Ben Stull
677c5eb72f
The example comment referenced 'ohm-rfc-app-flotilla overlay set' — the retired per-app shim. flotilla-core is the operator CLI for all deployments. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
50 lines
2.3 KiB
Bash
50 lines
2.3 KiB
Bash
# Preview environment shape (flotilla SPEC §15) — TEST values only.
|
|
#
|
|
# These are the env vars a per-PR preview boots with. The operator loads them
|
|
# into flotilla's PREVIEW overlay layer (NOT the base overlay, NOT secrets):
|
|
#
|
|
# while IFS='=' read -r k v; do
|
|
# [ -n "$k" ] && case "$k" in \#*) ;; *) \
|
|
# flotilla-core overlay set <deployment> "$k=$v" --preview ;; esac
|
|
# done < deploy/preview/preview.env.example
|
|
#
|
|
# CRITICAL (§15 / §3 invariant 1): a preview resolves ZERO real secret bytes.
|
|
# Every value here is synthetic or a documented public test value. None is a
|
|
# real credential. Do NOT bind real `secret_refs` for previews.
|
|
|
|
# --- Turnstile: Cloudflare's documented ALWAYS-PASS test keys (public) -------
|
|
# Site key is also baked into the image at build time (Dockerfile ARG); the
|
|
# secret key here makes server-side verification always succeed.
|
|
CLOUDFLARE_TURNSTILE_SECRET=1x0000000000000000000000000000000AA
|
|
VITE_TURNSTILE_SITE_KEY=1x00000000000000000000AA
|
|
|
|
# --- Email: a catch-all SMTP sink (run Mailpit/Inbucket as a sidecar/service)-
|
|
# No mail leaves the preview; everything lands in the sink's web UI.
|
|
SMTP_HOST=mailpit
|
|
SMTP_PORT=1025
|
|
SMTP_STARTTLS=0
|
|
SMTP_PASSWORD=preview-sink-no-auth
|
|
EMAIL_FROM=preview@preview.invalid
|
|
EMAIL_FROM_NAME=RFC App (preview)
|
|
|
|
# --- Analytics: no-op'd -------------------------------------------------------
|
|
VITE_AMPLITUDE_API_KEY=
|
|
|
|
# --- App identity / required env (synthetic) ---------------------------------
|
|
# These satisfy backend/app/config.py's required vars with non-secret test
|
|
# values. SECRET_KEY is a throwaway — sessions in an ephemeral preview need a
|
|
# key, not a SECRET one. GITEA_* point at whatever read surface the preview
|
|
# uses; for a content-light framework-PR preview the seeded synthetic DB
|
|
# carries the visible state and Gitea need not be reachable.
|
|
SECRET_KEY=preview-throwaway-not-a-secret-0000000000
|
|
GITEA_URL=https://git.wiggleverse.org
|
|
GITEA_BOT_USER=preview-bot
|
|
GITEA_BOT_TOKEN=preview-not-a-real-token
|
|
GITEA_ORG=preview
|
|
GITEA_WEBHOOK_SECRET=preview-webhook-not-a-secret
|
|
OAUTH_CLIENT_ID=preview-oauth-client
|
|
OAUTH_CLIENT_SECRET=preview-oauth-not-a-secret
|
|
# APP_URL: set to the Cloud Run service URL once `preview up` reports it, if the
|
|
# app's OAuth redirect / absolute-URL building needs it for your review flow.
|
|
APP_URL=http://localhost:8080
|