website/.env.example at dev · DevelopmentFinanceObservatory/website · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# Dev only: LAN hosts (comma-separated) allowed to open the dev server, for
# phone/tablet testing — e.g. DEV_ORIGINS=192.168.1.20
DEV_ORIGINS=

# DFO engine base URL (Search, Datasets and graph APIs). Required: the server
# refuses to start in production without it, and every call to those APIs
# fails in dev. The dev apis service admits only callers with
# roles/run.invoker, so local work reaches it through a proxy that signs each
# call with your gcloud login (docs/development.md, "Reach the dev APIs"):
#   gcloud run services proxy dfo-dev-apis --region northamerica-northeast1 \
#     --project dev-fin-observatory --port 8083
SEARCH_API_BASE=http://localhost:8083

# Browser-side override for the Search API base. Empty means same-origin
# (the app proxies /api/search/* and /api/datasets/*) — set this only to hit
# a remote engine origin directly from the browser.
NEXT_PUBLIC_SEARCH_API_BASE=

# Studio agent (the dfo-ai harness). The proxy under /api/studio/* sends the
# token as a bearer; without it every turn answers 401. Defaults to a harness
# on localhost:8080 when the base is unset.
STUDIO_API_BASE=
STUDIO_TOKEN=

# Accounts and saved conversations (Postgres). Local development only --
# run `just db-up && just db-migrate` first, then this connects as the
# `website_runtime` role db/migrate-local.ts creates. Deployed services
# don't read DATABASE_URL at all; they connect to Cloud SQL via
# WEBSITE_DB_INSTANCE_CONNECTION_NAME, WEBSITE_DB_USER, and WEBSITE_DB_NAME
# instead (set by dfo-infra). The schema lives in db/schema.ts; migrations
# are generated with `pnpm db:generate`.
DATABASE_URL=postgresql://website_runtime:website_runtime_dev_password@localhost:5433/website

# Better Auth. The secret signs sessions (32+ random bytes, e.g.
# `openssl rand -base64 32`); the URL is this app's own public origin.
BETTER_AUTH_SECRET=
BETTER_AUTH_URL=http://localhost:3000

# Sign-in providers (Better Auth social sign-in). There are no password
# accounts. Each pair is optional: a provider without keys isn't offered on
# /login. Callback URL to register with every provider:
#   <BETTER_AUTH_URL>/api/auth/callback/<google|github|microsoft>
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=

# Email sign-in: /login emails a six-digit code (src/lib/auth/emailSignIn.ts).
# On only when these three and a mail transport (below) are all set, so no
# code is sent without the Turnstile bot check. AUTH_EMAIL_FROM is the From header,
# e.g. DFO Studio <studio@developmentfinance.org>. Turnstile keys come from
# the Cloudflare dashboard; locally, Cloudflare's always-pass test keys work:
# site 1x00000000000000000000AA, secret 1x0000000000000000000000000000000AA.
AUTH_EMAIL_FROM=
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=

# Feedback form (POST /api/feedback, docs/feedback.md). Submissions are
# stored via DATABASE_URL above; each sink below is optional and off when
# unset. The Slack webhook posts each submission to a channel (deployed:
# mounted from Secret Manager by dfo-infra; values that aren't a
# hooks.slack.com URL mean off). Submissions are emailed to FEEDBACK_TO
# through the mail transport below.
FEEDBACK_SLACK_WEBHOOK_URL=
FEEDBACK_FROM=
FEEDBACK_TO=

# Mail transport, for sign-in codes and feedback (src/lib/mail/settings.ts).
# Deployed environments send through the Amazon SES v2 API. AWS STS trades
# the Cloud Run service account's Google ID token, minted for the audience
# SES_TOKEN_AUDIENCE, for temporary credentials for the IAM role
# SES_ROLE_ARN, whose trust policy names that service account and audience.
# No AWS key is stored. SES_REGION is the SES account's region, e.g.
# us-east-1. Setting some of the three but not all turns mail off. The role
# sends only as the address its policy names, studio@developmentfinance.org,
# so AUTH_EMAIL_FROM and FEEDBACK_FROM use that address in the same case. A
# display name in front of it is fine.
SES_ROLE_ARN=
SES_REGION=
SES_TOKEN_AUDIENCE=
# Local work uses SMTP against a mail catcher (e.g. Mailpit), used only when
# the SES settings are unset. The connection must use TLS 1.2 or later, over
# STARTTLS (port 587) unless SMTP_SECURE=true.
SMTP_HOST=
SMTP_PORT=
SMTP_SECURE=
SMTP_USER=
SMTP_PASS=

# Sentry (errors, browser + server; docs/analytics.md). Off without a DSN.
# Usage events need no key — they land in the `event` table.
NEXT_PUBLIC_SENTRY_DSN=
NEXT_PUBLIC_SENTRY_ENVIRONMENT=
# Build only, for source-map upload (Sentry -> Settings -> Auth Tokens).
SENTRY_ORG=
SENTRY_PROJECT=
SENTRY_AUTH_TOKEN=

# --- Platform proxy -------------------------------------------------------------
# The DFO APIs and the MCP servers are mirrored 1:1 under this site's domain
# (/api/search|datasets|graph/* -> dfo-apis, /api/studio/* -> dfo-ai, and
# /mcp -> dfo-ai's combined MCP server at /mcp/). /api/* and /mcp have a
# per-IP rate limit, counted in the website database (table limit_counter).
# RATE_LIMIT_WINDOW_S=60
# RATE_LIMIT_API=120
# RATE_LIMIT_PIN=10
# /mcp is higher because a vendor's address can carry many users.
# RATE_LIMIT_MCP=300
# The harness's own token for its MCP server (MCP_API_TOKEN on dfo-ai);
# attached by the proxy so outside MCP clients don't need it. Unset: the
# caller's own Authorization header is passed through.
MCP_API_TOKEN=
# /mcp names each caller to dfo-ai, and the dfo-apis proxy to dfo-apis, as
# x-dfo-caller: ip:<digest>, an HMAC-SHA-256 of the client address (an IPv6
# address as its /64) keyed by this secret (e.g. openssl rand -hex 32). It
# must equal dfo-apis's DFO_CALLER_HMAC_KEY. If unset, no caller is sent and
# the site logs one warning.
CALLER_HMAC_KEY=
# The secret dfo-apis checks before it trusts x-dfo-caller (its
# DFO_CALLER_PRINCIPAL), sent as x-dfo-caller-principal on every dfo-apis
# call. If unset, the site sends dfo-apis neither header and logs one warning,
# and dfo-apis counts the whole site as one caller.
DFO_CALLER_PRINCIPAL=
# Which X-Forwarded-For entry is the client, counted from the right. 0 (the
# default) is the rightmost, the one Cloud Run's front end appends; add one
# for each load balancer in front of the service.
# TRUSTED_PROXY_HOPS=0
# OpenAI's domain-verification token for the app directory. GET
# /.well-known/openai-apps-challenge returns it as plain text, and 404 while
# it is unset.
OPENAI_APPS_CHALLENGE=