docs: consolidate repository guides and preserve audit history
This commit is contained in:
cesnimda
+54
-62
@@ -1,70 +1,54 @@
|
||||
# Copy this file to `.env` (same folder as docker-compose.yml) and fill in values.
|
||||
#
|
||||
# Used by docker-compose.yml
|
||||
#
|
||||
# Database. deploy/deploy.sh REQUIRES DATABASE_PROVIDER to be set explicitly and
|
||||
# refuses to deploy without it — it selects which backup to take, and guessing it
|
||||
# wrong means backing up the wrong database. Use `mariadb` (or `mysql`) for a
|
||||
# server deployment, `sqlite` for a single-file local one.
|
||||
# Copy to .env beside docker-compose.yml. Never commit real secret values.
|
||||
# Full descriptions: docs/configuration/environment-variables.md
|
||||
|
||||
# =============================================================================
|
||||
# DATABASE
|
||||
# =============================================================================
|
||||
DATABASE_PROVIDER=sqlite
|
||||
# Required when DATABASE_PROVIDER is mariadb/mysql. Ignored for sqlite, which
|
||||
# stores its file in the jobtracker_data volume.
|
||||
# The host resolves from INSIDE the backend container: 127.0.0.1 means the
|
||||
# container, not the Docker host.
|
||||
# Required for mariadb/mysql; ignored for sqlite.
|
||||
JOBTRACKER_CONNECTION_STRING=
|
||||
|
||||
AUTH_JWT_KEY=CHANGE_ME_LONG_RANDOM_SECRET
|
||||
# =============================================================================
|
||||
# AUTHENTICATION, IDENTITY, BILLING
|
||||
# =============================================================================
|
||||
AUTH_JWT_KEY=
|
||||
AUTH_ADMIN_EMAIL=admin@example.com
|
||||
AUTH_ADMIN_PASSWORD=CHANGE_ME_STRONG_PASSWORD
|
||||
# Public signup remains closed until explicitly enabled. Configure both Turnstile keys first.
|
||||
AUTH_ADMIN_PASSWORD=
|
||||
AUTH_ALLOW_REGISTRATION=false
|
||||
# Require local accounts to confirm ownership of their email address before signing in.
|
||||
AUTH_REQUIRE_EMAIL_VERIFICATION=true
|
||||
# Destructive account deletion stays dark-launched until the retention and restore runbook is
|
||||
# approved and rehearsed. The tombstone path is mounted separately by docker-compose.yml.
|
||||
ACCOUNT_DELETION_ENABLED=false
|
||||
TURNSTILE_SITE_KEY=
|
||||
TURNSTILE_SECRET_KEY=
|
||||
# Optional hosted Stripe Checkout. Configure all three values and the customer portal before enabling billing.
|
||||
STRIPE_SECRET_KEY=
|
||||
STRIPE_PRICE_PREMIUM=
|
||||
STRIPE_WEBHOOK_SECRET=
|
||||
AUTH_GOOGLE_CLIENT_ID=CHANGE_ME_GOOGLE_CLIENT_ID
|
||||
# Optional: enables the "Continue with Microsoft" sign-in tab (separate from the
|
||||
# MICROSOFT_CLIENT_ID below, which is for Outlook mail linking, not sign-in).
|
||||
AUTH_GOOGLE_CLIENT_ID=
|
||||
AUTH_MICROSOFT_CLIENT_ID=
|
||||
# Microsoft application sign-in tenant policy: tenant GUID, organizations, consumers, or common.
|
||||
# This is separate from MICROSOFT_TENANT_ID, which configures Graph mailbox OAuth.
|
||||
AUTH_MICROSOFT_TENANT=common
|
||||
GOOGLE_GMAIL_CLIENT_SECRET=CHANGE_ME_GOOGLE_OAUTH_CLIENT_SECRET
|
||||
# Optional. If omitted, the backend uses https://<your-domain>/api/gmail/oauth/callback
|
||||
MICROSOFT_CLIENT_ID=CHANGE_ME_MICROSOFT_CLIENT_ID
