mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 07:21:32 +02:00
jwinterm
a455c60ed0
- New docs/operations/CONSOLE.md: reaching /admin, NIP-98 login, the defaults->env->DB precedence model, per-section runtime-safe vs restart-required table, expected_versions concurrency, restart_apply_mode (with the systemd Restart=always requirement for auto), clearing a DB override. Linked from README + OPERATOR_SETUP. - All six example recipes gained an explicit chain-enablement block (FEATURE_XMR/WOW on, BTC/LTC/GRIN off) so they no longer hard-fail Config::validate in production (default-on chains with empty sources). - Documented all 16 previously-undocumented env vars in .env.example (RESTART_APPLY_MODE, TOR_ADMIN_ONION, DEPLOYMENT_MODE, TIP_SHARE_BASE_URL, ...); RELAY.md gained the premium-post policy + RELAY_WRITE_ALLOWLIST_NPUBS; ADMIN_PUBKEYS noted as reserved/inert.
72 lines
3.0 KiB
Bash
72 lines
3.0 KiB
Bash
# ── Recipe: personal ────────────────────────────────────────────────────────
|
|
# Your own sovereign backend — one user (you), no gates, your rules.
|
|
#
|
|
# Start from ../../.env.example, then apply the lines below (they are what make
|
|
# this recipe "personal"). Generate each secret with: openssl rand -hex 32
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
SERVER_HOST=127.0.0.1
|
|
SERVER_PORT=8080
|
|
# REQUIRED: replace with YOUR real https domain. The your-domain.example placeholder
|
|
# is rejected at boot in production (Nostr identity is on by default).
|
|
PUBLIC_API_URL=https://your-domain.example/api/v1
|
|
ENVIRONMENT=production
|
|
|
|
# Unix socket + peer auth (run the service as the DB-owning OS user) — no password.
|
|
DATABASE_URL=postgresql:///smirk?host=/var/run/postgresql
|
|
|
|
# Secrets (REQUIRED; openssl rand -hex 32 each).
|
|
JWT_SECRET=
|
|
SEED_FINGERPRINT_PEPPER=
|
|
REFRESH_TOKEN_PEPPER=
|
|
IP_SALT=
|
|
# ALTCHA_HMAC_KEY — only needed if you set FEATURE_POW=true (this recipe leaves PoW off).
|
|
ALTCHA_HMAC_KEY=
|
|
|
|
# No gates — it's just you.
|
|
POW_REQUIRED=false
|
|
REGISTRATION_REQUIRE_INVITE=false
|
|
REGISTRATION_REQUIRE_PAYMENT=false
|
|
|
|
# Your node, your rules — scan as far back as you like on import.
|
|
WALLET_RESTORE_POLICY=unlimited
|
|
|
|
# Prices on; tips parked (v0.3 redesign).
|
|
FEATURE_PRICES=true
|
|
FEATURE_TIPS=false
|
|
|
|
# Relay off — one person doesn't need a public inbox. Flip RELAY_ENABLED=true
|
|
# (with RELAY_URL + RELAY_WRITE_POLICY=author-allowlist) if you want your own
|
|
# DM relay that only you can publish to.
|
|
RELAY_ENABLED=false
|
|
|
|
# Admin HTTP plane off — the smirk-admin CLI (break-glass) is enough solo. Keep
|
|
# ADMIN_KEY_INTEGRITY_SECRET set so the CLI works.
|
|
ADMIN_ENABLED=false
|
|
ADMIN_KEY_INTEGRITY_SECRET=
|
|
|
|
# ── Chains: enable ONLY what this recipe wires up ────────────────────────────
|
|
# FAIL-CLOSED RULE: in production, an ENABLED chain with no source configured makes
|
|
# the server REFUSE TO BOOT. Every FEATURE_* chain defaults to true, so this recipe
|
|
# turns off the chains it does not wire up. It wires up Monero + Wownero (the
|
|
# XMR_/WOW_ blocks below); fill their *_LWS_ADMIN_KEY and it boots. Running your own
|
|
# node, you will likely want more chains: to add BTC/LTC set the electrum URL, to
|
|
# add GRIN set GRIN_OWNER_API_SECRET (+ wiring), THEN flip that chain's flag to true.
|
|
FEATURE_XMR=true
|
|
FEATURE_WOW=true
|
|
FEATURE_BTC=false
|
|
FEATURE_LTC=false
|
|
FEATURE_GRIN=false
|
|
|
|
# Chain endpoints — point at YOUR nodes / light-wallet servers. See the full list
|
|
# and formats in ../../.env.example (XMR/WOW LWS + daemon, GRIN_*, BTC/LTC electrum).
|
|
XMR_LWS_URL=
|
|
XMR_LWS_ADMIN_URL=
|
|
XMR_LWS_ADMIN_KEY=
|
|
XMR_DAEMON_URL=
|
|
WOW_LWS_URL=
|
|
WOW_LWS_ADMIN_URL=
|
|
WOW_LWS_ADMIN_KEY=
|
|
WOW_DAEMON_URL=
|
|
# BTC_ELECTRUM_FALLBACKS=..., LTC_ELECTRUM_FALLBACKS=..., GRIN_* — see root example.
|