Tronax
2899eb205b
- Go backend skeleton: config (caarlos0/env), slog JSON logging, pgxpool store, HTTP server with graceful shutdown. - httpapi: render helpers, Problem errors, middleware chain (requestID / logging / recover / CORS), /healthz and /readyz. - Migrations: full initial schema (users, sessions, lists, list_members, items, op_log SOURCE OF TRUTH, item_names) + golang-migrate runner binary using source/iofs (embedded). - Docker: multi-stage Dockerfile (Go 1.26 -> distroless nonroot), builds both server and migrate binaries. - deploy: docker-compose (caddy + backend + migrate + postgres:16), Caddyfile (auto-HTTPS), .env.example, pg extensions init script. - AGENTS.md: project context + roadmap for AI agents. Verified: image builds, both binaries run in container (smoke test).
44 lines
1.8 KiB
Text
44 lines
1.8 KiB
Text
# ===========================================================================
|
|
# mitbringsl backend configuration
|
|
# Copy this file to ".env" and adjust the values.
|
|
# cp .env.example .env
|
|
# ===========================================================================
|
|
|
|
# --- General app behavior ---
|
|
APP_ENV=production # development | production
|
|
LOG_LEVEL=info # debug | info | warn | error
|
|
|
|
# The externally reachable base URL (scheme + host, no trailing slash).
|
|
# Must match the domain you serve Caddy on. Used for OIDC redirect URIs etc.
|
|
PUBLIC_BASE_URL=https://mitbringsl.example.com
|
|
|
|
# The public domain Caddy serves. Used to set the Caddy site address.
|
|
PUBLIC_DOMAIN=mitbringsl.example.com
|
|
|
|
# --- PostgreSQL ---
|
|
POSTGRES_USER=app
|
|
# CHOOSE A STRONG PASSWORD (only required for first DB init, then stored).
|
|
POSTGRES_PASSWORD=change-me-to-a-long-random-string
|
|
POSTGRES_DB=appdb
|
|
# DATABASE_URL is composed by docker-compose from the values above.
|
|
|
|
# --- Session tokens ---
|
|
# TTL of the opaque session token issued after login.
|
|
SESSION_TOKEN_TTL=720h # 30 days
|
|
|
|
# --- OIDC: Google (optional) ---
|
|
OIDC_GOOGLE_ENABLED=false
|
|
# The OAuth client ID you created in Google Cloud Console (Audience the
|
|
# backend accepts). No client_secret needed: the Android app performs the
|
|
# code exchange itself and only sends the id_token to the backend.
|
|
OIDC_GOOGLE_CLIENT_ID=
|
|
OIDC_GOOGLE_ISSUER=https://accounts.google.com
|
|
|
|
# --- OIDC: Generic provider (Keycloak, Authentik, Dex, ...; optional) ---
|
|
OIDC_GENERIC_ENABLED=false
|
|
OIDC_GENERIC_ISSUER= # e.g. https://idp.example.com/realms/main
|
|
OIDC_GENERIC_CLIENT_ID= # audience the backend accepts
|
|
|
|
# --- CORS (only relevant for browser clients; Android doesn't need it) ---
|
|
# Comma-separated list of allowed origins, e.g. https://app.example.com
|
|
CORS_ALLOWED_ORIGINS=
|