pastilhasandClaude Opus 5
c5adb4aa08
ANTHROPIC_PROXY_PORT is gone. It was 5051 hardcoded in four files: proxy.ts, which binds it, and three others that guessed the same constant to find it. It is the only sidecar that binds a fixed port, and that part is a real constraint rather than an oversight. Every other one binds `port: 0`, lets the kernel choose and reports back over the registration socket — which works because their consumer is the platform. The proxy's consumer is `claude`, spawned by a different pm2 process that needs ANTHROPIC_BASE_URL at spawn time and has no channel to ask what port the proxy landed on. Two processes with nothing between them have to agree in advance. So the number must be predictable, but it need not be 5051 — a value chosen against nothing, in the registered range, free to collide with anything the owner installs later. The symptom of that collision would have been chat failing while the rest of the platform looked healthy. PORT + 1 keeps the predictability and drops both the constant and the variable. Nothing to set, no second number to keep in agreement with the first, and the pair moves together when the install moves. Also corrects .env.example, which said the proxy "holds the API credential, which lives in the host env". It does not. The upstream credential is the OAuth token claude writes to ~/.claude/.credentials.json, and the ANTHROPIC_API_KEY the agent presents is the proxy's own generated secret. Verified the derivation at PORT=9000 and PORT=10000; all four consumers now import it; every edited file parses. Still not typechecked — empty node_modules, frozen installs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
97 lines
6.8 KiB
Bash
97 lines
6.8 KiB
Bash
# What officer-setup writes. Everything below this block is optional, or is on its way out.
|
|
PORT=9000
|
|
BROWSER_RELAY_PORT=18792
|
|
POSTGRES_URL="postgres://postgres:password@localhost:5432/officer"
|
|
|
|
# ── Moving to the secret store ─────────────────────────────────────────────────────────────────
|
|
# Still REQUIRED — jwt.ts throws at module load without JWT_SECRET, and crypto.ts throws without
|
|
# VAULT_STORE_KEY — but officer-setup no longer writes either. They are moving into the SQLite key
|
|
# store (docs/secret-store.md), which is designed and not yet built, so an install made by the
|
|
# current script will not boot until it is. That is deliberate sequencing, not an oversight.
|
|
JWT_SECRET="<generate with: openssl rand -base64 32>"
|
|
|
|
# NOT Vaultwarden's, despite the name and where it used to sit — it is the platform's at-rest key,
|
|
# encrypting every secret column in Postgres: Headscale admin API keys, app-store service
|
|
# credentials, Jellyfin tokens, wallet node credentials, and the wallet seed envelope on top of the
|
|
# owner passphrase that seals it.
|
|
#
|
|
# CHANGING IT MAKES ALL OF THAT UNREADABLE AT ONCE, and for the seed that is unrecoverable: the
|
|
# passphrase opens the inner envelope and this is the outer one.
|
|
VAULT_STORE_KEY="<generate with: openssl rand -base64 32>"
