FilesExpand file tree

main

/

.env.example

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

83 lines (69 loc) · 3.31 KB

main

/

.env.example

Copy path

Top

File metadata and controls

• Code
• Blame

83 lines (69 loc) · 3.31 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

# Copy to .env and fill in. Nothing here is loaded automatically in production:

# Railway supplies these as service variables, and `.railway/railway.ts` marks

# every secret as preserve() so it never lands in the repository.

#

# Services are fail-closed. A missing variable does not crash startup; the

# affected route returns 401/503 until it is configured, so you can bring the

# stack up one capability at a time.

# ---------------------------------------------------------------------------

# Shutter Control (apps/control)

# ---------------------------------------------------------------------------

NODE_ENV=development

PORT=3000

# Postgres for the Preview Job ledger. Run migrations before first start:

# pnpm --filter @shutter/control db:migrate

DATABASE_URL=postgres://postgres:postgres@127.0.0.1:5432/shutter

# Master key for Capability Keys stored in the Space Registry. It must decode

# to 32 bytes from hex or base64url. Keep it stable until a maintenance-window

# rotation is available.

SHUTTER_ENCRYPTION_KEY=

# Dedicated read-only credential for the Edge configuration snapshot. It must

# match the Worker's EDGE_CONFIG_TOKEN and contain at least 32 characters.

EDGE_CONFIG_TOKEN=

# Machine credential for the /v1/admin JSON routes (docs/contracts/v1/admin-api.md).

# Use at least 32 random characters. The admin application calls Control with it.

ADMIN_API_TOKEN=

# S3-compatible Media Store. Shared verbatim with imgproxy and both

# Executors; all four must point at the same bucket.

S3_ENDPOINT=https://<account>.r2.cloudflarestorage.com

S3_REGION=auto

S3_BUCKET=shutter-media

S3_ACCESS_KEY_ID=

S3_SECRET_ACCESS_KEY=

# imgproxy. Key and salt are hex; the secret must be at least 32 characters.

IMGPROXY_BASE_URL=http://127.0.0.1:8080

IMGPROXY_KEY=

IMGPROXY_SALT=

IMGPROXY_SECRET=

# The process-start source allowlist used by imgproxy. The admin page derives

# the Space portion and reports origins that this value does not cover.

IMGPROXY_ALLOWED_SOURCES=

# Delivery edge. ORIGIN_AUTH_TOKEN is the shared credential the Worker presents

# to the Railway origin; it must match the Worker's value exactly.

EDGE_BASE_URL=http://127.0.0.1:8787

ORIGIN_AUTH_TOKEN=

# Cache purge. Only needed to exercise Source Purge end to end.

CLOUDFLARE_ZONE_ID=

CLOUDFLARE_CACHE_PURGE_TOKEN=

# Executor callbacks. The token values must match each Executor's

# EXECUTOR_ROLE_TOKEN below.

VIDEO_EXECUTOR_BASE_URL=http://127.0.0.1:3001

VIDEO_EXECUTOR_TOKEN=

PDF_EXECUTOR_BASE_URL=http://127.0.0.1:3002

PDF_EXECUTOR_TOKEN=

# Optional OTLP log export. Leave the endpoint unset for stdout-only logging.

# The endpoint must match the allowlist exactly after normalization; see

# docs/runbooks/logging.md.

# OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=

# OTEL_EXPORTER_OTLP_LOGS_ALLOWED_ENDPOINTS=

# OTEL_EXPORTER_OTLP_LOGS_HEADERS=

# OTEL_EXPORTER_OTLP_LOGS_PROTOCOL=http/json

# OTEL_EXPORTER_OTLP_LOGS_TIMEOUT=5000

# ---------------------------------------------------------------------------

# Video and PDF Executors (apps/executor-video, apps/executor-pdf)

# ---------------------------------------------------------------------------

# Both read the same variables. Run each with its own PORT and role token, and

# with the S3_* values above. The video Executor needs ffmpeg on PATH; the PDF

# Executor also needs poppler-utils.

CONTROL_BASE_URL=http://127.0.0.1:3000

EXECUTOR_ROLE_TOKEN=