pastilhasandClaude Opus 5
9d6c196848
Removing PUBLIC_URL earlier today was wrong, and the Build section is where it would have surfaced: gen-index.ts exits 1 without it, so `bun gen:index` fails, index.gen.html is never written, and `bun start` has no page to serve. It came out because origin validation was being discontinued — but that was one of four consumers and the only one that is gone. gen-index needs it for OpenGraph tags, which crawlers fetch standalone and cannot resolve relative; task-api-env builds OFFICER_API_HOST from it; and dav/router hard-requires it, https only, to build an iOS profile. It is also the one value this machine genuinely cannot derive, which is what separates it from DATA_PATH and the rest that left today. gen:index now takes a URL as its first argument, ahead of the environment and .env: `bun gen:index https://officer.example.com`. Changing the public address is one command rather than an edit plus a regenerate, and a second address can be generated for without touching the install's .env. It also validates now. A relative or scheme-less value substituted silently and produced OpenGraph tags nothing can resolve — invisible until someone shares a link and the preview comes back blank. .env is PORT, PUBLIC_URL, POSTGRES_URL. Verified by running the section; all three paths through gen:index exercised (absent, valid argument, invalid). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
90 lines
6.4 KiB
Bash
90 lines
6.4 KiB
Bash
# What officer-setup writes. Everything below this block is optional, or is on its way out.
|
|
PORT=9000
|
|
POSTGRES_URL="postgres://postgres:password@localhost:5432/officer"
|
|
|
|
# Where Officer is reached from a browser — the one value the machine cannot derive. Read by
|
|
# `bun gen:index` (OpenGraph tags, which need an absolute URL), the task API host, and the CalDAV iOS
|
|
# profile builder, which additionally requires https.
|
|
#
|
|
# `bun gen:index https://other.example.com` overrides it for one run without editing this file.
|
|
PUBLIC_URL=http://localhost:9000
|
|
|
|
# ── No secrets live here ───────────────────────────────────────────────────────────────────────
|
|
# JWT_SECRET and VAULT_STORE_KEY were here until 2026-08-13. Every encryption and signing key now
|
|
# lives in the secret store — a 0600 SQLite file at $OFFICER_ROOT/secrets/officer-keys.db, one key
|
|
# per purpose, created on first use. See docs/secret-store.md.
|
|
#
|
|
# The reason is blast radius rather than secrecy: bun auto-loads this file into ALL of the pm2
|
|
# processes, so a key here is readable from /proc/<pid>/environ of twenty processes that mostly have
|
|
# no business with it — officer-music held the key that decrypts wallet seed envelopes.
|
|
#
|
|
# BACK UP THAT FILE. Losing it signs everyone out and makes every encrypted column in Postgres
|
|
# unreadable, and for the wallet seed that is unrecoverable.
|
|
|
|
# ── Optional ───────────────────────────────────────────────────────────────────────────────────
|
|
# Guards (CORS origin checks, rate limits, password-strength rules) are ON unless this is set to
|
|
# "dev" or "development". Unset is hardened, which is why officer-setup no longer writes it — set it
|
|
# by hand, on a local machine you trust, to develop. Note that `bun dev` does NOT set it: that script
|
|
# only loads this file, so `bun dev` against a production .env runs fully hardened.
|
|
# PUBLIC_BUILD_ENV=dev
|
|
|
|
# DATA_PATH, OFFICER_ITEMS_DIR and HOME_DIR were here until 2026-08-12 and are no longer read.
|
|
# The install root is derived as the parent of the working directory (src/servers/data-path.ts), so
|
|
# data/, capabilities/ and dockers/ follow from it; the owner's home comes from the OS. Three values
|
|
# that had to agree with each other and with the disk became one that cannot disagree.
|
|
|
|
# ── Sidecars ────────────────────────────────────────────────────────────────────────────────────
|
|
# Each sidecar owns its upstream's credentials; the platform API is only a thin auth+forward proxy
|
|
# and never sees them. An unset upstream URL is not fatal — the sidecar logs a warning at boot and
|
|
# answers 503 until it is set, so you can run Officer with any subset of these configured.
|
|
|
|
# Transmission (officer-transmission) is configured from the app, not from here — Transmission →
|
|
# Connection. The daemon URL, the optional RPC auth and the RPC path live in `service_connections`,
|
|
# with the password encrypted, so nothing outside the sidecar can read it.
|
|
|
|
# InvoiceShelf (officer-invoiceshelf) is configured from the app, not from here — Invoices → Connection.
|
|
# Instances, their Sanctum tokens and the company each one is pinned to live encrypted in
|
|
# `invoiceshelf_accounts`, so nothing outside the sidecar can read a token.
|
|
|
|
# slskd (officer-slskd) is configured from the app, not from here — Soulseek → Connection. The
|
|
# daemon URL and its API key live encrypted in `service_connections`; the sidecar injects the key as
|
|
# X-API-Key on every forwarded request.
|
|
|
|
# Vaultwarden (officer-vault). VAULT_STORE_KEY is at the top of this file — it is the platform's
|
|
# key, not Vaultwarden's, however much the name and its old position here suggested otherwise.
|
|
# VAULTWARDEN_URL=http://127.0.0.1:8222
|
|
|
|
# The Anthropic proxy (officer-anthropic-proxy) binds PORT + 1, derived rather than configured — see
|
|
# src/servers/officer-url.mjs. There is nothing to set. It holds no credential from this file either:
|
|
# the upstream token is the OAuth one `claude` writes to ~/.claude/.credentials.json, and the
|
|
# ANTHROPIC_API_KEY the agent presents to it is the proxy's own generated secret.
|
|
|
|
# ReClip — the self-hosted yt-dlp service the download-media capability talks to. Defaults to
|
|
# http://localhost:8899.
|
|
# RECLIP_URL=http://localhost:8899
|
|
|
|
# ── Headscale (/api/vpn) ────────────────────────────────────────────────────────────────────────
|
|
# These drive the /api/vpn router, NOT the officer-headscale sidecar. The sidecar deliberately reads
|
|
# neither, keeping its registered servers and their keys in Postgres so host env can never shadow
|
|
# one. Set these only if you use /api/vpn.
|
|
# HEADSCALE_URL=https://headscale.example.com
|
|
# HEADSCALE_API_KEY="<headscale admin api key>"
|
|
# HEADSCALE_USER=officer
|
|
|
|
# ── Bitcoin wallet (officer-wallet) ─────────────────────────────────────────────────────────────
|
|
# The chain data source is NOT here — it is configured from the app, at Wallet → Settings → Chain
|
|
# source, and stored per owner. Any Esplora-compatible API works (electrs, esplora, mempool.space);
|
|
# it defaults to the public mempool.space until you set one.
|
|
# WALLET_NETWORK=bitcoin # bitcoin | testnet | signet | regtest
|
|
#
|
|
# How long an unlocked wallet stays unlocked, in seconds. Default 900 (15 min). The root key is held
|
|
# in the sidecar's memory for exactly this long after an unlock, then wiped. Shorter is safer.
|
|
# WALLET_UNLOCK_TTL_SEC=900
|
|
#
|
|
# NOTE: seed material is encrypted with VAULT_STORE_KEY (above) on top of the owner passphrase that
|
|
# seals it. Both are required to spend. If you lose VAULT_STORE_KEY, every stored seed is
|
|
# unrecoverable — back up the mnemonics separately, offline.
|
|
|
|
# Immich (officer-photos) is configured from the app, not from here — Photos → Connection. Instances and
|
|
# their API keys live encrypted in `photos_config`, so the platform never sees a key.
|