mirror of
https://github.com/BradGroux/veritas-kanban.git
synced 2026-10-09 05:07:53 +00:00
4189af29cb
- Add webhookUrl to NotificationSettingsSchema - Create clawdbot-webhook-service with fire-and-forget delivery + 1 retry - Hook into broadcastTaskChange and broadcastChatMessage in broadcast-service - Support VERITAS_WEBHOOK_URL and VERITAS_WEBHOOK_SECRET env vars - HMAC-SHA256 payload signing via X-Webhook-Signature header - Add 16 tests covering config, signing, delivery, retry, and payload formatting - Update .env.example with new env var documentation
120 lines
7.7 KiB
Text
120 lines
7.7 KiB
Text
# Veritas Kanban Server - Environment Variables
|
|
# Copy to .env and customize:
|
|
# cp .env.example .env
|
|
|
|
# Server port
|
|
PORT=3001
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# LOGGING
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Log level: trace | debug | info | warn | error | fatal (default: info)
|
|
# Set to 'debug' for verbose output, 'warn' for quieter logs
|
|
LOG_LEVEL=info
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# AUTHENTICATION SETTINGS
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Enable/disable authentication (default: true)
|
|
# Set to "false" to disable auth (NOT recommended for production)
|
|
VERITAS_AUTH_ENABLED=true
|
|
|
|
# Allow unauthenticated requests from localhost (default: false)
|
|
# Useful for local development while keeping auth enabled for remote
|
|
# When enabled, localhost gets the role specified by VERITAS_AUTH_LOCALHOST_ROLE
|
|
VERITAS_AUTH_LOCALHOST_BYPASS=true
|
|
|
|
# Role assigned to unauthenticated localhost connections (default: read-only)
|
|
# Options: read-only, agent, admin
|
|
# ⚠️ WARNING: "admin" grants full access to any local process without credentials
|
|
VERITAS_AUTH_LOCALHOST_ROLE=read-only
|
|
|
|
# Admin API key - has full access to all endpoints
|
|
# Generate a secure key: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
# ⚠️ Key MUST be at least 32 characters. Weak keys like "dev-admin-key" will trigger a startup warning.
|
|
VERITAS_ADMIN_KEY=your-secret-admin-key-here
|
|
|
|
# API keys for agents and services
|
|
# Format: name:key:role,name2:key2:role2
|
|
# Roles: admin, agent, read-only
|
|
# Example:
|
|
VERITAS_API_KEYS=veritas-agent:vk_agent123:agent,dashboard:vk_dashboard456:read-only
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# JWT / SESSION SECRET
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# JWT signing secret for user sessions (password auth).
|
|
# If set, the secret is NEVER written to security.json on disk.
|
|
# If unset, a secret is auto-generated and stored in security.json (legacy)
|
|
# or generated at runtime (ephemeral — sessions won't survive restart).
|
|
# Generate a secure secret: openssl rand -hex 64
|
|
# VERITAS_JWT_SECRET=
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# CORS & NETWORKING
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Allowed CORS origins (comma-separated)
|
|
CORS_ORIGINS=http://localhost:3000,http://localhost:5173,http://127.0.0.1:3000,http://127.0.0.1:5173
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# DATA & STORAGE
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Data directory for tasks, config, logs (default: .veritas-kanban in project root)
|
|
# VERITAS_DATA_DIR=.veritas-kanban
|
|
|
|
# Telemetry retention: days to keep event files before deletion (default: 30)
|
|
# TELEMETRY_RETENTION_DAYS=30
|
|
|
|
# Telemetry compression: days after which NDJSON files are gzip-compressed (default: 7, 0 = disabled)
|
|
# TELEMETRY_COMPRESS_DAYS=7
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# INTEGRATION
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Clawdbot gateway URL for AI agent orchestration
|
|
# CLAWDBOT_GATEWAY=http://127.0.0.1:18789
|
|
|
|
# Webhook URL for pushing task/chat events to an external service (e.g. Clawdbot Gateway).
|
|
# Overrides the webhookUrl value in notification settings if set.
|
|
# VERITAS_WEBHOOK_URL=http://127.0.0.1:18789/webhook
|
|
|
|
# Secret for signing webhook payloads (HMAC-SHA256). Sent in X-Webhook-Signature header.
|
|
# VERITAS_WEBHOOK_SECRET=your-webhook-secret-here
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# RATE LIMITING
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
|
|
# Max API requests per minute per IP (default: 300).
|
|
# Localhost is exempt from general rate limiting.
|
|
# Sensitive endpoints (auth, settings) have a stricter 15 req/min limit.
|
|
# RATE_LIMIT_MAX=300
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# ROLE PERMISSIONS
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
#
|
|
# admin - Full access to all endpoints
|
|
# agent - Can read/write tasks, run agents, manage worktrees
|
|
# read-only - Can only GET endpoints (view tasks, read config)
|
|
#
|
|
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
# AUTHENTICATION METHODS
|
|
# ═══════════════════════════════════════════════════════════════════════════════
|
|
#
|
|
# 1. Authorization header (Bearer token)
|
|
# curl -H "Authorization: Bearer your-api-key" http://localhost:3001/api/tasks
|
|
#
|
|
# 2. X-API-Key header
|
|
# curl -H "X-API-Key: your-api-key" http://localhost:3001/api/tasks
|
|
#
|
|
# 3. Query parameter (for WebSocket)
|
|
# ws://localhost:3001/ws?api_key=your-api-key
|
|
#
|