StackAlchemist/.env.example at main · stevenfackley/StackAlchemist · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# StackAlchemist Environment Variables
# ---------------------------------------------------------------------------
# Copy this file to .env and fill in your real secrets.
# See docs/architecture/Dev Environment Setup.md for more details.

# ── Frontend (Next.js) ──────────────────────────────────────────────────────
NEXT_PUBLIC_APP_URL=http://localhost:3000
NEXT_PUBLIC_IS_TEST_SITE=false
ENGINE_API_URL=http://localhost:5000

# ── Test Site Protection (test mirror only) ─────────────────────────────────
# HTTP Basic Auth credentials enforced by src/middleware.ts when
# NEXT_PUBLIC_IS_TEST_SITE=true. Leave blank for prod and local dev.
# /api/healthz is exempt so Docker/tunnel probes keep working.
TEST_SITE_BASIC_AUTH_USER=
TEST_SITE_BASIC_AUTH_PASS=

# ── SEO / Analytics (optional, prod only) ───────────────────────────────────
# Plausible analytics domain (e.g. "stackalchemist.app"). When set, a Plausible
# <script> is injected in the root layout. Left empty → no tracking loaded.
# Never set this for the test site — only prod should report to Plausible.
NEXT_PUBLIC_PLAUSIBLE_DOMAIN=
# Google Search Console verification token (from the GSC HTML tag method,
# value only — not the full meta tag). Renders as <meta name="google-site-verification" ...>.
GOOGLE_SITE_VERIFICATION=

# ── Backend (.NET API) ──────────────────────────────────────────────────────
# Set to 'Production' to enable production-specific validation (secrets required).
ASPNETCORE_ENVIRONMENT=Development
API_PORT=5000

# ── Demo mode ────────────────────────────────────────────────────────────────
# Outside production the web app runs in demo mode (no sign-in, no database)
# unless this is set to false. Set it to false together with DATABASE_URL,
# QAVREN_AUTH_URL and AUTH_SECRET for the real local stack.
NEXT_PUBLIC_DEMO_MODE=true

# ── Qavren Auth (Keycloak via Auth.js; required in production) ─────────────
# Setting QAVREN_AUTH_URL switches sign-in to the Keycloak realm. Requires DATABASE_URL.
# Local: the qavren-auth compose Keycloak on :8090 with realm stackalchemist-dev,
# and NEXT_PUBLIC_DEMO_MODE=false (see Demo mode above).
# QAVREN_AUTH_URL=http://localhost:8090
# QAVREN_REALM=stackalchemist-dev
# AUTH_SECRET=            # openssl rand -base64 32

# ── Cloudflare R2 (Storage) ─────────────────────────────────────────────────
# Buckets: stackalchemist-generations-dev | *-test | *-prod
R2_ACCOUNT_ID=your-cloudflare-account-id
R2_ACCESS_KEY_ID=your-r2-access-key-id
R2_SECRET_ACCESS_KEY=your-r2-secret-access-key
R2_BUCKET_NAME=stackalchemist-generations-dev

# ── Cloudflare Tunnel (Networking) ─────────────────────────────────────────
# Required only for production or staging deployments via Docker Compose.
CLOUDFLARE_TUNNEL_TOKEN=your-cloudflare-tunnel-token

# ── Stripe (Payments) ──────────────────────────────────────────────────────
# Get these from your Stripe Dashboard > Developers > API keys / Webhooks.
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...
STRIPE_SECRET_KEY=sk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...

# ── LLM APIs ───────────────────────────────────────────────────────────────
# Get this from your Anthropic Console (https://console.anthropic.com/).
ANTHROPIC_API_KEY=sk-ant-api03-...
# Anthropic model id. When empty, the engine falls back to claude-sonnet-5-5.
# Bump this value when Anthropic deprecates the current model.
ANTHROPIC_MODEL=claude-sonnet-5-5
# Optional thinking effort for models that take it (low|medium|high|xhigh|max). Default: medium.
# ANTHROPIC_EFFORT=medium
# Encrypts user BYOK API keys before storage (Next.js dashboard) AND decrypts them in the
# Engine when routing a generation to the user's provider/model. MUST be a DISTINCT high-entropy
# value of at least 32 chars — saving a BYOK key requires it and does NOT fall back to
# ENGINE_SERVICE_KEY (finding I3: rotating the engine key would otherwise strand stored keys).
# The Engine keeps a decrypt-time ENGINE_SERVICE_KEY fallback only for keys saved before this rule.
BYOK_ENCRYPTION_KEY=your-long-random-byok-encryption-key

# ── Engine Security ─────────────────────────────────────────────────────────
# Shared secret for Next.js -> Engine API authentication (X-Engine-Key header).
# Required when ASPNETCORE_ENVIRONMENT=Production.
ENGINE_SERVICE_KEY=your-long-random-service-key

# ── Resend (Transactional Email) ───────────────────────────────────────────
# https://resend.com/api-keys — leave blank to disable email (engine logs only).
# When unset the Engine registers NoOpEmailService so the pipeline never fails
# because email is unavailable.
#
# This key is for the ENGINE's own mail (receipts, build-finished, refund notices)
# over the Resend HTTP API. Sign-in mail (verification, password reset) comes from
# Keycloak, configured in the qavren-auth realm, not from this file.
RESEND_API_KEY=
RESEND_FROM_EMAIL=StackAlchemist <noreply@stackalchemist.app>