LearnStack/.env.example at main · HodeTech/LearnStack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
# LearnStack — local dev environment variables (single source of truth).
#
# Copy to `.env` at the repo root (NOT committed — `.gitignore` covers it).
# `infra/compose/dev.yml` and `infra/compose/e2e.yml` read this via the
# `${VAR:-default}` interpolation Compose performs at file-parse time
# (every reference has a dev-safe fallback so the stack still boots even
# without `.env`).
#
# It only reaches Compose through an explicit `--env-file .env`. Compose
# resolves its default env file from the project directory — `infra/compose/` —
# not from the cwd, so a bare `docker compose -f infra/compose/dev.yml …` from
# the repo root ignores this file entirely and every value below falls back.
# `make`, `scripts/seed.sh` and the commands in `infra/*/README.md` pass the
# flag; anything you type by hand has to as well.
#
# The Dapr Vault token chain runs through Dapr's own
# `secretKeyRef` + local-env-secret-store indirection — `.env` → compose
# env → daprd's process env → `secretstore-envvar.yaml` (the
# `secretstores.local.env` component named `envvar-secrets`) →
# `secretstore-vault.yaml` `secretKeyRef`. Dapr does not support a
# `{{env.VAR}}` template; the indirection is the only sanctioned shape.
# See `infra/dapr/README.md` § Vault token for the full walk.
#
# Every value below is a **dev-only** default. Production wires the real
# values through `ISecretProvider` against an authenticated Vault cluster
# per Standards 12 § Secrets Management — `.env.example` is the local
# parity, not the production source.

# ─── Postgres (PostgreSQL 18 per ADR-0031) ───────────────────────────────
# The superuser the container boots as. It owns nothing the application uses:
# every LearnStack table is owned by learnstack_migration below, because an
# owner defeats its own Row Level Security policies and every isolation test
# would then pass against policies that constrain nothing.
POSTGRES_USER=learnstack
POSTGRES_PASSWORD=learnstack
POSTGRES_DB=learnstack

# ─── The four database roles (ADR-0003 Amendment 3) ──────────────────────
# Read by infra/compose/postgres-init/02-create-roles.sql through psql's
# \getenv on first boot. Four roles, four separate login credentials, four
# connection strings — the model is closed and a fifth role requires an ADR.
# An unset variable aborts initdb rather than creating a passwordless role.
LEARNSTACK_MIGRATION_PW=learnstack-migration-dev
LEARNSTACK_APP_PW=learnstack-app-dev
LEARNSTACK_PLATFORM_PW=learnstack-platform-dev
LEARNSTACK_OUTBOX_PW=learnstack-outbox-dev

# ─── The four connection strings ─────────────────────────────────────────
# Double underscore is the .NET environment spelling of `ConnectionStrings:X`.
# These are NOT interchangeable and must not be unified in any environment,
# local development included — see Standards 05 § Database roles.
#
#   Migration        — `make migrate` and the deploy job ONLY. Never present in
#                      API or worker runtime configuration: the role owns every
#                      table, and a runtime that is the owner is the arrangement
#                      FORCE ROW LEVEL SECURITY exists to defeat.
#   Default          — every request-path and job-path DbContext. NOBYPASSRLS.
#   PlatformAdmin    — resolvable only by PlatformAdminScope. BYPASSRLS.
#   OutboxDispatcher — API-owned OutboxProcessor only. Never Seeder or web.
ConnectionStrings__Migration='Host=localhost;Port=5432;Database=learnstack;Username=learnstack_migration;Password=learnstack-migration-dev'
ConnectionStrings__Default='Host=localhost;Port=5432;Database=learnstack;Username=learnstack_app;Password=learnstack-app-dev'
ConnectionStrings__PlatformAdmin='Host=localhost;Port=5432;Database=learnstack;Username=learnstack_platform;Password=learnstack-platform-dev'
ConnectionStrings__OutboxDispatcher='Host=localhost;Port=5432;Database=learnstack;Username=learnstack_outbox_admin;Password=learnstack-outbox-dev'

# ─── Keycloak (two realms per ADR-0004 Amendment 1) ──────────────────────
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=admin-dev-secret

# ─── Vault (-dev mode; token shared with Dapr secret-store component) ────
# Boots the `vault` compose service via `-dev-root-token-id` AND is passed
# into the `dapr-sidecar-api` service env so Dapr's `secretstore-vault.yaml`
# component can resolve `vaultToken` through `secretKeyRef` against the
# local-env secret store (`secretstore-envvar.yaml` → `envvar-secrets`).
# Changing this value updates Vault boot + Dapr auth in one shot.
VAULT_ROOT_TOKEN=learnstack-dev-root-token

# ─── LiveKit (dev key/secret; production rotates via ILiveClassProvider) ─
LIVEKIT_API_KEY=devkey
LIVEKIT_API_SECRET=devsecret-32-byte-min-length-padding-xyz

# ─── Coturn (long-term credentials; production uses use-auth-secret) ─────
COTURN_USER=devuser
COTURN_PASSWORD=devsecret

# ─── SeaweedFS S3 (dev identities; production loads from Vault) ──────────
# These values MUST match `infra/seaweedfs/s3-identities.json` because that
# file is what SeaweedFS actually reads at boot (the binary does not support
# env-var substitution in its identity config). The vars here document the
# canonical credential for the future backend `IStorageProvider` adapter
# (Phase 02b+) and any developer S3 CLI scripts; changing them WITHOUT
# updating the JSON above means the backend tries to talk with a key the
# server has never seen. Production swaps both for Vault-issued credentials.
SEAWEEDFS_ACCESS_KEY=learnstack
SEAWEEDFS_SECRET_KEY=learnstack-dev-secret

# ─── Meilisearch (dev master key; production loads from Vault) ───────────
# Read by the `meilisearch` compose service. Every search request carries it
# as a bearer token; Meilisearch refuses to start in `production` env without
# one. Standards 12 § Development credentials requires the `${VAR:-default}`
# indirection rather than a literal in `dev.yml`.
MEILI_MASTER_KEY=learnstack-dev-master-key

# ─── Backend host (LearnStack.Api, runs on workstation via `dotnet run`) ─
# `dotnet run` reads no `.env`, so these two lines are documentation. The API's launch
# profile, backend/src/LearnStack.Api/Properties/launchSettings.json, sets the same two.
ASPNETCORE_ENVIRONMENT=Development
ASPNETCORE_URLS=http://localhost:5080

# ─── Public renderer (ADR-0053; API and web share this private source) ───
# make public-env fills the empty secret with 32 random bytes encoded as ASCII.
# No TLS/hosts/trust-store changes are automatic. See README Quickstart.
# make public-api loads application/platform-admin/dispatcher DB credentials
# plus network AND secret.
# pnpm dev/start loads these values; an optional web .env.local must match.
LEARNSTACK_PUBLIC_API_ORIGIN=http://127.0.0.1:5080
LEARNSTACK_PUBLIC_HOP_SECRET=
LEARNSTACK_PUBLIC_TLS_CERT=.data/tls/public.pem
LEARNSTACK_PUBLIC_TLS_KEY=.data/tls/public-key.pem