Josep Piguillem
5ae1d05d30
Pireon signs each webhook with the secret of the client that registered it, and the API has two clients (the web app's and the password grant's). Only PIREON_WEBHOOK_SECRET was accepted, so a token revoked for someone signed in with a password went unheard. A delivery now verifies with PIREON_WEBHOOK_SECRET or PIREON_PASSWORD_WEBHOOK_SECRET; the same event arriving from both clients changes nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
2.7 KiB
Plaintext
69 lines
2.7 KiB
Plaintext
PORT=3000
|
|
|
|
# Write model (commands)
|
|
POSTGRES_URL=postgres://taskstream:taskstream@localhost:5432/taskstream
|
|
# Creates/updates tables from the entities. Use migrations in production.
|
|
POSTGRES_SYNCHRONIZE=true
|
|
|
|
# Read model (queries)
|
|
MONGO_URL=mongodb://localhost:27017/taskstream_read
|
|
|
|
# Event stream (write → read), GraphQL pub/sub and session cache
|
|
REDIS_URL=redis://localhost:6379
|
|
EVENT_STREAM_KEY=task-stream:events
|
|
# Set to false on API-only instances when the events bridge (projections) runs elsewhere
|
|
EVENTS_BRIDGE_ENABLED=true
|
|
|
|
# Pireon identity server (https://oauth.pireon.dev/api/documentation)
|
|
PIREON_BASE_URL=https://oauth.pireon.dev
|
|
# Secret returned when registering the webhook (POST /api/clients/{client}/webhooks).
|
|
# Pireon signs with the secret of the client that registered it: one per client.
|
|
PIREON_WEBHOOK_SECRET=
|
|
# The password client's webhook, if it has its own
|
|
PIREON_PASSWORD_WEBHOOK_SECRET=
|
|
# OAuth clients of task-stream in Pireon (POST /api/clients). Each Pireon client allows ONE grant type:
|
|
# authorization_code → "Sign in with Pireon" and Swagger UI. Redirect URIs to register:
|
|
# http://localhost:4200/auth/callback, http://localhost:3000/api/docs/oauth2-redirect.html
|
|
PIREON_CLIENT_ID=
|
|
PIREON_CLIENT_SECRET=
|
|
# password → email + password sign-in (defaults to the client above when empty)
|
|
PIREON_PASSWORD_CLIENT_ID=
|
|
PIREON_PASSWORD_CLIENT_SECRET=
|
|
PIREON_SCOPES=users:read
|
|
PIREON_PASSWORD_GRANT=true
|
|
AUTH_SESSION_TTL_SECONDS=60
|
|
|
|
GRAPHQL_PLAYGROUND=true
|
|
|
|
# REST + OpenAPI for other apps (Swagger UI at /api/docs). The document is also written to OPENAPI_FILE.
|
|
SWAGGER_ENABLED=true
|
|
OPENAPI_FILE=apps/api/openapi.json
|
|
|
|
# Files attached to tickets: folder (a volume in Docker) and size limit per file.
|
|
ATTACHMENTS_DIR=data/attachments
|
|
ATTACHMENTS_MAX_MB=25
|
|
|
|
# Optional e-mail copies of notifications. Without SMTP_URL nothing is sent.
|
|
SMTP_URL=
|
|
MAIL_FROM=
|
|
WEB_URL=http://localhost:4200
|
|
|
|
# Outgoing webhooks refuse hosts on this machine or its private network unless true.
|
|
WEBHOOKS_ALLOW_PRIVATE=false
|
|
|
|
# Due-date reminders (hourly). The day changes at midnight in this time zone.
|
|
REMINDERS_ENABLED=true
|
|
REMINDERS_TIMEZONE=Europe/Madrid
|
|
|
|
# Docker builds only: token of Pireon's Nexus for @pi/ui (build secret, never stored in an image).
|
|
# Locally: export NEXUS_TOKEN=$(grep '^//nexus.pireon.dev/repository/npm-releases/:_authToken=' ~/.npmrc | cut -d= -f2-)
|
|
NEXUS_TOKEN=
|
|
|
|
# MCP server (apps/mcp, docs/09-mcp.md). Port: not PORT, which is the API's.
|
|
MCP_PORT=3010
|
|
TASKSTREAM_API_URL=http://localhost:3000
|
|
# Domains it answers on, comma-separated (DNS rebinding protection). Empty: localhost only.
|
|
MCP_ALLOWED_HOSTS=
|
|
# error | warn | log | debug | verbose (warn: the library logs every tool on every call otherwise)
|
|
MCP_LOG_LEVEL=warn
|