Hiren KangadandClaude Opus 4.7
76a6e462ee
Two changes that drop the friction in self-hosting RefBoard so the install
story becomes "docker compose up, open the URL".
1. JWT_SECRET is now optional. On first boot the backend generates a
64-byte random secret and persists it in the existing settings table.
process.env.JWT_SECRET still wins when set, so ops setups that manage
secrets out-of-band are unaffected. The prod-throws-without-env guard
is gone (auto-generation is a strictly safer default than the previous
hardcoded dev fallback).
2. STORAGE_BACKEND=fs|minio picks between MinIO (default, unchanged) and
a new local-filesystem adapter. The FS adapter exposes a fake minioClient
that mirrors the methods RefBoard calls (statObject, getObject,
getPartialObject, listObjectsV2, putObject, removeObject(s), bucketExists,
makeBucket), so consumers swap require('./minio') for require('./storage')
and nothing else changes. Sidecar .mime files hold Content-Type so the
range-aware media proxy still serves the right response headers.
examples/compose/minimal-fs.yml is the single-container variant that uses
the FS adapter. The default docker-compose.yml still spins up MinIO.
README quick-start collapses to one block (cp .env, docker compose pull,
docker compose up -d). The first user you register on the Login screen is
auto-promoted to admin, same as before.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
75 lines
3.1 KiB
Bash
75 lines
3.1 KiB
Bash
# ────────────────────────────────────────────────
|
|
# RefBoard — Environment Configuration
|
|
# Copy this file to `.env` and edit values for your install.
|
|
# ────────────────────────────────────────────────
|
|
|
|
# ---- Server ----
|
|
PORT=8000
|
|
NODE_ENV=development
|
|
CORS_ORIGIN=*
|
|
|
|
# ---- Container image (Docker Compose only) ----
|
|
# Pre-built multi-arch images are published to GHCR on every push to main.
|
|
# Pin a release with e.g. ghcr.io/metalfinger/refboard:v0.5.0 — see
|
|
# https://github.com/metalfinger/refboard/pkgs/container/refboard for tags.
|
|
REFBOARD_IMAGE=ghcr.io/metalfinger/refboard:latest
|
|
|
|
# ---- JWT auth ----
|
|
# OPTIONAL. If unset, RefBoard generates a 64-byte random secret on first boot
|
|
# and persists it in the SQLite settings table. Set this env var only if you
|
|
# want ops to manage the secret out-of-band (e.g. via a secrets manager) — when
|
|
# set, it always overrides the persisted value. Rotate by clearing the env var
|
|
# *and* deleting the settings.jwt_secret row; this invalidates existing tokens.
|
|
# JWT_SECRET=
|
|
JWT_EXPIRES_IN=7d
|
|
|
|
# ---- SQLite database ----
|
|
# Path inside the running process. Defaults to /app/data/refboard.db (Docker).
|
|
# For local non-Docker dev, set this to ./data/refboard.db (relative to backend/).
|
|
DB_PATH=/app/data/refboard.db
|
|
|
|
# ---- Object storage ----
|
|
# STORAGE_BACKEND=minio (default) — uses MinIO or any S3-compatible store.
|
|
# STORAGE_BACKEND=fs — stores media bytes on the local filesystem
|
|
# under STORAGE_DATA_DIR. Collapses the stack
|
|
# to a single container; see
|
|
# examples/compose/minimal-fs.yml.
|
|
STORAGE_BACKEND=minio
|
|
STORAGE_DATA_DIR=/app/data/storage
|
|
|
|
# MinIO settings (ignored when STORAGE_BACKEND=fs)
|
|
MINIO_ENDPOINT=minio
|
|
MINIO_PORT=9000
|
|
MINIO_USE_SSL=false
|
|
MINIO_ACCESS_KEY=minioadmin
|
|
MINIO_SECRET_KEY=minioadmin
|
|
MINIO_BUCKET=refboard
|
|
|
|
# Public-facing base URL for media. Leave empty to serve via the backend proxy
|
|
# (recommended for self-hosted single-box installs).
|
|
PUBLIC_URL=
|
|
|
|
# Max upload size in MB (per file). Defaults to 200.
|
|
MAX_FILE_SIZE_MB=200
|
|
|
|
# ---- First-run admin bootstrap ----
|
|
# When the server starts and no user with this email exists, RefBoard will
|
|
# create one with role=admin. Idempotent — runs every boot but only seeds once.
|
|
# Leave blank to skip seeding.
|
|
SEED_ADMIN_EMAIL=
|
|
SEED_ADMIN_PASSWORD=
|
|
SEED_ADMIN_USERNAME=
|
|
SEED_ADMIN_DISPLAY_NAME=
|
|
|
|
# ---- Self-registration ----
|
|
# Initial value for the runtime self-registration toggle. Default "false".
|
|
# After the first boot this env var is IGNORED — admins control the toggle
|
|
# from the dashboard at /admin (it's persisted in the database).
|
|
# The very first user can always register, regardless of this flag, and is
|
|
# auto-promoted to admin.
|
|
ALLOW_SELF_REGISTRATION=false
|
|
|
|
# ---- Optional: API key for bot / programmatic upload ----
|
|
# If set, /api/upload/api-key endpoints require this header value.
|
|
REFBOARD_API_KEY=
|