rfc123/.env.example at main · cat-ph/rfc123 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# GitHub OAuth App credentials
GITHUB_CLIENT_ID=your_github_oauth_app_client_id
GITHUB_CLIENT_SECRET=your_github_oauth_app_client_secret

# Read-only fallback token for logged-out visitors. Used by the landing-page
# showcase widget and to render *public* RFC repos without a sign-in (so
# /rfcs/<owner>/<public-repo>/<n> is shareable as a marketing link).
# A plain PAT with no scopes is enough (public repos don't require any). The
# token is never used for writes.
PUBLIC_GITHUB_TOKEN=

# NextAuth configuration
# Generate a random secret with: openssl rand -base64 32
AUTH_SECRET=your_random_secret_here

# Externally-visible app URL. Used by NextAuth for callback construction,
# by the Slack OAuth routes for the redirect URI, and by the Convex cron
# to call back into Next.js. In local dev behind a tunnel (e.g. ngrok),
# set this to the public URL, NOT http://localhost:3000.
NEXTAUTH_URL=https://your-domain.com

# PostHog configuration
NEXT_PUBLIC_POSTHOG_KEY=your_posthog_project_api_key
NEXT_PUBLIC_POSTHOG_HOST=https://us.posthog.com

# PostHog source map upload (set on Vercel only; leave unset locally to skip).
# POSTHOG_PERSONAL_API_KEY is a personal API key with `error tracking: write`
# scope: https://us.posthog.com/settings/user-api-keys
# POSTHOG_PROJECT_ID is the numeric project id from project settings.
POSTHOG_PERSONAL_API_KEY=
POSTHOG_PROJECT_ID=

# Convex URL the browser hits. For Convex Cloud this is the deployment URL
# (`npx convex dev` provisions it). For self-hosted Convex this is the public
# URL of the backend container, e.g. https://convex.yourdomain.com. The default
# below works for the bundled docker-compose stack on localhost.
NEXT_PUBLIC_CONVEX_URL=http://localhost:3210

# Optional: separate URL the Next.js *server* uses to reach Convex. Defaults to
# NEXT_PUBLIC_CONVEX_URL. Set this when the server side needs to use an
# internal hostname (e.g. CONVEX_URL=http://backend:3210 inside docker-compose
# while the browser uses http://localhost:3210). Leave unset otherwise.
CONVEX_URL=

# Self-hosted Convex only: URL + admin key the app uses to push schema and
# functions on startup (in the bundled docker-compose, these point at the
# `backend` service). The admin key is generated once with
#   docker compose exec backend ./generate_admin_key.sh
# Leave both blank when using Convex Cloud.
CONVEX_SELF_HOSTED_URL=
CONVEX_SELF_HOSTED_ADMIN_KEY=

# Self-hosted Convex only: instance identity for the backend container.
# CONVEX_INSTANCE_SECRET must stay stable across restarts so admin keys
# remain valid. Generate with: openssl rand -hex 32
CONVEX_INSTANCE_NAME=rfc123
CONVEX_INSTANCE_SECRET=

# Shared secret between Next.js and Convex. Used in both directions:
# Next.js → Convex (as a function arg) and Convex cron → Next.js (Bearer).
# Generate with: openssl rand -base64 32
# Also set on Convex: npx convex env set SECRET_KEY <value>
# And:               npx convex env set NEXTAUTH_URL <same value as above>
SECRET_KEY=

# Envelope-encryption key for GitHub OAuth tokens stored in Convex. Convex
# only sees ciphertext; without this key (held only by the Next.js side) a
# Convex breach cannot replay tokens against GitHub. Generate with:
#   openssl rand -base64 32
# Rotation: re-encrypt all rows under the new key before retiring the old one.
TOKEN_ENCRYPTION_KEY=

# Slack app credentials (https://api.slack.com/apps, create from manifest)
# To render the manifest with your NEXTAUTH_URL filled in, run:
#   node scripts/render-slack-manifest.mjs
# then paste the output into "Create app from manifest" on api.slack.com/apps.
SLACK_CLIENT_ID=
SLACK_CLIENT_SECRET=

# Upstash Redis (REST). Used as the cache for GitHub API responses, so every
# RFC route depends on it. For self-hosting, the bundled docker-compose runs a
# Redis container with Hiett's serverless-redis-http REST shim in front.
# For hosted Upstash, get URL + token from https://console.upstash.com.
UPSTASH_REDIS_REST_URL=
UPSTASH_REDIS_REST_TOKEN=

# Optional: OpenAI key for AI-generated RFC body summaries and commit messages.
# Without it, both features fall back to non-AI defaults.
OPENAI_API_KEY=