kylrix/env.sample at master · Kylrix/kylrix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
# ─────────────────────────────────────────────────────────────────────────────
# Kylrix — Environment Configuration
# Copy to .env and fill in your values, or run: make setup
# ─────────────────────────────────────────────────────────────────────────────

# ═══════════════════════════════════════════════════════════════════════════════
# CORE
# ═══════════════════════════════════════════════════════════════════════════════

# Appwrite Server SDK API key (full access — used for server-side operations)
APPWRITE_API=

# Your base domain (used for cookies, passkey RP ID, and security context)
DOMAIN=localhost

# The public URL where Kylrix is accessible
NEXT_PUBLIC_APP_URL=https://localhost
NEXT_PUBLIC_APP_URI=https://localhost
NEXT_PUBLIC_ORIGIN=https://localhost

# ═══════════════════════════════════════════════════════════════════════════════
# APPWRITE (Build-Time — passed as Docker build args)
# ═══════════════════════════════════════════════════════════════════════════════

# Your Appwrite API endpoint (with /v1)
APPWRITE_ENDPOINT=http://appwrite/v1

# Your Appwrite project ID
APPWRITE_PROJECT_ID=

# Appwrite API subdomain (for Caddy reverse proxy in bundled mode)
APPWRITE_DOMAIN=api.localhost

# ═══════════════════════════════════════════════════════════════════════════════
# APPWRITE INFRASTRUCTURE (Bundled self-hosted Appwrite only)
# ═══════════════════════════════════════════════════════════════════════════════

# OpenSSL encryption key for Appwrite (min 128 bits / 32 hex chars)
APPWRITE_OPENSSL_KEY=

# MariaDB credentials
MARIADB_USER=appwrite
MARIADB_PASSWORD=
MARIADB_ROOT_PASSWORD=

# ═══════════════════════════════════════════════════════════════════════════════
# SELF-HOSTING
# ═══════════════════════════════════════════════════════════════════════════════

# Appwrite Server SDK API key for schema provisioning (same as APPWRITE_API)
APPWRITE_API_KEY=

# Flag to indicate self-hosted instance (enables self-host-specific behaviors)
SELFHOST_MODE=true

# ═══════════════════════════════════════════════════════════════════════════════
# SECURITY
# ═══════════════════════════════════════════════════════════════════════════════

# Admin email addresses (comma-separated) — gets admin panel access
ADMINS=

# Internal jobs authentication (min 32 chars, never expose to client)
# Used for POST /api/internal/runtime-functions cron/infra calls
KYLRIX_INTERNAL_JOBS_SECRET=

# HMAC signing secret for attachment download URLs
ATTACHMENT_URL_SIGNING_SECRET=

# Signed attachment URL time-to-live (seconds)
ATTACHMENT_URL_TTL_SECONDS=300

# Auth subdomain prefix (e.g. "accounts" → accounts.yourdomain.com)
AUTH_SUBDOMAIN=accounts

# ═══════════════════════════════════════════════════════════════════════════════
# AI / AGENTIC FEATURES (Optional)
# ═══════════════════════════════════════════════════════════════════════════════

# Google Gemini API key — powers agentic workflows, AI summaries, etc.
GOOGLE_API_KEY=

# Gemini model name (e.g. gemini-2.5-flash-lite, gemini-1.5-pro)
GEMINI_MODEL_NAME=gemini-2.5-flash-lite

# ═══════════════════════════════════════════════════════════════════════════════
# INTEGRATIONS (Optional)
# ═══════════════════════════════════════════════════════════════════════════════

# Cloudflare Turnstile — bot protection on auth flows
CLOUDFLARE_TURNSTILE_SECRET=
NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_KEY=

# Cloudflare API — DNS management
CLOUDFLARE_API=

# Telegram Bot — push notifications via Telegram
TELEGRAM_BOT_API=

# BlockBee — crypto payments for Kylrix Pro subscriptions
BLOCKBEE_API=
# RSA public key PEM for webhook verification (defaults to BlockBee-published key)
BLOCKBEE_WEBHOOK_PUBLIC_KEY_PEM=
# NEVER set in production: skips RSA verification on /api/pro/notify (testing only)
BLOCKBEE_ALLOW_UNSIGNED_WEBHOOKS=

# ═══════════════════════════════════════════════════════════════════════════════
# TUNING
# ═══════════════════════════════════════════════════════════════════════════════

# Number of notes loaded per page
NEXT_PUBLIC_NOTES_PAGE_SIZE=100

# Verbose client logging (set to "true" for debugging)
NEXT_PUBLIC_LOGGING_VERBOSE=

# ═══════════════════════════════════════════════════════════════════════════════
# SMTP (Required for multi-user — email verification & notifications)
# ═══════════════════════════════════════════════════════════════════════════════

# SMTP_HOST=smtp.example.com
# SMTP_PORT=587
# SMTP_SECURE=tls
# SMTP_USERNAME=
# SMTP_PASSWORD=