From f98ebe509f65f023ea355b45af04d59a93dbeec8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Thu, 30 Jul 2026 17:16:18 +0000 Subject: [PATCH] document the sidecar env vars in .env.example the example stopped at the core five and never mentioned the sidecars, so a fresh checkout gave no hint that transmission, slskd or the vault are configured at all. every value here is a placeholder. notes the two things that are easy to get wrong: transmission rejects an empty basic header, so user/pass must stay empty rather than blank-filled when the daemon has no rpc auth; and HEADSCALE_URL/API_KEY drive /api/vpn, not the officer-headscale sidecar, which deliberately reads neither. Co-Authored-By: Claude Opus 5 --- .env.example | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/.env.example b/.env.example index 9890a24c..62e3e52a 100644 --- a/.env.example +++ b/.env.example @@ -13,3 +13,42 @@ DATA_PATH=/path/to/data OFFICER_ITEMS_DIR=/path/to/officer-items HOME_DIR=/home/user BROWSER_RELAY_PORT=18792 + +# ── Sidecars ──────────────────────────────────────────────────────────────────────────────────── +# Each sidecar owns its upstream's credentials; the platform API is only a thin auth+forward proxy +# and never sees them. An unset upstream URL is not fatal — the sidecar logs a warning at boot and +# answers 503 until it is set, so you can run Officer with any subset of these configured. + +# Transmission (officer-transmission). TRANSMISSION_USER/PASS are only needed if the daemon has RPC +# auth turned on; leave them empty otherwise, since Transmission rejects an empty Basic header. +# TRANSMISSION_RPC_PATH defaults to /transmission/rpc and only needs setting behind a reverse proxy +# that mounts the RPC endpoint somewhere else. +TRANSMISSION_URL=http://127.0.0.1:9091 +TRANSMISSION_USER= +TRANSMISSION_PASS= +# TRANSMISSION_RPC_PATH=/transmission/rpc + +# slskd (officer-slskd). The key is injected as X-API-Key on every forwarded request. +SLSKD_URL=http://127.0.0.1:5030 +SLSKD_API_KEY="" + +# Vaultwarden (officer-vault). VAULT_STORE_KEY encrypts stored secrets at rest — any strong secret +# of 16+ chars works, and CHANGING IT MAKES EXISTING STORED SECRETS UNREADABLE. +VAULTWARDEN_URL=http://127.0.0.1:8222 +VAULT_STORE_KEY="" + +# Anthropic proxy (officer-anthropic-proxy). Defaults to 5051; it holds the API credential, which +# lives in the host env rather than here. +# ANTHROPIC_PROXY_PORT=5051 + +# ReClip — the self-hosted yt-dlp service the download-media capability talks to. Defaults to +# http://localhost:8899. +# RECLIP_URL=http://localhost:8899 + +# ── Headscale (/api/vpn) ──────────────────────────────────────────────────────────────────────── +# These drive the /api/vpn router, NOT the officer-headscale sidecar. The sidecar deliberately reads +# neither, keeping its registered servers and their keys in Postgres so host env can never shadow +# one. Set these only if you use /api/vpn. +# HEADSCALE_URL=https://headscale.example.com +# HEADSCALE_API_KEY="" +# HEADSCALE_USER=officer