synth.textmode.art/.env.example at main · humanbydefinition/synth.textmode.art · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# ==========================================
# Core Configuration
# ==========================================
NODE_ENV=development
HOST=0.0.0.0
PORT=3000
# Connection string for PostgreSQL database
DATABASE_URL=postgresql://user:password@localhost:5432/synth_textmode
# Secret token for authenticating admin API requests (Bearer token)
ADMIN_API_TOKEN=replace_with_secure_random_token

PUBLISH_CONSENT_POLICY_VERSION=2026-02-08

# ==========================================
# Client Configuration (Vite)
# ==========================================
# Public Turnstile site key for the publish dialog
VITE_TURNSTILE_SITE_KEY=replace_with_turnstile_site_key

# Optional: Override API base URL (defaults to /api)
# VITE_API_BASE_URL=https://api.example.com
# Optional: Override runner iframe URL (defaults to internal runner)
# VITE_RUNNER_URL=https://runner.example.com
# Optional: Override media proxy URL
# VITE_MEDIA_PROXY_URL=https://media.example.com
# Optional: Allowed parent origins for the runner iframe (comma-separated)
# VITE_RUNNER_PARENT_ORIGINS=https://synth.textmode.art

# ==========================================
# Security & Anti-Spam (Server)
# ==========================================
# Secret used to sign anti-spam challenges (min 32 chars). Required in production.
ANTI_SPAM_SECRET=replace_with_at_least_32_chars_random_secret
# Secret key for verifying Turnstile tokens. Required in production.
TURNSTILE_SECRET_KEY=replace_with_turnstile_secret_key
# Optional: Turnstile verification endpoint
# TURNSTILE_VERIFY_URL=https://challenges.cloudflare.com/turnstile/v0/siteverify

# Proof-of-work difficulty (leading zero bits, 8-24). Default: 14
ANTI_SPAM_POW_DIFFICULTY=14
# Challenge validity in seconds. Default: 180
ANTI_SPAM_CHALLENGE_TTL_SECONDS=180
# Idempotency key validity in seconds. Default: 600
ANTI_SPAM_IDEMPOTENCY_TTL_SECONDS=600

# Rate limits (global)
ANTI_SPAM_MAX_CHALLENGES_PER_MINUTE=600
ANTI_SPAM_MAX_SUBMISSIONS_PER_MINUTE=60
ANTI_SPAM_MAX_PENDING_REQUESTS=5000

# ==========================================
# External Services
# ==========================================
# Optional: Discord bot for notifications
DISCORD_BOT_TOKEN=replace_with_bot_token
DISCORD_CHANNEL_ID=replace_with_channel_id
DISCORD_APPROVED_CHANNEL_ID=replace_with_approved_channel_id

# Optional: SMTP for contact form
SMTP_HOST=mail.privateemail.com
SMTP_PORT=465
SMTP_USER=hello@textmode.art
SMTP_PASS=replace_with_password
CONTACT_EMAIL_RECIPIENT=hello@textmode.art

# ==========================================
# Screenshots & Previews
# ==========================================
# Secret token required to access /_internal/preview/:slug. Required in production.
SCREENSHOT_PREVIEW_TOKEN=replace_with_at_least_16_chars_token
# Optional: Internal URL the screenshot service uses to reach the server.
# Defaults to http://127.0.0.1:{PORT}
# SCREENSHOT_BASE_URL=http://127.0.0.1:3000
# Optional: Directory for storing generated OG images. Defaults to server/storage.
# SCREENSHOT_STORAGE_DIR=/path/to/storage

# ==========================================
# Advanced / Deployment
# ==========================================
# Optional: Absolute path to the built static client assets (dist folder)
# STATIC_DIR=/app/dist
# Required in production: Public URL of the site, used for canonical links & OG tags in both server and client.
# Client reads this via Vite `envPrefix` (`PUBLIC_` is exposed).
# PUBLIC_BASE_URL=https://synth.textmode.art
# Optional: Public URL of the runner, used for CSP frame-src and CORS
# RUNNER_PUBLIC_URL=https://runner.textmode.art
# Optional: Vite dev server URL for proxying in development
# VITE_DEV_SERVER_URL=http://localhost:5180