From 6933ec28be3dac0dc17cd634c663db3b4818caad Mon Sep 17 00:00:00 2001 From: Doan Luu Duc Tai Date: Fri, 30 Oct 2026 22:36:11 -0500 Subject: Centralize deployment settings in the root environment file Document public domains, ports, upstreams, chat binding, and backup defaults alongside private settings. Validate shared configuration and render Caddy, cgit, and website links from an explicit public allowlist while preserving one installation environment file. --- .env.example | 38 +++++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) (limited to '.env.example') diff --git a/.env.example b/.env.example index b8fad96..521bcd8 100644 --- a/.env.example +++ b/.env.example @@ -13,7 +13,43 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . -SEARXNG_SECRET=GENERATE_RANDOM_HEX_KEY +# Public hostnames: DNS names only, without a scheme, path, or port. +# www aliases are derived from these names. These settings are public, not secrets. +BASE_DOMAIN=luuduct.ai +SITE_HOST=doan.luuduct.ai +GIT_HOST=git.doan.luuduct.ai +SEARCH_HOST=search.doan.luuduct.ai +WKD_HOST=openpgpkey.luuduct.ai +CHAT_HOST=chat.doan.luuduct.ai + +# Production TCP HTTP and TCP/UDP HTTPS listener/published ports. +# Keep 80/443 for ordinary public HTTPS and ACME validation. Nonstandard ports +# also require matching external routing and a suitable certificate setup. +HTTP_PORT=80 +HTTPS_PORT=443 + +# Development Caddy binds only to loopback. Its HTTPS host port is this value + 1. +# A --port argument overrides this setting for that invocation. +LOCAL_HTTP_PORT=8080 + +# Caddy connection targets, not upstream application bind settings. +# The bundled cgit and SearXNG images listen internally on 8080. +CGIT_UPSTREAM=cgit:8080 +SEARXNG_UPSTREAM=searxng:8080 +# Chat remains a separate local experimental process. --bind overrides CHAT_BIND. +# CHAT_ORIGIN must match the browser's exact origin; existing identity files pin it. +# Changing an origin is not a private-key or identity-file migration. +CHAT_BIND=127.0.0.1:9080 CHAT_ORIGIN=http://127.0.0.1:9080 + +# Public backup recipient and a project-relative public key file. +# Private GnuPG keys stay outside the project. CLI --recipient/--key override these. +BACKUP_RECIPIENT=3346AA3150F8F16828BB0D14F8C66DF77AFECEA6 +BACKUP_PUBLIC_KEY=web/.well-known/openpgpkey/luuduct.ai/hu/t76q8xqkeassgy1kr38re1ppj6cpc1dp + +# Private values: generate locally; never commit the actual .env. +# The stack creates SEARXNG_SECRET on first initialization. +SEARXNG_SECRET=GENERATE_RANDOM_HEX_KEY +# cargo stack chat --init generates the owner registration token. CHAT_SETUP_TOKEN=GENERATE_WITH_CHAT_SERVER_INIT -- cgit v1.2.3