46 lines
2 KiB
Text
46 lines
2 KiB
Text
# Production env BAKED into the backend image (no Secret Manager).
|
|
# Copy to .env.production and fill in. Keep .env.production out of git (it holds secrets).
|
|
# PORT is intentionally omitted — Cloud Run injects it (8080) and that wins over this file.
|
|
#
|
|
# IMPORTANT: the browser only ever talks to ONE origin — the FRONTEND service URL.
|
|
# The frontend (nginx) reverse-proxies /auth and /api to the backend, so the
|
|
# session cookie stays first-party. Every public URL below is the FRONTEND URL.
|
|
|
|
NODE_ENV=production
|
|
|
|
# The deployed FRONTEND service URL (set after the first deploy). The single
|
|
# public origin. Exact origin, no trailing slash.
|
|
FRONTEND_URL=https://cerebrus-frontend-XXXXXXXX-uc.a.run.app
|
|
|
|
# WorkOS — https://dashboard.workos.com
|
|
WORKOS_API_KEY=
|
|
WORKOS_CLIENT_ID=
|
|
WORKOS_COOKIE_PASSWORD=
|
|
# FRONTEND URL + /auth/callback (proxied to the backend). Register this exact URL
|
|
# as a Redirect URI in the WorkOS dashboard.
|
|
WORKOS_REDIRECT_URI=https://cerebrus-frontend-XXXXXXXX-uc.a.run.app/auth/callback
|
|
|
|
# Supabase Postgres connection string (use the pooler URI).
|
|
DATABASE_URL=
|
|
|
|
# GitHub OAuth App — https://github.com/settings/developers
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
# FRONTEND URL + /api/github/callback (proxied to the backend). Set this exact URL
|
|
# as the OAuth App's Authorization callback URL.
|
|
GITHUB_REDIRECT_URI=https://cerebrus-frontend-XXXXXXXX-uc.a.run.app/api/github/callback
|
|
|
|
# Encrypts stored GitHub tokens at rest. openssl rand -base64 32
|
|
APP_ENCRYPTION_KEY=
|
|
|
|
# Scanner: run scans as Cloud Run Jobs in production.
|
|
SCAN_RUNNER=cloudrun
|
|
# The deployed BACKEND service URL the scanner POSTs results to.
|
|
SCAN_CALLBACK_URL=https://cerebrus-backend-XXXXXXXX-uc.a.run.app
|
|
# Shared secret the scanner sends as x-scan-secret. openssl rand -base64 32
|
|
SCAN_CALLBACK_SECRET=
|
|
# Cloud Run Job to execute (deployed via apps/cli/cloudbuild.yaml). The backend's
|
|
# service account needs run.developer + run.jobsExecutorWithOverrides on the job.
|
|
GCP_PROJECT=
|
|
GCP_REGION=us-central1
|
|
SCAN_JOB_NAME=cerebrus-scanner
|