.env.example

# LaunchPad - Docker Compose on any Linux host, private S3 and Lambda Web Functions.
# Copy to .env at the repository root. Keep real values out of Git.
# Compose passes only the settings each service needs. Never pass this whole
# file to a customer build container; the API supplies each build job's settings.

# Generate random values before first startup. Hex values work in connection URLs.
# Keep existing values when reusing MongoDB and Redis volumes.
MONGO_ROOT_PASSWORD=
MONGO_APP_PASSWORD=
REDIS_PASSWORD=
JWT_SECRET=
WORKER_API_TOKEN=

# Existing AWS resources and credentials for the API, proxy and worker process.
# Use a dedicated application IAM user's access keys. Temporary credentials also
# require AWS_SESSION_TOKEN and must be refreshed before they expire.
AWS_REGION=ap-south-1
AWS_BUCKET_NAME=
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_SESSION_TOKEN=
# Existing logs-only execution role assumed by deployed Node.js Web Functions.
LAMBDA_WEB_ROLE_ARN=

# Ephemeral ECS Fargate jobs pull the worker image from ECR.
AWS_ECS_CLUSTER=launchpad-build
AWS_ECS_TASK_DEFINITION=launchpad-build-worker
AWS_ECS_SUBNETS=
AWS_ECS_SECURITY_GROUPS=
# Bind Redis only on the host's private interface reachable from Fargate.
# Restrict port 6379 to the worker security group. Never expose it publicly.
BUILD_REDIS_BIND_IP=127.0.0.1
BUILD_REDIS_URL=

# Cloudflare token: Zone Read + DNS Edit, restricted to this domain.
# Only Caddy receives this token. It obtains and renews wildcard certificates.
BASE_DOMAIN=launch-pad.dev
CF_API_TOKEN=

# GitHub OAuth App: https://github.com/settings/developers
# Kept only for existing sign-in migration; new sign-ins request email only.
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_CALLBACK_URL=https://api.launch-pad.dev/auth/github/callback
FRONTEND_URL=https://launch-pad.dev

# One GitHub App for sign-in, selected repository access and signed push events.
# Run: node api-server/scripts/register-github-app.cjs
# The registration helper writes these values and .secrets/github-app.pem locally.
GITHUB_APP_ID=
GITHUB_APP_SLUG=
GITHUB_APP_CLIENT_ID=
GITHUB_APP_CLIENT_SECRET=
GITHUB_WEBHOOK_SECRET=
GITHUB_APP_CALLBACK_URL=https://api.launch-pad.dev/auth/github-app/callback
GITHUB_APP_PRIVATE_KEY_PATH=.secrets/github-app.pem
# GitHub App repository permission: Deployments read/write, on selected repos.
# Reporting retries independently and can be disabled without stopping builds.
GITHUB_DEPLOYMENTS_ENABLED=true

# Kafka uses an internal Docker listener and a persistent volume. No host port.
# For API/worker processes outside Compose, use a reachable private Kafka broker.
KAFKA_BROKERS=kafka:9092

# Public dashboard settings; also set in the frontend hosting environment.
NEXT_PUBLIC_API_URL=https://api.launch-pad.dev
NEXT_PUBLIC_LOGS_URL=https://logs.launch-pad.dev

# Docker Compose sets internal MongoDB/Redis URLs and the build concurrency cap.
# The API supplies per-build IDs, commands, tokens and callbacks.
# The API/proxy use explicit credentials. Fargate workers use their task role;
# API credentials and Cloudflare tokens are never copied into task overrides.