mirror of
https://github.com/AmruthPillai/Reactive-Resume.git
synced 2026-10-03 18:23:47 +10:00
Amruth Pillai
bec152b7e9
Add managed credentials, job posting search and scraping, database migration, translations, and self-hosting documentation. Fix empty resume-copy recovery and ensure every sheet popup renders inside a drawer viewport.
162 lines
6.2 KiB
Bash
162 lines
6.2 KiB
Bash
# --- Application ---
|
|
# Public port used by the production server and the Vite web server in local development.
|
|
PORT="3000"
|
|
|
|
# Port used by the Hono server in local development. Vite proxies API requests to this port.
|
|
SERVER_PORT="3001"
|
|
|
|
# Public URL where the app is served. Used for auth callbacks, OAuth issuer URLs,
|
|
# OpenGraph metadata, and absolute upload URLs.
|
|
APP_URL="http://localhost:3000"
|
|
|
|
# Optional: serve one already-public resume at /. Use the ID from /builder/<id>.
|
|
# Unset or blank keeps the marketing home. Restart after changes.
|
|
# ROOT_RESUME_ID=
|
|
|
|
# Vercel: APP_URL can be omitted; production uses VERCEL_PROJECT_PRODUCTION_URL.
|
|
|
|
# --- Database (PostgreSQL) ---
|
|
# PostgreSQL connection URL. In Docker Compose, the hostname is usually `postgres`;
|
|
# when running directly on your machine, `localhost` is typical.
|
|
DATABASE_URL="postgresql://postgres:postgres@postgres:5432/postgres"
|
|
|
|
# Optional direct connection for migrations (Neon: DATABASE_URL_UNPOOLED alias).
|
|
# DATABASE_MIGRATION_URL=""
|
|
# DATABASE_POOL_MAX="10"
|
|
|
|
# When "true", the server refuses to boot if the live database schema has drifted from
|
|
# the migration ledger (e.g. a table dropped outside migrations). Default "false" logs
|
|
# the drift loudly at startup and continues.
|
|
STRICT_SCHEMA_CHECK="false"
|
|
|
|
# --- Authentication ---
|
|
# Generated using `openssl rand -hex 32`
|
|
AUTH_SECRET="change-me-to-a-secure-secret-key-in-production"
|
|
|
|
# Better Auth Dashboard (optional)
|
|
# Enables the Better Auth Dashboard plugin when set, you probably don't need this.
|
|
BETTER_AUTH_API_KEY=""
|
|
|
|
# Social Auth (Google, optional)
|
|
# Set both values to enable Google sign-in.
|
|
GOOGLE_CLIENT_ID=""
|
|
GOOGLE_CLIENT_SECRET=""
|
|
|
|
# Social Auth (GitHub, optional)
|
|
# Set both values to enable GitHub sign-in.
|
|
GITHUB_CLIENT_ID=""
|
|
GITHUB_CLIENT_SECRET=""
|
|
|
|
# Social Auth (LinkedIn, optional)
|
|
# Set both values to enable LinkedIn sign-in.
|
|
LINKEDIN_CLIENT_ID=""
|
|
LINKEDIN_CLIENT_SECRET=""
|
|
|
|
# Custom OAuth Provider (optional)
|
|
# Set OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET plus either OAUTH_DISCOVERY_URL or
|
|
# the three manual endpoint URLs below.
|
|
OAUTH_PROVIDER_NAME=""
|
|
OAUTH_CLIENT_ID=""
|
|
OAUTH_CLIENT_SECRET=""
|
|
OAUTH_DISCOVERY_URL=""
|
|
OAUTH_AUTHORIZATION_URL=""
|
|
OAUTH_TOKEN_URL=""
|
|
OAUTH_USER_INFO_URL=""
|
|
|
|
# Space-separated scopes requested from the custom OAuth provider.
|
|
OAUTH_SCOPES="openid profile email"
|
|
|
|
# --- Email (optional) ---
|
|
# If SMTP_HOST, SMTP_USER, SMTP_PASS, or SMTP_FROM is missing, the app logs the
|
|
# email to the console instead.
|
|
SMTP_HOST=""
|
|
SMTP_PORT=""
|
|
SMTP_USER=""
|
|
SMTP_PASS=""
|
|
SMTP_FROM="Reactive Resume <noreply@rxresu.me>"
|
|
SMTP_SECURE="false"
