freesocks-control-plane/.env.beta.example at main · unredacted/freesocks-control-plane · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
# Compose project name — namespaces containers/volumes per deployment
# (default fcp-beta for backward compatibility; use e.g. fcp-prod on other hosts).
# COMPOSE_PROJECT_NAME=fcp-prod

# Beta INFRA env for docker-compose.beta.yml:
#   docker compose -f docker-compose.beta.yml --env-file .env.beta up -d --build
# Copy to .env.beta (gitignored). This is the container infra config (Caddy + the
# Convex backend identity) PLUS the CDN-blinding PUBLIC pins baked into the SPA
# build. The application SECRETS (session keys, pepper, WebAuthn, ...) live on the
# Convex deployment via the deployer / .env.convex (see docs/beta-deploy.md §3).
#
# SEAMLESS FIRST DEPLOY: run `bun run bootstrap` once before `up` (it installs deps first).
# It fills the CHANGE_ME randoms below (INSTANCE_SECRET / POSTGRES_PASSWORD /
# CAP_ADMIN_KEY) AND generates the CDN-blinding keypair (the VITE_FS_* pins here +
# the FS_* secrets in .env.convex), idempotently — re-running never overwrites a
# value that is already set. You then fill only the EXTERNAL creds by hand.

# --- Caddy / public site ---
SITE_ADDRESS=beta.freesocks.org
ACME_EMAIL=ops@freesocks.org
# Client-IP trust: set to the fronting proxy's peer IP/CIDR ONLY when something
# fronts Caddy (Pangolin / CF Tunnel / ngrok / LB). This beta runs behind Pangolin
# over Tailscale, so use the tailnet CIDR (single CIDR; multi-CIDR isn't reliably
# split) and set TRUSTED_PROXY_HOPS=2 on the backend (.env.convex). Empty = Caddy
# is the public edge. Verify via GET /api/v1/admin/client-ip.
# CADDY_TRUSTED_PROXIES=100.64.0.0/10
# Set true ONLY when a real Cloudflare edge fronts this deployment AND the origin
# rejects non-CF traffic (e.g. CF -> Pangolin -> Caddy, where the tunnel is the
# only ingress): Caddy then passes the Cloudflare headers (CF-Connecting-IP +
# the CF-IPCountry/CF-Region-Code/CF-IPCity geo trio) through to the backend,
# which CF_FRONTED (security path + mirror country tiering, .env.convex) and
# the Admin -> Settings analytics IP-source/coarse-location options need.
# Default (unset) strips them all — a spoofed value can then never reach the
# backend. See docs/beta-deploy.md topologies (c)/(d).
# CADDY_TRUST_CF_HEADER=true

# --- Convex backend identity (generate secrets: openssl rand -hex 32) ---
# Changing these invalidates existing admin keys; set once and keep them.
# INSTANCE_NAME also selects the Postgres database (hyphens -> underscores), so
# it must match POSTGRES_DB (compose default freesocks_beta). If you change
# INSTANCE_NAME, set POSTGRES_DB to the same hyphen->underscore value here —
# the compose postgres env, healthcheck, and backup sidecar all read it.
INSTANCE_NAME=freesocks_beta
# POSTGRES_DB=freesocks_beta
INSTANCE_SECRET=CHANGE_ME_openssl_rand_hex_32

# Public origin where the API (/api, HTTP actions) is reachable through Caddy.
CONVEX_SITE_ORIGIN=https://beta.freesocks.org
# Internal deploy/sync origin (on-host `convex deploy` + the dashboard). Keep it
# on localhost; it is bound to 127.0.0.1 by the compose file and never public.
CONVEX_CLOUD_ORIGIN=http://127.0.0.1:3210

# Admin-only host ports (bound to 127.0.0.1 by the compose file).
PORT=3210
DASHBOARD_PORT=6791

# --- Backend tunables (all have compose defaults; override only if needed) ---
# Convex "usenode" action timeout (seconds). Raise if a slow backend/S3 op trips it.
# ACTIONS_USER_TIMEOUT_SECS=120
# Don't phone home; don't echo internal error detail to API clients (keep both on).
# DISABLE_BEACON=true
# REDACT_LOGS_TO_CLIENT=true
# Backend log level. Default silences the per-request HTTP access line (which logs
# the immediate peer's socket) for privacy while keeping warnings/errors; see
# docs/privacy.md. Fall back to `warn` if a Convex version renames that log target.
# RUST_LOG=info,convex-cloud-http=warn

