-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
136 lines (119 loc) · 6.82 KB
/
Copy path.env.example
File metadata and controls
136 lines (119 loc) · 6.82 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
# Magik — example environment. Committed. Contains no real values, ever.
#
# ############################################################################
# # 1. NOTHING READS THIS FILE YET. #
# # #
# # As of 2026-08-26 Magik is spec only: there is no config loader, no boot #
# # process and no database connection. Every variable below is the NAME and #
# # DEFAULT that `docs/idea/00-build-spec.md` calls for, written down now so #
# # the swap points have one spelling from the start. Copying this to `.env` #
# # changes no behaviour, because no code looks it up. Status: planned. #
# # #
# # 2. `.env` IS FOR DEVELOPMENT ONLY. PRODUCTION NEVER READS IT. #
# # #
# # The intended model is Rails-shaped, and it has three layers: #
# # #
# # development .env, loaded from the working directory. Convenience. #
# # any env config/credentials.yml.enc — encrypted, COMMITTED, #
# # decrypted with config/master.key (never committed) or #
# # with MAGIK_MASTER_KEY from the environment. #
# # production real environment variables, set by the platform, plus #
# # the encrypted credentials. No .env file is read at all. #
# # #
# # `.env`, `.env.local` and `.env.*.local` are gitignored and MUST STAY #
# # gitignored. `config/master.key` is gitignored and must stay that way too. #
# # If you find yourself editing .gitignore to commit one of them, stop. #
# # This file — `.env.example` — is the only one that is committed, and it #
# # holds names and defaults, never values. #
# # #
# # The full model is documented in docs/architecture/07-configuration-and- #
# # secrets.md. #
# ############################################################################
#
# Usage, once Phase 1 lands:
# cp .env.example .env # bin/setup does this for you, and never overwrites
# # fill in the blanks, then start the local services:
# docker compose -f docker/compose.yml up -d
# --- Application -----------------------------------------------------------
# Which environment the app boots as. One of: development, test, production.
# Chooses config defaults; production additionally turns the boot-time
# guardrails into hard failures rather than warnings.
# Default: development
# In production: set by the platform (Dockerfile ENV, Kubernetes env, etc.).
MAGIK_ENV=development
# Port the Puma-backed `magik server` binds.
# Default: 3000
# In production: set by the platform — most PaaS runtimes inject $PORT.
PORT=3000
# --- Secrets ---------------------------------------------------------------
#
# Nothing in this section has a default, and that is deliberate. An app that
# boots with a fallback secret is an app that ships with one.
# Signing key from which cookie and session keys are derived. At least 64
# characters of entropy.
# Generate one with: ruby -rsecurerandom -e 'puts SecureRandom.hex(64)'
# In production: an environment variable, or an entry in the encrypted
# credentials — not this file.
SECRET_KEY_BASE=
# The key that decrypts `config/credentials.yml.enc`. Exactly one of these two
# supplies it, and this variable is the second:
#
# 1. config/master.key a file on your machine. Gitignored. Local default.
# 2. MAGIK_MASTER_KEY this variable. How production supplies it, because
# a container should carry no key file on disk.
#
# Leave it empty locally and use the file. If both are present the environment
# variable wins, so an accidentally-copied key file cannot override production.
MAGIK_MASTER_KEY=
# --- Data ------------------------------------------------------------------
# Sequel connection string for the primary database. Postgres is the default
# and the only engine with a full swap-point implementation planned for Phase 1
# (UUIDv7 keys, LISTEN/NOTIFY realtime, the transactional job queue).
# Matches the POSTGRES_* defaults in docker/compose.yml.
# Default: postgres://magik:magik@localhost:5432/magik_development
# In production: an environment variable from your database provider. It is a
# credential — it does not belong in a file that is easy to `cat` by accident.
DATABASE_URL=postgres://magik:magik@localhost:5432/magik_development
# Redis connection string. Only read when a backend below is switched to
# :redis — Redis is the documented ALTERNATIVE, never the default. Start it
# with the compose `swap` profile: `docker compose --profile swap up -d`.
# Default: redis://localhost:6379/0
# In production: an environment variable from your Redis provider.
REDIS_URL=redis://localhost:6379/0
# --- Logging ---------------------------------------------------------------
# Log output format. `text` is human-readable and is what you want in a
# terminal; `json` is one object per line, which is what you want anywhere a
# log aggregator is reading.
# text | json
# Default: text in development and test, json in production.
MAGIK_LOG_FORMAT=text
# Minimum severity that is emitted.
# debug | info | warn | error | fatal
# Default: debug in development, info in production.
MAGIK_LOG_LEVEL=debug
# --- Swap points -----------------------------------------------------------
#
# Spec decision 11: every opinionated default is switchable by config, without
# touching application code. These four selectors are that switch. The default
# column is the opinionated choice; the alternatives are what the spec commits
# to also supporting. All four are plain configuration, not secrets — set them
# wherever the rest of your platform config lives.
# Cache backend. memory | redis
# Default: memory
MAGIK_CACHE_BACKEND=memory
# Background job backend. A Postgres-backed transactional queue (Que-style) by
# default, so a job enqueues inside the same transaction as the data it acts on
# and cannot outlive a rolled-back write.
# postgres | kafka
# Default: postgres
MAGIK_JOBS_BACKEND=postgres
# Realtime backend. Postgres LISTEN/NOTIFY by default, so a single-database
# deployment needs no extra infrastructure to run realtime screens.
# postgres | redis
# Default: postgres
MAGIK_REALTIME_BACKEND=postgres
# Search backend. Postgres full-text search by default; pgvector is the same
# database with the extension enabled, for embedding search.
# postgres | pgvector | elasticsearch
# Default: postgres
MAGIK_SEARCH_BACKEND=postgres