|
|
|
|
# --- Storage (optional) ---
|
|
# Backend defaults to S3 when all credentials are present, otherwise local.
|
|
# Vercel defaults to private Blob. Explicit selection: local, s3, blob.
|
|
# STORAGE_BACKEND="local"
|
|
# BLOB_READ_WRITE_TOKEN=""
|
|
# BLOB_STORE_ID=""
|
|
# DEPLOYMENT_NAMESPACE="default"
|
|
# Vercel previews need isolated resources before setting ALLOW_PREVIEW_MIGRATIONS=true.
|
|
|
|
# If all S3 keys are disabled, Docker uses local filesystem storage instead.
|
|
# Make sure to mount this directory to a volume or the host filesystem to ensure data integrity.
|
|
# LOCAL_STORAGE_PATH overrides where local uploads/cache are written.
|
|
# Defaults to /app/data in the official Docker image; in dev, defaults to <workspace>/data.
|
|
# LOCAL_STORAGE_PATH="/app/data"
|
|
|
|
# Seaweedfs
|
|
S3_ACCESS_KEY_ID="seaweedfs"
|
|
S3_SECRET_ACCESS_KEY="seaweedfs"
|
|
S3_REGION="us-east-1"
|
|
S3_ENDPOINT="http://seaweedfs:8333"
|
|
S3_BUCKET="reactive-resume"
|
|
S3_FORCE_PATH_STYLE="true"
|
|
|
|
# --- AI Agent Workspace (optional) ---
|
|
# ENCRYPTION_SECRET is required for saved AI providers and the assistant.
|
|
# Redis is optional on a single server. Providers and conversations persist in PostgreSQL.
|
|
# Redis shares rate limits, resume events, cancellation and view deduplication, and resumes reply streams.
|
|
# Vercel Upstash KV_URL is accepted as an alias for REDIS_URL.
|
|
REDIS_URL="redis://redis:6379"
|
|
ENCRYPTION_SECRET="change-me-to-a-secure-agent-secret-in-production"
|
|
|
|
# --- Job posting search and scraping (optional) ---
|
|
# Set an API URL for self-hosted Firecrawl, or just an API key for Firecrawl Cloud.
|
|
# Leave both unset to let users bring their own Cloud key (requires ENCRYPTION_SECRET).
|
|
# Without a server or personal key, the built-in reader remains available and keyword search is disabled.
|
|
# FIRECRAWL_API_URL="http://localhost:3102"
|
|
# FIRECRAWL_API_KEY=""
|
|
|
|
# Optional shared AI provider. When set, personal AI providers are disabled.
|
|
# AI_PROVIDER="openai"
|
|
# AI_MODEL="gpt-5-mini"
|
|
# AI_API_KEY=""
|
|
# AI_BASE_URL=""
|
|
|
|
# --- Feature Flags ---
|
|
# This flag disables new signups, both on the web app and the server.
|
|
FLAG_DISABLE_SIGNUPS="false"
|
|
|
|
# This flag disables email/password login. Disables email verification, forgot password, and reset password flows.
|
|
# Users can still sign up via social auth (Google/GitHub/Custom OAuth), unless FLAG_DISABLE_SIGNUPS is also set to true.
|
|
FLAG_DISABLE_EMAIL_AUTH="false"
|
|
|
|
# This flag disables the image processing.
|
|
# This is useful if you are using a machine with limited resources, like a Raspberry Pi.
|
|
FLAG_DISABLE_IMAGE_PROCESSING="false"
|
|
|
|
# This flag disables API and authentication rate limiting, including PDF export and AI requests.
|
|
# Rate limiting is enabled by default in production to prevent abuse.
|
|
FLAG_DISABLE_API_RATE_LIMIT="false"
|
|
|
|
|
|
# Allows dynamic OAuth client registration to use any parseable redirect URI,
|
|
# including custom schemes, private hosts, and non-loopback http:// URLs.
|
|
# WARNING: Enabling this on a public or multi-tenant deployment can enable phishing
|
|
# or token exfiltration. Only enable this on a trusted, self-hosted instance.
|
|
FLAG_ALLOW_UNSAFE_OAUTH_REDIRECT_URI="false"
|
|
|
|
# Allows AI providers to be configured with any base URL, including http:// and
|
|
# private/loopback addresses (e.g. http://localhost:11434 for a local Ollama instance).
|
|
# WARNING: Enabling this on a multi-tenant deployment is a Server-Side Request Forgery (SSRF)
|
|
# risk. Only enable this on a trusted, single-tenant self-hosted instance.
|
|
FLAG_ALLOW_UNSAFE_AI_BASE_URL="false"
|
|
|
|
# --- Others ---
|
|
# Google Cloud API Key (optional)
|
|
# For font-list generation tooling.
|
|
# Requires "Google Fonts Developer API" to be enabled.
|
|
GOOGLE_CLOUD_API_KEY=""
|
|
|
|
# Crowdin (optional)
|
|
# For translation tooling.
|
|
CROWDIN_PROJECT_ID=""
|
|
CROWDIN_API_TOKEN=""
|