|
||||
MICROSOFT_CLIENT_SECRET=CHANGE_ME_MICROSOFT_OAUTH_CLIENT_SECRET
|
||||
# Optional. Defaults to "common" (personal + work/school accounts).
|
||||
|
||||
# =============================================================================
|
||||
# MAIL PROVIDER CONNECTIONS
|
||||
# =============================================================================
|
||||
GOOGLE_GMAIL_CLIENT_SECRET=
|
||||
MICROSOFT_CLIENT_ID=
|
||||
MICROSOFT_CLIENT_SECRET=
|
||||
MICROSOFT_TENANT_ID=
|
||||
# Optional. If omitted, the backend uses https://<your-domain>/api/microsoft-graph/oauth/callback
|
||||
|
||||
# =============================================================================
|
||||
# AI SERVICE AND PROVIDERS
|
||||
# =============================================================================
|
||||
AI_SERVICE_BASE_URL=http://ai-service:8001
|
||||
# REQUIRED. Shared secret the backend sends to ai-service on every call except /health.
|
||||
# The stack refuses to start without it. Generate with: openssl rand -hex 32
|
||||
# Required for protected backend -> AI service calls.
|
||||
AI_SERVICE_TOKEN=
|
||||
# Optional: enables hybrid CV block classification in the local AI service.
|
||||
OLLAMA_BASE_URL=http://ollama:11434
|
||||
OLLAMA_MODEL=qwen2.5:7b
|
||||
|
||||
# Optional external fallback provider for heavy /cv/* calls: ollama (none) | gemini | groq.
|
||||
# Local Ollama is always attempted first unless the explicitly configured mode is
|
||||
# external_only. External processing still requires the administrator gate, an
|
||||
# allowed task, and the authenticated Pro user's opt-in. /summarize stays local.
|
||||
# Keys are read from the environment only — never commit real keys.
|
||||
AI_PROVIDER=ollama
|
||||
EXTERNAL_AI_ENABLED=false
|
||||
AI_ROUTING_MODE=local_first
|
||||
EXTERNAL_AI_ALLOWED_TASKS=cv-normalize,cv-classify,cv-rewrite
|
||||
# Per-request cost/privacy ceiling. Requests above this size remain local even after local failure.
|
||||
EXTERNAL_AI_MAX_PROMPT_CHARS=24000
|
||||
LOCAL_AI_CIRCUIT_FAILURE_THRESHOLD=3
|
||||
LOCAL_AI_CIRCUIT_OPEN_SECONDS=30
|
||||
# Isolated CV document decoder budgets. Increase only after benign-file measurement.
|
||||
PARSER_TIMEOUT_SECONDS=25
|
||||
PARSER_CPU_SECONDS=20
|
||||
PARSER_MEMORY_MIB=512
|
||||
@@ -73,8 +57,6 @@ GEMINI_API_KEY=
|
||||
GEMINI_MODEL=gemini-2.0-flash
|
||||
GROQ_API_KEY=
|
||||
GROQ_MODEL=llama-3.3-70b-versatile
|
||||
|
||||
# Durable AI operation worker. Keep false until handlers, monitoring and rollout gates are verified.
|
||||
WORKER_AI_OPERATIONS_ENABLED=false
|
||||
AI_QUEUE_WORKER_CONCURRENCY=1
|
||||
AI_QUEUE_GLOBAL_CAPACITY=100
|
||||
@@ -82,47 +64,57 @@ AI_QUEUE_PER_USER_CAPACITY=10
|
||||
AI_QUEUE_DEADLINE_MINUTES=15
|
||||
AI_QUEUE_OPERATION_TIMEOUT_SECONDS=300
|
||||
|
||||
# Optional: only needed if you want the UI to call a non-default API base URL.
|
||||
# In production the UI defaults to `/api`.
|
||||
# =============================================================================
|
||||
# FRONTEND AND PUBLIC APPLICATION
|
||||
# =============================================================================
|
||||
# Leave empty in production so nginx proxies same-origin /api requests.
|
