Josep Piguillem
233c46e9fa
- What reaches the bell also reaches the devices where the person turned «Avisos en este dispositivo» on, with TaskStream closed: the Notifier sends each new notification encrypted (aes128gcm) and signed with VAPID, and forgets subscriptions the push service dropped (404/410). A failure never blocks the event stream. - The API keeps one subscription per device (push_subscriptions) and exposes the VAPID public key in the notification settings; GraphQL subscribePush/unsubscribePush, REST /me/push-subscriptions. Without VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY push is off. - The web registers /push-sw.js, a service worker that only shows the notification and opens its ticket on a tap (no caching, served without cache by nginx), and a manifest that makes it installable, which iPhones need for push. - The bell's toggles show their text next to them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
3.0 KiB
Plaintext
76 lines
3.0 KiB
Plaintext
PORT=3000
|
|
|
|
# Write model (commands)
|
|
POSTGRES_URL=postgres://taskstream:taskstream@localhost:5432/taskstream
|
|
# Creates/updates tables from the entities. Use migrations in production.
|
|
POSTGRES_SYNCHRONIZE=true
|
|
|
|
# Read model (queries)
|
|
MONGO_URL=mongodb://localhost:27017/taskstream_read
|
|
|
|
# Event stream (write → read), GraphQL pub/sub and session cache
|
|
REDIS_URL=redis://localhost:6379
|
|
EVENT_STREAM_KEY=task-stream:events
|
|
# Set to false on API-only instances when the events bridge (projections) runs elsewhere
|
|
EVENTS_BRIDGE_ENABLED=true
|
|
|
|
# Pireon identity server (https://oauth.pireon.dev/api/documentation)
|
|
PIREON_BASE_URL=https://oauth.pireon.dev
|
|
# Secret returned when registering the webhook (POST /api/clients/{client}/webhooks).
|
|
# Pireon signs with the secret of the client that registered it: one per client.
|
|
PIREON_WEBHOOK_SECRET=
|
|
# The password client's webhook, if it has its own
|
|
PIREON_PASSWORD_WEBHOOK_SECRET=
|
|
# OAuth clients of task-stream in Pireon (POST /api/clients). Each Pireon client allows ONE grant type:
|
|
# authorization_code → "Sign in with Pireon" and Swagger UI. Redirect URIs to register:
|
|
# http://localhost:4200/auth/callback, http://localhost:3000/api/docs/oauth2-redirect.html
|
|
PIREON_CLIENT_ID=
|
|
PIREON_CLIENT_SECRET=
|
|
# password → email + password sign-in (defaults to the client above when empty)
|
|
PIREON_PASSWORD_CLIENT_ID=
|
|
PIREON_PASSWORD_CLIENT_SECRET=
|
|
PIREON_SCOPES=users:read
|
|
PIREON_PASSWORD_GRANT=true
|
|
AUTH_SESSION_TTL_SECONDS=60
|
|
|
|
GRAPHQL_PLAYGROUND=true
|
|
|
|
# REST + OpenAPI for other apps (Swagger UI at /api/docs). The document is also written to OPENAPI_FILE.
|
|
SWAGGER_ENABLED=true
|
|
OPENAPI_FILE=apps/api/openapi.json
|
|
|
|
# Files attached to tickets: folder (a volume in Docker) and size limit per file.
|
|
ATTACHMENTS_DIR=data/attachments
|
|
ATTACHMENTS_MAX_MB=25
|
|
|
|
# Optional e-mail copies of notifications. Without SMTP_URL nothing is sent.
|
|
SMTP_URL=
|
|
MAIL_FROM=
|
|
WEB_URL=http://localhost:4200
|
|
|
|
# Optional push notifications (Web Push). Without both keys nothing is sent.
|
|
# Make them once with `npx web-push generate-vapid-keys` (changing them drops
|
|
# every device's subscription). VAPID_SUBJECT: a mailto: or https: contact.
|
|
VAPID_PUBLIC_KEY=
|
|
VAPID_PRIVATE_KEY=
|
|
VAPID_SUBJECT=mailto:no-reply@pireon.dev
|
|
|
|
# Outgoing webhooks refuse hosts on this machine or its private network unless true.
|
|
WEBHOOKS_ALLOW_PRIVATE=false
|
|
|
|
# Due-date reminders (hourly). The day changes at midnight in this time zone.
|
|
REMINDERS_ENABLED=true
|
|
REMINDERS_TIMEZONE=Europe/Madrid
|
|
|
|
# Docker builds only: token of Pireon's Nexus for @pi/ui (build secret, never stored in an image).
|
|
# Locally: export NEXUS_TOKEN=$(grep '^//nexus.pireon.dev/repository/npm-releases/:_authToken=' ~/.npmrc | cut -d= -f2-)
|
|
NEXUS_TOKEN=
|
|
|
|
# MCP server (apps/mcp, docs/09-mcp.md). Port: not PORT, which is the API's.
|
|
MCP_PORT=3010
|
|
TASKSTREAM_API_URL=http://localhost:3000
|
|
# Domains it answers on, comma-separated (DNS rebinding protection). Empty: localhost only.
|
|
MCP_ALLOWED_HOSTS=
|
|
# error | warn | log | debug | verbose (warn: the library logs every tool on every call otherwise)
|
|
MCP_LOG_LEVEL=warn
|