ginnoirandClaude Sonnet 4.6
1185f5ab50
- PushOptIn now accepts vapidKey as a prop from its server-component parent (settings page reads VAPID_PUBLIC_KEY at runtime) — eliminates the NEXT_PUBLIC_* build-time dependency so pre-built GHCR images work without a build arg. - deploy/compose.yaml: famapp exposes 3010:3000, authentik-server exposes 9200:9000 so the existing Caddy stack can proxy by IP, matching every other service in the homelab. NEXT_PUBLIC_APP_URL replaced by AUTH_URL (correct next-auth v5 var). - deploy/Caddyfile.snippet: updated to 192.168.1.69:3010 / :9200. - .env.production.example: AUTH_URL, ntfy pre-wired to ntfy.ginnoir.com, VAPID_SUBJECT prefilled with real email. - typecheck and pnpm build both pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
52 lines
2.2 KiB
Bash
52 lines
2.2 KiB
Bash
# ── famapp ────────────────────────────────────────────────────────────────────
|
|
|
|
# Image tag to deploy. Pin to a specific version after first deploy
|
|
# (e.g. ghcr.io/ginnoir/famapp:v0.1.0). `latest` is fine for staging/initial.
|
|
FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest
|
|
# `always` pulls on every `up`; set `missing` if you want to skip pulls.
|
|
FAMAPP_PULL_POLICY=always
|
|
# Authentik image tag. Bump in lockstep with Authentik release notes.
|
|
AUTHENTIK_IMAGE_TAG=2024.12.3
|
|
# Run drizzle migrations on container start. Leave true.
|
|
RUN_MIGRATIONS=true
|
|
|
|
# Public URL for the app — used by Auth.js for OIDC redirect URIs.
|
|
AUTH_URL=https://fam.ginnoir.com
|
|
|
|
# famapp Postgres credentials (used to build DATABASE_URL inside compose.yaml)
|
|
FAMAPP_DB_USER=famapp
|
|
FAMAPP_DB_PASSWORD=replace-with-strong-password
|
|
FAMAPP_DB_NAME=famapp
|
|
|
|
# Auth.js session secret — generate with: openssl rand -base64 32
|
|
AUTH_SECRET=replace-with-openssl-rand-base64-32
|
|
|
|
# OIDC provider (Authentik) — fill in after bootstrapping Authentik
|
|
AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/
|
|
AUTH_OIDC_CLIENT_ID=replace-me
|
|
AUTH_OIDC_CLIENT_SECRET=replace-me
|
|
|
|
# Web Push VAPID keys — generate with: pnpm vapid:generate (run from the repo)
|
|
VAPID_PUBLIC_KEY=
|
|
VAPID_PRIVATE_KEY=
|
|
# Must be "mailto:<address>" or a URL
|
|
VAPID_SUBJECT=mailto:3nigma.matt@gmail.com
|
|
|
|
# ntfy push fallback — uses your existing ntfy instance at ntfy.ginnoir.com
|
|
# Leave NTFY_URL blank to disable ntfy fanout.
|
|
NTFY_URL=https://ntfy.ginnoir.com
|
|
NTFY_TOPIC=famapp
|
|
|
|
# Log level: error | warn | info | debug
|
|
LOG_LEVEL=info
|
|
|
|
# ── Authentik ─────────────────────────────────────────────────────────────────
|
|
|
|
# Authentik Postgres credentials (separate DB per Matt's rule)
|
|
AUTHENTIK_DB_USER=authentik
|
|
AUTHENTIK_DB_PASSWORD=replace-with-strong-password
|
|
AUTHENTIK_DB_NAME=authentik
|
|
|
|
# Authentik secret key — generate with: openssl rand -base64 60
|
|
AUTHENTIK_SECRET_KEY=replace-with-openssl-rand-base64-60
|