tops/.env.docker.example at develop · teemops/tops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
# Teemops Docker Compose — copy to .env and adjust as needed
# Phase 1: app + MySQL + Maildev (no AWS infra)
# Phase 2: ./install.sh's AWS step deploys SQS/SNS and generates generated/teemops.env

APP_PORT=8080
APP_URL=http://localhost:8080

APP_NAME=Teemops
APP_ENV=local
APP_DEBUG=true

# Shared Laravel encryption key used by BOTH the app and worker containers.
# Leave blank — docker/scripts/prepare-build.sh generates a stable key here on
# first run. It must be the same value for app and worker (the worker encrypts
# IAM role ARNs that the app later decrypts), so set it once and don't rotate it.
APP_KEY=

# Laravel reads these for DB (entrypoint also uses them to wait for MySQL)
#
# The three passwords below are left blank on purpose — the same treatment
# APP_KEY gets. install.sh (and docker/scripts/prepare-build.sh, for the
# build-from-source path) generates each one on first run. This repo is public,
# so any value shipped here would be a published password on every install that
# followed the docs; and MySQL's port is bound to the host by default, which
# would make it a reachable one.
#
# DB_PASSWORD and MYSQL_PASSWORD are the same account and must hold the same
# value; the installers keep them in step.
#
# Do not rotate MYSQL_ROOT_PASSWORD or MYSQL_PASSWORD after the first
# `docker compose up`. MySQL stores them in its datadir on first init and never
# reads these again, so changing them here just locks you out — exactly like
# rotating APP_KEY.
DB_CONNECTION=mysql
DB_HOST=mysql
DB_PORT=3306
DB_DATABASE=teemops
DB_USERNAME=teem
DB_PASSWORD=

MYSQL_ROOT_PASSWORD=
MYSQL_DATABASE=teemops
MYSQL_USER=teem
MYSQL_PASSWORD=
MYSQL_PORT=3306

# Database backups — daily full, hourly differential, 15-minute binary log
# archive. Runs in the `backup` container; driven from the host with
# ./backup.sh. Full reference: docs/backups.md
#
# Where backups land on the HOST. Kept outside the repo on purpose: a physical
# MySQL backup is a byte-for-byte copy of production data, and one careless
# `git add -A` would commit it. The repo's .gitignore also covers backups/ and
# .tops/ so an in-repo override stays safe if you change this.
TOPS_BACKUP_DIR=${HOME}/.tops/backups

# The timezone the schedule and the backup directory names are expressed in.
# This is what makes the daily backup fire at 5pm where you are rather than 5pm
# UTC, and what --to timestamps are read in during a point-in-time restore.
# docker/scripts/prepare-build.sh fills this in from the host.
TOPS_BACKUP_TZ=UTC

# Ownership handed to finished backups so ~/.tops/backups is usable without
# sudo. Also filled in by docker/scripts/prepare-build.sh.
TOPS_BACKUP_UID=1000
TOPS_BACKUP_GID=1000

# Least-privilege MySQL account the scheduler uses. Created automatically on
# container start from MYSQL_ROOT_PASSWORD; it can copy the datadir and rotate
# binary logs, and nothing else. Restores use root, not this account.
#
# Blank, and generated at install time, for the same reason as the passwords
# above. This is the one that is safe to rotate later: the backup container
# re-applies it with ALTER USER on every start.
TOPS_BACKUP_USER=tops_backup
TOPS_BACKUP_PASSWORD=

# Schedules (cron syntax, in TOPS_BACKUP_TZ). The differential is offset to :10
# so it never collides with the 17:00 full.
TOPS_BACKUP_FULL_CRON=0 17 * * *
TOPS_BACKUP_DIFF_CRON=10 * * * *
TOPS_BACKUP_BINLOG_CRON=*/15 * * * *
TOPS_BACKUP_PRUNE_CRON=30 3 * * *

# Retention. Binlogs are kept longer than fulls by design and are never pruned
# past the oldest surviving full — without them that full can only be restored
# to its own instant, which would silently disable point-in-time recovery.
TOPS_BACKUP_FULL_RETENTION_DAYS=7
TOPS_BACKUP_BINLOG_RETENTION_DAYS=14

SESSION_DRIVER=database
CACHE_STORE=database
QUEUE_CONNECTION=database
SCAN_QUEUE_CONNECTION=database
SCAN_REGION_QUEUE_CONNECTION=database

MAIL_MAILER=smtp
MAIL_HOST=maildev
MAIL_PORT=1025
MAIL_FROM_ADDRESS=noreply@teemops.local
MAIL_FROM_NAME=Teemops

LOG_CHANNEL=stderr
LOG_LEVEL=debug

# Auth: set false for Laravel email/password login (Docker default). Requires rebuild after change.
FIREBASE_USER_AUTH=false

# Phase 2 — AWS messaging. install.sh asks for the region and writes it here.
TOPS_DEPLOYMENT_REGION=
TOPS_ENVIRONMENT=test
TOPS_INSTALL_TARGET=docker
AWS_PROFILE=default

# Populated by ./install.sh --aws-only into generated/teemops.env (do not set manually unless reusing an existing stack)
AWS_PARENT_ACCOUNT_ID=

VITE_APP_NAME=Teemops

# Build-time only (docker compose build args)
# VITE_APP_NAME is passed via docker-compose build args

# EC2 install only: use host network so installer can reach IMDS for instance credentials
# TOPS_INSTALLER_NETWORK=host