# --- OPTIONAL: expose the Convex dashboard through Caddy (no SSH tunnel) ---
# Off by default (dashboard + deploy API stay 127.0.0.1-only; reach them via an
# SSH tunnel — docs/beta-deploy.md). To expose: UNCOMMENT the two site blocks in
# the Caddyfile, point DNS for BOTH hostnames at this host, set the three vars
# below, `up -d`, then reload Caddy.
#
# SECURITY: the API host fronts the deploy/admin surface (admin key = full
# control). The hostname is NOT secret — Let's Encrypt publishes it to public
# Certificate Transparency logs — so do NOT rely on a random name as the gate.
# Gate the real way: the `@gate remote_ip` IP allowlist in the Caddyfile blocks
# (your operator IPs/VPN), or basic_auth/mTLS; Pangolin (auth + CrowdSec) in
# prod. A non-guessable name is only minor defense-in-depth on top.
# CONVEX_DASHBOARD_ADDRESS=cvx-dash.beta.freesocks.org
# CONVEX_API_ADDRESS=cvx-api.beta.freesocks.org
# CONVEX_DASHBOARD_DEPLOYMENT_URL=https://cvx-api.beta.freesocks.org

# --- Postgres 18 (the datastore; runs as the `postgres` service in the stack) ---
# Use a URL-safe password (it is interpolated into the connection string):
#   openssl rand -hex 24
POSTGRES_PASSWORD=CHANGE_ME_url_safe_hex

# Self-hosted Cap captcha (W1) dashboard/admin key. >=32 chars:
#   openssl rand -hex 24
# The admin dashboard is reachable at /cap (Caddy relaxes the CSP for that
# path so its login works; gate it at the fronting edge — Pangolin/CrowdSec).
# After first boot, open it, create a site key, and put the site key + secret
# into .env.convex (CAP_SITE_KEY / CAP_SECRET). See docs/beta-deploy.md.
CAP_ADMIN_KEY=CHANGE_ME_cap_admin_key_min_32_chars
# Loopback fallback port for the dashboard with no edge/auth in the path
# (ssh -L 3000:127.0.0.1:3000 <host>) — useful if the fronting proxy is down.
# CAP_DASHBOARD_PORT=3000
# Quiet Cap's error logging (privacy: keeps a client IP out of any stack trace).
# On by default; see docs/privacy.md.
# CAP_DISABLE_ERROR_LOGGING=true

# --- Automated Postgres backups (A3, the `backup` service) ---
# Offsite storage is REQUIRED: with BACKUP_S3_* unset the backup container
# exits fatally and CRASH-LOOPS on first deploy (this is intentional — accounts
# are anonymous, so a host-disk loss without an offsite copy is unrecoverable).
# Set the BACKUP_S3_* + BACKUP_AWS_* creds below before `up`, OR, for a
# throwaway/dev stack only, accept the risk explicitly with
# BACKUP_ALLOW_LOCAL_ONLY=true.
BACKUP_INTERVAL_SECONDS=86400
BACKUP_RETENTION=7
# Client-side dump encryption (age, X25519 recipient — generate the keypair
# OFFLINE with `age-keygen` and store the private half in a password manager).
# Strongly recommended: a dump contains accountIdHash + live subscription
# tokens, so an unencrypted bucket compromise yields the readable datastore.
# BACKUP_AGE_PUBLIC_KEY=age1...
# BACKUP_ALLOW_UNENCRYPTED=true
# S3-compatible offsite (e.g. Backblaze B2, Cloudflare R2, MinIO). All required
# together to enable upload.
BACKUP_S3_ENDPOINT=
BACKUP_S3_BUCKET=
BACKUP_S3_PREFIX=db-backups
BACKUP_AWS_ACCESS_KEY_ID=
BACKUP_AWS_SECRET_ACCESS_KEY=
BACKUP_AWS_REGION=auto
# BACKUP_ALLOW_LOCAL_ONLY=true

# --- CDN-blinding (E2EE) PUBLIC pins, baked into the SPA build ----------------
# Generated by `bun run bootstrap` (the private halves go to
# .env.convex as FS_*). The web service's build args read these (compose
# interpolates ${VITE_FS_*}); empty/commented = the SPA ships "dark" (plaintext
# dual-mode over TLS), filled = body-sealing (the account number + proxy URL are
# hidden from a compromised CDN) is ON. Do NOT hand-edit individual values — the
# pins must match the .env.convex secrets, so always (re)generate the whole set
# via the bootstrap or `bun scripts/gen-e2ee-keys.mjs`.
# VITE_FS_SERVER_HPKE_PK=CHANGE_ME_run_bootstrap
# VITE_FS_SERVER_HPKE_KID=CHANGE_ME_run_bootstrap
# VITE_FS_E2EE_SUITE_ID=CHANGE_ME_run_bootstrap
# VITE_FS_MANIFEST_PK=CHANGE_ME_run_bootstrap
# VITE_FS_MANIFEST_PK_PQ=CHANGE_ME_run_bootstrap