||||
NEXT_PUBLIC_API_BASE_URL=
|
||||
|
||||
# Used by docker-compose.yml (email / password resets / notifications)
|
||||
APP_PUBLIC_BASE_URL=https://jobs.cesnimda.uk
|
||||
# Dedicated nginx-to-backend network. Confirm this CIDR does not overlap existing Docker networks.
|
||||
WEB_PROXY_SUBNET=172.31.250.0/29
|
||||
# Required for production: space-separated observed Traefik socket-peer CIDRs at nginx.
|
||||
# Prefer individual /32 or /128 addresses. Never guess Docker gateway/proxy addresses.
|
||||
# Empty fails deployment/nginx startup; development explicitly uses direct mode.
|
||||
INGRESS_PROXY_CIDRS=
|
||||
APP_VERSION=
|
||||
APP_COMMIT_SHA=
|
||||
APP_BUILD_STAMP=
|
||||
# Optional. Use a narrowly scoped Gitea token that can dispatch Actions workflows.
|
||||
|
||||
# =============================================================================
|
||||
# INGRESS AND MAINTENANCE
|
||||
# =============================================================================
|
||||
WEB_PROXY_SUBNET=172.31.250.0/29
|
||||
# Space-separated trusted reverse-proxy peer CIDRs; required in production.
|
||||
INGRESS_PROXY_CIDRS=
|
||||
MAINTENANCE_GITEA_BASE_URL=https://git.cesnimda.uk
|
||||
MAINTENANCE_GITEA_OWNER=cesnimda
|
||||
MAINTENANCE_GITEA_REPOSITORY=jobtrackingapp
|
||||
MAINTENANCE_GITEA_TOKEN=
|
||||
# Complete recovery sets are created before deployment and nightly at 02:00 Europe/Oslo.
|
||||
|
||||
# =============================================================================
|
||||
# BACKUPS
|
||||
# =============================================================================
|
||||
BACKUP_TIMEZONE=Europe/Oslo
|
||||
BACKUP_DAILY_RETENTION_DAYS=30
|
||||
BACKUP_MONTHLY_RETENTION_COUNT=12
|
||||
# Optional encrypted rclone destination, for example gdrive-crypt:jobtracker.
|
||||
# Optional encrypted rclone destination, e.g. gdrive-crypt:jobtracker.
|
||||
BACKUP_RCLONE_REMOTE=
|
||||
|
||||
# =============================================================================
|
||||
# SMTP AND EMAIL WORKERS
|
||||
# =============================================================================
|
||||
EMAIL_ENABLED=false
|
||||
EMAIL_SMTP_HOST=smtp.gmail.com
|
||||
EMAIL_SMTP_PORT=587
|
||||
EMAIL_SMTP_USER=CHANGE_ME_GMAIL_ADDRESS
|
||||
EMAIL_SMTP_PASSWORD=CHANGE_ME_GOOGLE_APP_PASSWORD
|
||||
EMAIL_FROM=CHANGE_ME_GMAIL_ADDRESS
|
||||
EMAIL_SMTP_USER=
|
||||
EMAIL_SMTP_PASSWORD=
|
||||
EMAIL_FROM=
|
||||
EMAIL_FROM_NAME=Jobbjakt
|
||||
EMAIL_FOLLOWUPREMINDERS_ENABLED=false
|
||||
EMAIL_FOLLOWUPREMINDERS_UPCOMINGDAYS=2
|
||||
EMAIL_SMTP_ENABLE_SSL=true
|
||||
EMAIL_SMTP_TIMEOUT_MS=15000
|
||||
|
||||
# =============================================================================
|
||||
# APPLICATION WORKERS AND DISCOVERY
|
||||
# =============================================================================
|
||||
WORKER_RULES_ENABLED=false
|
||||
WORKER_FOLLOWUP_REMINDERS_ENABLED=false
|
||||
WORKER_SAVED_SEARCH_ALERTS_ENABLED=true
|
||||
SAVED_SEARCH_INTERVAL_HOURS=6
|
||||
WORKER_DAILY_EXPORT_ENABLED=false
|
||||
WORKER_JOB_ENRICHMENT_ENABLED=false
|
||||
|
||||
EMAIL_SMTP_ENABLE_SSL=true
|
||||
EMAIL_SMTP_TIMEOUT_MS=15000
|
||||
|
||||
Reference in New Issue
Block a user