|
|
|
|
# ── Optional ───────────────────────────────────────────────────────────────────────────────────
|
|
# Where Officer is reached from a browser. Read by origin validation, the task API host check, and
|
|
# the CalDAV iOS profile builder — which is the only one that hard-requires it, and demands https.
|
|
# PUBLIC_URL=https://officer.example.com
|
|
|
|
# Guards (CORS origin checks, rate limits, password-strength rules) are ON unless this is set to
|
|
# "dev" or "development". Unset is hardened, which is why officer-setup no longer writes it — set it
|
|
# by hand, on a local machine you trust, to develop. Note that `bun dev` does NOT set it: that script
|
|
# only loads this file, so `bun dev` against a production .env runs fully hardened.
|
|
# PUBLIC_BUILD_ENV=dev
|
|
|
|
# Origin checking is OFF unless this is explicitly "false" — an inversion of the usual rule, and one
|
|
# that is only defensible when the tailnet is the perimeter. On a machine with no tailnet, set it to
|
|
# false. Written explicitly rather than left to the default so the choice is visible.
|
|
ALLOW_ANY_ORIGIN=true
|
|
|
|
# DATA_PATH, OFFICER_ITEMS_DIR and HOME_DIR were here until 2026-08-12 and are no longer read.
|
|
# The install root is derived as the parent of the working directory (src/servers/data-path.ts), so
|
|
# data/, capabilities/ and dockers/ follow from it; the owner's home comes from the OS. Three values
|
|
# that had to agree with each other and with the disk became one that cannot disagree.
|
|
|
|
# ── Sidecars ────────────────────────────────────────────────────────────────────────────────────
|
|
# Each sidecar owns its upstream's credentials; the platform API is only a thin auth+forward proxy
|
|
# and never sees them. An unset upstream URL is not fatal — the sidecar logs a warning at boot and
|
|
# answers 503 until it is set, so you can run Officer with any subset of these configured.
|
|
|
|
# Transmission (officer-transmission) is configured from the app, not from here — Transmission →
|
|
# Connection. The daemon URL, the optional RPC auth and the RPC path live in `service_connections`,
|
|
# with the password encrypted, so nothing outside the sidecar can read it.
|
|
|
|
# InvoiceShelf (officer-invoiceshelf) is configured from the app, not from here — Invoices → Connection.
|
|
# Instances, their Sanctum tokens and the company each one is pinned to live encrypted in
|
|
# `invoiceshelf_accounts`, so nothing outside the sidecar can read a token.
|
|
|
|
# slskd (officer-slskd) is configured from the app, not from here — Soulseek → Connection. The
|
|
# daemon URL and its API key live encrypted in `service_connections`; the sidecar injects the key as
|
|
# X-API-Key on every forwarded request.
|
|
|
|
# Vaultwarden (officer-vault). VAULT_STORE_KEY is at the top of this file — it is the platform's
|
|
# key, not Vaultwarden's, however much the name and its old position here suggested otherwise.
|
|
VAULTWARDEN_URL=http://127.0.0.1:8222
|
|
|
|
# The Anthropic proxy (officer-anthropic-proxy) binds PORT + 1, derived rather than configured — see
|
|
# src/servers/officer-url.mjs. There is nothing to set. It holds no credential from this file either:
|
|
# the upstream token is the OAuth one `claude` writes to ~/.claude/.credentials.json, and the
|
|
# ANTHROPIC_API_KEY the agent presents to it is the proxy's own generated secret.
|
|
|
|
# ReClip — the self-hosted yt-dlp service the download-media capability talks to. Defaults to
|
|
# http://localhost:8899.
|
|
# RECLIP_URL=http://localhost:8899
|
|
|
|
# ── Headscale (/api/vpn) ────────────────────────────────────────────────────────────────────────
|
|
# These drive the /api/vpn router, NOT the officer-headscale sidecar. The sidecar deliberately reads
|
|
# neither, keeping its registered servers and their keys in Postgres so host env can never shadow
|
|
# one. Set these only if you use /api/vpn.
|
|
# HEADSCALE_URL=https://headscale.example.com
|
|
# HEADSCALE_API_KEY="<headscale admin api key>"
|
|
# HEADSCALE_USER=officer
|
|
|
|
# ── Bitcoin wallet (officer-wallet) ─────────────────────────────────────────────────────────────
|
|
# The chain data source is NOT here — it is configured from the app, at Wallet → Settings → Chain
|
|
# source, and stored per owner. Any Esplora-compatible API works (electrs, esplora, mempool.space);
|
|
# it defaults to the public mempool.space until you set one.
|
|
# WALLET_NETWORK=bitcoin # bitcoin | testnet | signet | regtest
|
|
#
|
|
# How long an unlocked wallet stays unlocked, in seconds. Default 900 (15 min). The root key is held
|
|
# in the sidecar's memory for exactly this long after an unlock, then wiped. Shorter is safer.
|
|
# WALLET_UNLOCK_TTL_SEC=900
|
|
#
|
|
# NOTE: seed material is encrypted with VAULT_STORE_KEY (above) on top of the owner passphrase that
|
|
# seals it. Both are required to spend. If you lose VAULT_STORE_KEY, every stored seed is
|
|
# unrecoverable — back up the mnemonics separately, offline.
|
|
|
|
# Immich (officer-photos) is configured from the app, not from here — Photos → Connection. Instances and
|
|
# their API keys live encrypted in `photos_config`, so the platform never sees a key.
|