Lucas Berger
73fcdaf075
- schema.ts: new pushSubscriptions mysqlTable (user_id FK cascade, endpoint unique, p256dh, auth) - schema.ts: add nullable title varchar(500) to calendarEvents after rawVevent (D-02/NOTIF-01) - 0003_same_xavin.sql: CREATE TABLE push_subscriptions + ALTER calendar_events ADD title - migration applied to dev DB via db:generate + db:migrate (NOT db:push per anti-pattern) - docker-compose.yml: inject VAPID_PUBLIC_KEY/PRIVATE_KEY/SUBJECT into api environment block - .env.example: document all three VAPID vars with placeholders + generation instructions
38 lines
2.4 KiB
Bash
38 lines
2.4 KiB
Bash
# FamilySync — environment variable reference
|
|
# Copy to .env and fill in real values. .env is gitignored and must never be committed.
|
|
#
|
|
# Deployment: these vars are injected into the Docker Compose `api` service via
|
|
# the `environment:` block in docker-compose.yml. All values are resolved at
|
|
# container start time from the host .env file.
|
|
|
|
# ── MariaDB ───────────────────────────────────────────────────────────────────
|
|
DB_PASSWORD=change_me_strong_password
|
|
DB_ROOT_PASSWORD=change_me_root_password
|
|
|
|
# ── OIDC / Authelia ───────────────────────────────────────────────────────────
|
|
# Authorization code + PKCE flow (client_secret_basic). See CLAUDE.md §Authelia.
|
|
OIDC_AUTH_SECRET=change_me_32_char_secret_minimum
|
|
OIDC_ISSUER=https://auth.example.com
|
|
OIDC_CLIENT_ID=familysync
|
|
OIDC_CLIENT_SECRET=change_me_client_secret
|
|
OIDC_REDIRECT_URI=https://familysync.example.com/callback
|
|
OIDC_AUTH_EXTERNAL_URL=https://auth.example.com
|
|
# Scopes granted by the Authelia client definition (must include offline_access for
|
|
# refresh-token session persistence).
|
|
OIDC_SCOPES=openid profile email offline_access
|
|
|
|
# ── App-password encryption ───────────────────────────────────────────────────
|
|
# 32-byte hex key used to AES-256-GCM encrypt Fastmail app passwords at rest.
|
|
# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
APP_PASSWORD_ENCRYPTION_KEY=change_me_64_hex_chars
|
|
|
|
# ── VAPID — Web Push notifications (Phase 5) ─────────────────────────────────
|
|
# Generate a keypair (one-time, per deployment):
|
|
# npx web-push generate-vapid-keys --json
|
|
# VAPID_PUBLIC_KEY is served to the PWA at GET /api/push/vapid-public-key (no secret).
|
|
# VAPID_PRIVATE_KEY signs push messages — treat as a secret; never commit it.
|
|
# VAPID_SUBJECT is a contact URL (mailto: or https:) sent to push services.
|
|
VAPID_PUBLIC_KEY=replace_with_url_safe_base64_public_key
|
|
VAPID_PRIVATE_KEY=replace_with_url_safe_base64_private_key
|
|
VAPID_SUBJECT=mailto:admin@familysync.example.com
|