server/.env.example at development · PapyrusReader/server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
DEBUG=false
HOST=0.0.0.0
PORT=8080
API_PREFIX=/v1
CORS_ORIGINS='["http://papyrus.localhost:3000"]'
SECRET_KEY=
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=60
REFRESH_TOKEN_EXPIRE_DAYS=30
RATE_LIMIT_AUTH=5
RATE_LIMIT_GENERAL=100
RATE_LIMIT_UPLOAD=60
RATE_LIMIT_BATCH=300
FORWARDED_ALLOW_IPS=127.0.0.1

# Public server URL used in OAuth callbacks and API links.
# Local desktop testing: http://localhost:8080
# Mobile/device or real Google testing: use a public HTTPS URL or tunnel.
PUBLIC_BASE_URL=http://localhost:8080

# Public Flutter app URL used in user-facing email links.
# Local papyrus.localhost testing requires:
#   127.0.0.1 papyrus.localhost
#   ::1 papyrus.localhost
APP_PUBLIC_BASE_URL=http://papyrus.localhost:3000

# Google OAuth web-application credentials.
# Authorized redirect URI should be:
#   <PUBLIC_BASE_URL>/v1/auth/oauth/google/callback
GOOGLE_OAUTH_CLIENT_ID=
GOOGLE_OAUTH_CLIENT_SECRET=
OAUTH_ALLOWED_REDIRECT_SCHEMES=["papyrus"]
OAUTH_ALLOWED_REDIRECT_HOSTS=["localhost","127.0.0.1"]
OAUTH_STATE_EXPIRE_MINUTES=10
AUTH_EXCHANGE_CODE_EXPIRE_MINUTES=5
EMAIL_VERIFICATION_TOKEN_EXPIRE_MINUTES=1440
PASSWORD_RESET_TOKEN_EXPIRE_MINUTES=60

# Local Mailpit defaults when running the API on the host machine.
# If the API itself runs in Docker, use SMTP_HOST=mailpit instead.
EMAIL_DELIVERY_ENABLED=true
SMTP_HOST=127.0.0.1
SMTP_PORT=1025
SMTP_USERNAME=
SMTP_PASSWORD=
SMTP_USE_TLS=false
SMTP_USE_SSL=false
SMTP_FROM_EMAIL=noreply@papyrus.local
SMTP_FROM_NAME=Papyrus

# Dev page frontend assets. In debug mode the backend falls back to Vite when
# no build manifest exists, but setting this explicitly is the easiest local setup.
DEV_PAGES_USE_VITE=true
DEV_PAGES_VITE_URL=http://localhost:5173
DEV_PAGES_MANIFEST_PATH=frontend/dev-pages/dist/.vite/manifest.json

# Enable private indexer and download-client integrations.
ACQUISITION_ENABLED=false
# Server-visible root of the directory shared with qBittorrent. It must expose
# the same user/job-relative layout as the endpoint's qBittorrent download root.
ACQUISITION_IMPORT_ROOT=
ACQUISITION_MONITOR_ACTIVE_INTERVAL_SECONDS=2
ACQUISITION_MONITOR_IDLE_INTERVAL_SECONDS=10
ACQUISITION_MONITOR_LEASE_SECONDS=30

# Prefer file-based PowerSync keys for local development.
# Generate them with: ./scripts/generate_dev_powersync_keys.sh
POWERSYNC_JWT_PRIVATE_KEY_FILE=.local/powersync/private.pem
POWERSYNC_JWT_PUBLIC_KEY_FILE=.local/powersync/public.pem

# Inline PEM values are still supported if you need them.
POWERSYNC_JWT_PRIVATE_KEY=
POWERSYNC_JWT_PUBLIC_KEY=
POWERSYNC_JWT_KEY_ID=papyrus-powersync-dev
POWERSYNC_JWT_PREVIOUS_PUBLIC_KEY=
POWERSYNC_JWT_PREVIOUS_PUBLIC_KEY_FILE=
POWERSYNC_JWT_PREVIOUS_KEY_ID=
POWERSYNC_JWT_AUDIENCE=powersync-dev
POWERSYNC_TOKEN_EXPIRE_MINUTES=5
POWERSYNC_SERVICE_URL=http://localhost:8081
POWERSYNC_SERVICE_PORT=8081
POWERSYNC_JWKS_URI=http://host.docker.internal:8080/v1/auth/jwks
POWERSYNC_SOURCE_ROLE=powersync_role
POWERSYNC_SOURCE_PASSWORD=powersync_dev_password
POWERSYNC_STORAGE_DB=powersync_storage
POWERSYNC_STORAGE_USER=powersync_storage_user
POWERSYNC_STORAGE_PASSWORD=powersync_storage_password
POSTGRES_USER=papyrus
POSTGRES_PASSWORD=papyrus
POSTGRES_HOST=127.0.0.1
POSTGRES_PORT=5432
POSTGRES_DB=papyrus

# Optional public deletion notice for operator-managed backup/exceptional retention.
# Automated backups are not implemented. Planned future expiry: 30 days after deletion.
# ACCOUNT_DELETION_RETENTION_NOTICE="Your server's actual retention policy"

# Optional: fine-grained GitHub token with Issues write access to PapyrusReader/client.
# Keep this secret on the server. Empty disables public support submissions.
# Attachment uploads also require the token owner to have repository write access.
SUPPORT_GITHUB_TOKEN=

# Support routing. Token also needs organization Projects write access.
SUPPORT_GITHUB_REPOSITORY=PapyrusReader/client
SUPPORT_GITHUB_ASSIGNEE=Eoic
SUPPORT_GITHUB_PROJECT_OWNER=PapyrusReader
SUPPORT_GITHUB_PROJECT_NUMBER=1
SUPPORT_GITHUB_BUG_LABEL=bug
SUPPORT_GITHUB_FEATURE_LABEL=enhancement
SUPPORT_GITHUB_BUG_TYPE=Bug
SUPPORT_GITHUB_FEATURE_TYPE=Feature
SUPPORT_GITHUB_STATUS_FIELD=Status
SUPPORT_GITHUB_STATUS=Backlog
SUPPORT_GITHUB_KIND_FIELD=Kind
SUPPORT_GITHUB_KIND=Task