Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
76 lines (68 loc) · 3.42 KB
/
Copy path.env.example
File metadata and controls
76 lines (68 loc) · 3.42 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# Public URLs used by the landing page
NEXT_PUBLIC_SITE_URL=
NEXT_PUBLIC_GITHUB_URL=
# Model endpoint (/chat/completions)
LLM_BASE_URL=
LLM_API_KEY=
LLM_MODEL=
# Postgres. The app's role only needs to read and write rows; migrations can
# use a separate role that may change the schema.
DATABASE_URL=
DATABASE_MIGRATION_URL=
# Optional: model prices in USD per million tokens, to report the cost of each scan
LLM_PRICE_INPUT=
LLM_PRICE_CACHED_INPUT=
LLM_PRICE_OUTPUT=
# Optional: path to the sandchest-index binary (default: the cargo release build)
SANDCHEST_INDEXER_BIN=
# GitHub App (M2)
GITHUB_APP_ID=
GITHUB_APP_PRIVATE_KEY=
GITHUB_WEBHOOK_SECRET=
# Public URL of this deployment, for links in Checks and comments
SANDCHEST_APP_URL=
# Bearer token for operator-only routes (manual deep scans and any scan's live feed)
SANDCHEST_ADMIN_TOKEN=
# Dashboard sign-in uses the GitHub App's own OAuth client (App settings → Client ID / Generate a new
# client secret). Set the App's callback URL to <SANDCHEST_APP_URL>/api/auth/callback/github, its setup
# URL to <SANDCHEST_APP_URL>/dashboard, and give it the "Email addresses: read" account permission.
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
# The App's URL name, for install links: github.com/apps/<slug>
GITHUB_APP_SLUG=
# Signs sessions and encrypts stored GitHub tokens: 32+ random characters (openssl rand -base64 32)
BETTER_AUTH_SECRET=
# Email: Resend in the cloud, or SMTP when self-hosting. Leave both empty to send no email.
RESEND_API_KEY=
SMTP_URL=
EMAIL_FROM=
# Billing (Autumn). Leave empty to turn billing off: nothing is limited, as when self-hosting.
# Plans live in packages/billing/autumn/autumn.config.ts: `bun run --cwd packages/billing autumn:push`.
AUTUMN_SECRET_KEY=
# Signing secret (whsec_...) of the Autumn webhook for <SANDCHEST_APP_URL>/api/autumn/webhooks: auto top-up
# emails and plan changes. `autumn:push` creates the webhook and writes the secret to the env file it uses.
AUTUMN_WEBHOOK_SECRET=
# Used only by `autumn:push`: where live Autumn sends events (default: production), and where the sandbox
# does. Without a sandbox URL the sandbox gets no webhook, so a sandbox push never points at production.
AUTUMN_WEBHOOK_URL_LIVE=
AUTUMN_WEBHOOK_URL_SANDBOX=
# Vercel Cron authentication for /api/cron/sweep
CRON_SECRET=
# Where scans run: "sandbox" (default on Vercel) or "local" (default elsewhere)
SANDCHEST_WORKSPACE=
# Indexer for sandboxes: a static x86_64 Linux build, as a file or a release download + sha256
SANDCHEST_INDEXER_LINUX_BIN=
SANDCHEST_INDEXER_LINUX_URL=
SANDCHEST_INDEXER_LINUX_SHA256=
# Operators who may open /admin (quality, cost and funnel dashboards): GitHub user ids, comma-separated.
# Ids, not logins: a login can be renamed and claimed by someone else. Find yours at https://api.github.com/users/<login>.
# Empty means nobody; everyone else gets a 404.
SANDCHEST_ADMIN_GITHUB_IDS=
# Error reporting to Sentry (or anything that speaks its envelope protocol). Optional; nothing is sent by default.
# SENTRY_DSN reports server errors. NEXT_PUBLIC_SENTRY_DSN, read at build time, adds a small inline reporter (about 4 KB gzipped per page)
# to every page; leave it empty and pages carry no Sentry code at all. Events never include request bodies,
# headers, cookies, source code, finding contents or personal data. No tracing, no session replay.
SENTRY_DSN=
NEXT_PUBLIC_SENTRY_DSN=
# Optional: tag events with an environment (default: VERCEL_ENV or NODE_ENV)
SENTRY_ENVIRONMENT=