NixReaperandClaude Sonnet 5
39b2d4bfcd
CI / lint (push) Canceled after 0s
CI / typecheck (push) Canceled after 0s
CI / unit-tests (push) Canceled after 0s
CI / integration-tests (push) Canceled after 0s
CI / container-build (push) Canceled after 0s
CI / dependency-audit (push) Canceled after 0s
Two real bugs hit during tonight's first production deploy (found and fixed live on the server, folded back into the tracked config so the next deploy doesn't hit either wall): 1. pgbouncer defaults to md5 auth; postgres:17-alpine defaults password_encryption to scram-sha-256. Every connection failed with "wrong password type" until AUTH_TYPE=scram-sha-256 was set explicitly on the pgbouncer service. 2. POSTGRES_USER/PASSWORD/DB were never documented anywhere (not in .env.example, despite docker-compose.prod.yml requiring them) -- added, with a note against `openssl rand -base64` for the password specifically: its output can contain /+=, which breaks pgbouncer's (and any DATABASE_URL parser's) naive URL parsing. Pointed at token_urlsafe instead, matching the other generated secrets. Co-Authored-By: Claude Sonnet 5 <[email protected]>
63 lines
2.0 KiB
Bash
63 lines
2.0 KiB
Bash
# Copy to .env and fill in real values for local development.
|
|
# NEVER commit a real .env file.
|
|
|
|
# --- Runtime ---
|
|
AURORA_ENV=development
|
|
AURORA_LOG_LEVEL=INFO
|
|
AURORA_API_DOCS_ENABLED=true
|
|
|
|
# --- Database ---
|
|
# Async URL used by the application (asyncpg driver).
|
|
DATABASE_URL=postgresql+asyncpg://aurora:aurora@localhost:5432/aurora_core
|
|
# Sync URL used by Alembic migrations (psycopg2 driver).
|
|
DATABASE_URL_SYNC=postgresql+psycopg2://aurora:aurora@localhost:5432/aurora_core
|
|
DATABASE_POOL_SIZE=10
|
|
DATABASE_MAX_OVERFLOW=20
|
|
|
|
# --- Redis ---
|
|
REDIS_URL=redis://localhost:6379/0
|
|
# If false, the app runs without caching/rate-limiting when Redis is unreachable
|
|
# instead of failing readiness checks.
|
|
REDIS_REQUIRED=false
|
|
|
|
# --- Security ---
|
|
# Generate with: python -c "import secrets; print(secrets.token_urlsafe(48))"
|
|
AURORA_SECRET_KEY=changeme-generate-a-real-secret
|
|
# Comma-separated API keys allowed to call /api/v1/admin/* endpoints.
|
|
AURORA_ADMIN_API_KEYS=changeme-admin-key
|
|
|
|
# --- CORS ---
|
|
CORS_ORIGINS=http://localhost:3000,http://localhost:5173
|
|
|
|
# --- Providers ---
|
|
# https://www.themoviedb.org/settings/api
|
|
TMDB_API_KEY=
|
|
|
|
# --- Workers ---
|
|
WORKER_CONCURRENCY=4
|
|
|
|
# --- Caching ---
|
|
CACHE_DEFAULT_TTL=300
|
|
|
|
# --- Rate limiting ---
|
|
RATE_LIMIT_ENABLED=true
|
|
RATE_LIMIT_PER_MINUTE=120
|
|
|
|
# --- Artwork storage ---
|
|
# Local disk, shared between the api and worker containers via a volume
|
|
# (see docker-compose.yml) -- the worker downloads here, the api serves it.
|
|
MEDIA_ROOT=./media
|
|
MEDIA_URL_PREFIX=/media
|
|
ARTWORK_DOWNLOAD_MAX_BYTES=15728640
|
|
|
|
# --- Production only (docker-compose.prod.yml) ---
|
|
# Not used by docker-compose.yml (local dev) or the app itself directly --
|
|
# only interpolated into the postgres/pgbouncer service definitions.
|
|
# Generate POSTGRES_PASSWORD with a URL-safe generator, not `openssl rand
|
|
# -base64`: base64 output can contain `/+=`, which breaks pgbouncer's (and
|
|
# any DATABASE_URL parser's) naive URL parsing.
|
|
POSTGRES_USER=aurora
|
|
# python3 -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
POSTGRES_PASSWORD=changeme-generate-a-real-password
|
|
POSTGRES_DB=aurora_core
|