frontlit/.env.example at main · codelitdev/frontlit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# Copy this file to .env before `docker compose up` (self-host stack).
# Local Bun development uses docker-compose.local.yml plus apps/*/.env
# instead. Do not commit .env.
# Generate secrets with: openssl rand -base64 48

# --- FrontLit ---------------------------------------------------------------
# Required by frontlit-api. Must be at least 32 bytes.
BETTER_AUTH_SECRET=
# Required on X-Frontlit-Provisioning-Secret for POST /provisioning/teams.
PROVISIONING_SECRET=

# Optional. Creates one administrator account + team + API key on first boot.
# The key is printed once in `docker compose logs frontlit-api`.
SUPER_ADMIN_EMAIL=admin@example.com

# Public origins. Keep these for local Compose. For a public deployment, use
# the externally reachable HTTPS origins and set ENABLE_TRUST_PROXY=true.
API_PUBLIC_URL=http://localhost:4000
WEB_CLIENT=http://localhost:3000
WEB_BASE_URL=http://localhost:3000
SITES_BASE_URL=http://localhost:3002
PLATFORM_SITE_DOMAIN=localhost
# Optional: FrontLit's own team id; it may use reserved subdomains and the
# PLATFORM_SITE_DOMAIN apex as its custom domain (dogfooding).
PLATFORM_TEAM_ID=
ENABLE_TRUST_PROXY=false

# Optional published host ports.
API_PORT=4000
WEB_PORT=3000
SITES_PORT=3002
SENDLIT_API_PORT=3001

# Postgres is published on loopback only so `bun run dev:api` can still use it.
# POSTGRES_BIND=127.0.0.1
# POSTGRES_PORT=5433
# POSTGRES_USER=frontlit
# POSTGRES_PASSWORD=frontlit
# POSTGRES_DB=frontlit

# Optional platform SMTP (login OTPs). In development the OTP is logged.
EMAIL_HOST=
EMAIL_PORT=587
EMAIL_USER=
EMAIL_PASS=
EMAIL_FROM=

# Optional integrations.
MEDIALIT_APIKEY=
MEDIALIT_SERVER=https://api.medialit.cloud
# Public sites cache pages and refresh them the moment content is published.
# Without this secret they refresh at most once a minute instead.
REVALIDATE_WEBHOOK_SECRET=
# Optional: Redis for a cache shared by several frontlit-sites replicas
# (passed to frontlit-sites as REDIS_URL). One replica doesn't need it.
SITES_REDIS_URL=
# Image hosts the public sites resize through their optimizer, comma
# separated (default: cdn.medialit.cloud,images.unsplash.com). Build time:
# rebuild frontlit-sites after changing it.
IMAGE_REMOTE_HOSTS=

# --- Optional edge cache / CDN (docs/site-delivery.md §5) -------------------
# none (default): FrontLit's own cache only. ttl: any CDN or proxy in front
# may keep pages EDGE_CACHE_TTL seconds. purge: pages stay at the edge until
# frontlit-api purges them (needs EDGE_PURGE_* below).
EDGE_CACHE_MODE=none
EDGE_CACHE_TTL=60
# Purge adapter used by frontlit-api in purge mode: http (signed POST to
# EDGE_PURGE_URL) or cloudflare. deploy/edge-cache sets the URL itself and
# only needs EDGE_PURGE_SECRET.
EDGE_PURGE_ADAPTER=http
EDGE_PURGE_URL=
EDGE_PURGE_SECRET=
# EDGE_PURGE_ADAPTER=cloudflare: the zone custom hostnames live in, and an
# API token with the Zone → Cache Purge permission.
CLOUDFLARE_ZONE_ID=
CLOUDFLARE_API_TOKEN=
# deploy/edge-cache (Varnish) only: published port and cache size.
EDGE_PORT=8080
VARNISH_SIZE=512M
# Optional separate host for /_next/static. Build time.
ASSET_PREFIX=

# Public pages send anonymous Core Web Vitals to frontlit-api's POST /rum
# (scrape /metrics; see deploy/monitoring). Set to "off" to disable.
SITE_RUM=
INTEGRATIONS_ENCRYPTION_KEY=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
# Cloudflare Turnstile. The secret alone turns on CAPTCHA for public forms;
# add the site key to also protect the sign-in page.
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=
AUTH_COOKIE_DOMAIN=

# Optional documentation GitHub App. See /self-hosting/github-app in the docs.
# Set all values from one App registration; subscribe to push, pull_request,
# and check_run. Compose passes these through the API's env_file.
GITHUB_DOCS_APP_ID=
GITHUB_DOCS_APP_SLUG=
GITHUB_DOCS_CLIENT_ID=
GITHUB_DOCS_CLIENT_SECRET=
# Complete PEM key; literal \n escapes are supported.
GITHUB_DOCS_PRIVATE_KEY=
GITHUB_DOCS_WEBHOOK_SECRET=
GITHUB_DOCS_CALLBACK_URL=
GITHUB_DOCS_WEB_ORIGIN=

# --- SendLit (bundled email engine) ----------------------------------------
# Generate each independently.
SENDLIT_BETTER_AUTH_SECRET=
SENDLIT_PIXEL_SIGNING_SECRET=
SENDLIT_ESP_CREDENTIALS_ENCRYPTION_KEY=
SENDLIT_SUPPRESSION_HASH_KEY=

# On first boot, SendLit creates this administrator's default organization
# and logs a one-time scoped organization API key. Paste it below.
SENDLIT_SUPER_ADMIN_EMAIL=

# Inside Compose, FrontLit talks to SendLit on the Docker network. After the
# first SendLit boot, set the one-time key from:
#   docker compose logs sendlit-api
# then `docker compose up -d frontlit-api` so FrontLit picks it up.
SENDLIT_API_URL=http://sendlit-api:3001
SENDLIT_ORGANIZATION_API_KEY=

# Public URLs used by SendLit when it runs behind a reverse proxy. The
# defaults in docker-compose.yml are suitable for local Compose.
# SENDLIT_NODE_ENV=production
# SENDLIT_API_PUBLIC_URL=https://sendlit-api.example.com
# SENDLIT_WEB_CLIENT=https://sendlit.example.com
# SENDLIT_PROTOCOL=https
# SENDLIT_DOMAIN=sendlit.example.com