first-tree/.env.example at main · first-tree-ai/first-tree · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# =============================================================================
# First Tree — Environment Variables
# Copy this file: cp .env.example .env
# =============================================================================
#
# The Server section below is for First Tree SaaS (operated by the First Tree
# team) and dev-only `pnpm --filter @first-tree/server dev` runs. End
# users only need the Client section.
#
# =============================================================================

# ┌───────────────────────────────────────────────────────────────────────────┐
# │ Server (SaaS internal) — Required                                        │
# └───────────────────────────────────────────────────────────────────────────┘

# PostgreSQL connection URL
# Local dev: docker compose up -d (provides postgres at localhost:5432)
# Supabase: use the direct connection (port 5432), NOT pooled (port 6543)
FIRST_TREE_DATABASE_URL=postgresql://firsttree:firsttree@localhost:5432/firsttree

# Transitional S3 read/delete compatibility for payloads written by #2062.
# New uploads are stored in PostgreSQL. Keep these settings during the
# expand/contract rollout until every attachment has a PostgreSQL payload and
# all pre-transition Server replicas have drained.
FIRST_TREE_OBJECT_STORAGE_BUCKET=first-tree-attachments
FIRST_TREE_OBJECT_STORAGE_REGION=us-east-1
FIRST_TREE_OBJECT_STORAGE_ENDPOINT=http://127.0.0.1:9000
FIRST_TREE_OBJECT_STORAGE_FORCE_PATH_STYLE=true
FIRST_TREE_OBJECT_STORAGE_ACCESS_KEY_ID=firsttree
FIRST_TREE_OBJECT_STORAGE_SECRET_ACCESS_KEY=firsttree-dev-secret

# Bind address — MUST be 0.0.0.0 in Docker; 127.0.0.1 for local
FIRST_TREE_HOST=0.0.0.0

# ┌───────────────────────────────────────────────────────────────────────────┐
# │ Server (SaaS internal) — Optional                                        │
# └───────────────────────────────────────────────────────────────────────────┘

# Server port (default: 8000)
# FIRST_TREE_PORT=8000

# JWT signing secret for admin authentication (auto-generated if not set)
# FIRST_TREE_JWT_SECRET=

# AES-256-GCM encryption key for adapter credentials (auto-generated if not set)
# FIRST_TREE_ENCRYPTION_KEY=

# CORS allowed origins (comma-separated)
# FIRST_TREE_CORS_ORIGIN=https://app.example.com

# Deployment-owned GitLab Web Context egress authorization (JSON; default deny).
# Each exact HTTPS origin uses either {"kind":"public"} or explicit CIDRs.
# Team admins cannot extend this policy from Settings.
# FIRST_TREE_GITLAB_EGRESS_ALLOWLIST=[{"origin":"https://gitlab.example.com","addressPolicy":{"kind":"public"}}]

# ┌───────────────────────────────────────────────────────────────────────────┐
# │ OIDC SSO — Private Deployments                                           │
# └───────────────────────────────────────────────────────────────────────────┘

# Auth mode: "standard" (default, Google/GitHub) or "oidc-required" (OIDC only)
# FIRST_TREE_AUTH_MODE=standard

# OIDC provider configuration (all three required when any is set)
# FIRST_TREE_OIDC_ISSUER=https://idp.example.com
# FIRST_TREE_OIDC_CLIENT_ID=
# FIRST_TREE_OIDC_CLIENT_SECRET=

# Public-facing URL (required for OIDC callback derivation in production)
# FIRST_TREE_PUBLIC_URL=https://first-tree.example.com

# ┌───────────────────────────────────────────────────────────────────────────┐
# │ Web Sentry (SaaS internal) — Optional                                    │
# └───────────────────────────────────────────────────────────────────────────┘

# Public browser DSN for the first-tree-web Sentry project. When configured,
# browser error monitoring is enabled by default.
# VITE_SENTRY_DSN=https://public@example.ingest.sentry.io/1
# VITE_SENTRY_ENVIRONMENT=production
# VITE_SENTRY_TRACES_SAMPLE_RATE=0.1

# Build-time source map upload. Missing values skip upload without failing the
# web build. Keep SENTRY_AUTH_TOKEN in CI/platform secrets, not in .env.
# SENTRY_ORG=your-sentry-org
# SENTRY_PROJECT_WEB=first-tree-web

# Rate limiting (requests per minute per IP)
# FIRST_TREE_RATE_LIMIT_MAX=100
# FIRST_TREE_RATE_LIMIT_LOGIN_MAX=5
# FIRST_TREE_RATE_LIMIT_WEBHOOK_MAX=60

# ┌───────────────────────────────────────────────────────────────────────────┐
# │ Server — Dev-only (NEVER set in production)                              │
# └───────────────────────────────────────────────────────────────────────────┘

# Enable the GET /auth/github/dev-callback stub so the web login page's
# "Dev: skip GitHub" button works (signs in as a stable `devuser` /
# "Dev User" identity without a real GitHub OAuth client). The route is
# also gated by `NODE_ENV !== "production"`, so this opt-in is harmless
# in local dev. `pnpm --filter @first-tree/server dev` already sets this
# inline — only set it here if you run the server some other way (custom
# script, Docker dev image, etc.).
# FIRST_TREE_DEV_CALLBACK_ENABLED=1

# Personal access token injected into dev-callback so the Step 2/3 GitHub
# repo picker can hit the real GitHub API in local development without
# going through OAuth. Only honoured when the dev-callback route is reached
# (production builds short-circuit that route entirely). Set in the local
# dev-stack .env, never in a deployed environment.
# DEV_GITHUB_PAT=ghp_xxx

# ┌───────────────────────────────────────────────────────────────────────────┐
# │ Client — Required (for first-tree daemon start)                          │
# └───────────────────────────────────────────────────────────────────────────┘

# Server URL the client connects to
# FIRST_TREE_SERVER_URL=https://first-tree.example.com

# ┌───────────────────────────────────────────────────────────────────────────┐
# │ Client — Optional                                                        │
# └───────────────────────────────────────────────────────────────────────────┘

# Log level (debug | info | warn | error, default: info)
# FIRST_TREE_LOG_LEVEL=info

# Sentry error monitoring for the local Client runtime. It is enabled by
# default when FIRST_TREE_CLIENT_SENTRY_DSN is configured, and can be explicitly
# disabled by operators on user-owned machines.
# FIRST_TREE_CLIENT_SENTRY_DSN=https://public@example.ingest.sentry.io/2
# FIRST_TREE_CLIENT_SENTRY_ENVIRONMENT=production
# FIRST_TREE_CLIENT_SENTRY_ENABLED=true
# FIRST_TREE_CLIENT_SENTRY_TRACES_SAMPLE_RATE=0.05