMAC-SHA256). Sent in X-Webhook-Signature header.
|
|
# VERITAS_WEBHOOK_SECRET=your-webhook-secret-here
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# RATE LIMITING
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Max API requests per minute per IP (default: 300).
|
|
# Localhost is exempt from general rate limiting.
|
|
# Sensitive endpoints (auth, settings) have a stricter 15 req/min limit.
|
|
# RATE_LIMIT_MAX=300
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# ROLE PERMISSIONS
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
#
|
|
# admin - Full access to all endpoints
|
|
# agent - Can read/write tasks, run agents, manage worktrees
|
|
# read-only - Can only GET endpoints (view tasks, read config)
|
|
#
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# AUTHENTICATION METHODS
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
#
|
|
# 1. Authorization header (Bearer token)
|
|
# curl -H "Authorization: Bearer your-api-key" http://localhost:3001/api/tasks
|
|
#
|
|
# 2. X-API-Key header
|
|
# curl -H "X-API-Key: your-api-key" http://localhost:3001/api/tasks
|
|
#
|
|
# 3. Query parameter (for WebSocket)
|
|
# ws://localhost:3001/ws?api_key=your-api-key
|
|
#
|
|
|
|
# Squad Chat Script Configuration
|
|
# VK_HOST=localhost # Host for squad-post.sh (default: localhost)
|
|
# VK_PORT=3001 # Port for squad-post.sh (default: 3001)
|