# ============================================================================ # Tx OS — environment configuration. Copy to `.env` and edit before deploying. # Everything in this file is read either by docker-compose.yml at `up` time # or directly by the application processes (`api-server`, `tx-os`, scripts). # NEVER commit `.env` — it is gitignored. `.env.example` is the public template. # ============================================================================ # ----------------------------------------------------------------------------- # Host ports (compose only) # ----------------------------------------------------------------------------- # Port the SPA (nginx) is reachable on. Front with TLS in production. WEB_PORT=3000 # Port the API container is reachable on. In public deployments, bind this # to 127.0.0.1 only so the edge proxy is the sole external entry point. API_PORT=8080 # Component preview server port (dev profile only). MOCKUP_PORT=8081 # ----------------------------------------------------------------------------- # API server runtime # ----------------------------------------------------------------------------- # In compose this is set automatically; required when running natively. PORT=8080 # Public base URL the SPA + API are reachable at. Used to build absolute # upload URLs for the local-FS storage driver and to derive whether the # session cookie should be marked `secure`. Match the URL operators # actually open in the browser (e.g. https://tx.example.com). PUBLIC_BASE_URL=http://localhost:3000 # Comma-separated list of origins allowed by the API server's CORS layer. # MUST include every URL the SPA can be reached at — the public domain, # any reverse-proxy hostnames, the LAN IP for tablets/phones, and any # tunneled URL (Tailscale `*.ts.net`, ngrok, Cloudflare Tunnel, etc). # Examples: # ALLOWED_ORIGINS=http://localhost:3000 # ALLOWED_ORIGINS=https://tx.example.com,https://it-demo.tail70b2bc.ts.net # ALLOWED_ORIGINS=http://localhost:3000,http://192.168.1.42:3000 ALLOWED_ORIGINS=http://localhost:3000 # Set to `true` when Tx OS sits behind a TLS-terminating proxy that # does NOT forward `X-Forwarded-Proto: https` (notably `tailscale serve`, # the ngrok free tier, and some Cloudflare Tunnel setups). Without this, # the session cookie is silently dropped and login bounces back to the # login screen even on a successful POST /auth/login. Leave unset for # direct localhost access or when your proxy forwards the header. # SECURITY: only enable when the API is not reachable directly over plain # HTTP from outside — i.e. only your TLS edge proxy can hit it. Otherwise # anyone on the same network can submit plain-HTTP requests that the app # trusts as HTTPS. TRUST_PROXY_HTTPS=false # pino log level: trace | debug | info | warn | error | fatal LOG_LEVEL=info # 32+ random bytes. Generate with `openssl rand -hex 32`. REQUIRED. SESSION_SECRET=change-me-session-secret-min-32-chars-please # ----------------------------------------------------------------------------- # Local hostname / TLS (used by Caddy + the Setup Wizard) # ----------------------------------------------------------------------------- # Hostname operators reach the system at on the LAN. The Caddy edge # binds this name and serves the mkcert-issued certificate. LOCAL_DOMAIN=tx.local # Auto-detected by scripts/local-setup.sh — the host's LAN IP. Used as # an additional SAN on the local certificate so phones / tablets that # can't resolve mDNS can still reach the system at https:///. LOCAL_IP= # Canonical public URL the SPA + API are reachable at. Setup Wizard # stores this in system_settings.base_url at install time. BASE_URL=https://tx.local # Edge ports (Caddy). Set HTTP_PORT=8080 / HTTPS_PORT=8443 if you # can't bind privileged ports. HTTP_PORT=80 HTTPS_PORT=443 # TLS strategy: # local — local-setup.sh provisions ./certs/local-{cert,key}.pem via mkcert # byo — operator drops their own cert/key into ./certs/ with the same names # skip — DEVELOPER ONLY: serve plaintext on :80, no HTTPS. Never use # outside trusted local development networks. HTTPS_MODE=local # ----------------------------------------------------------------------------- # SPA build (tx-os) — read by Vite at build time AND `pnpm --filter tx-os dev` # ----------------------------------------------------------------------------- # Path the SPA is mounted at. Use "/" when serving from the domain root. BASE_PATH=/ # ----------------------------------------------------------------------------- # Database # ----------------------------------------------------------------------------- POSTGRES_USER=tx POSTGRES_PASSWORD=change-me-postgres POSTGRES_DB=tx_os # Composed automatically by docker-compose; set explicitly when running natively. # DATABASE_URL=postgres://tx:change-me-postgres@localhost:5432/tx_os DATABASE_URL=postgres://tx:change-me-postgres@db:5432/tx_os # ----------------------------------------------------------------------------- # Object storage # ----------------------------------------------------------------------------- # Driver selection. "local" persists uploads on the API container's # filesystem (works out-of-the-box for a single-host deployment like the # Mac mini); "s3" routes uploads to MinIO/S3 (requires the keys below). # If unset, the driver auto-detects: "s3" when S3_ENDPOINT is set, else "local". STORAGE_DRIVER=local # Bucket-level paths used by the API. Format: // PRIVATE_OBJECT_DIR=/tx-private/private PUBLIC_OBJECT_SEARCH_PATHS=/tx-public/public # Bucket names — created on first boot by the minio-init container. S3_BUCKET_PRIVATE=tx-private S3_BUCKET_PUBLIC=tx-public # S3-compatible endpoint URL. For MinIO running in compose this is the # in-network DNS name. For AWS S3 leave blank (the SDK uses the default # regional endpoint). For Cloudflare R2 / Backblaze B2, set the vendor URL. S3_ENDPOINT=http://minio:9000 # MinIO root credentials. Used both as MINIO_ROOT_USER/PASSWORD and as the # API server's S3 access key. Change before first boot. S3_ACCESS_KEY_ID=tx-minio-admin S3_SECRET_ACCESS_KEY=change-me-minio-secret-min-20-chars # Region label is cosmetic for MinIO but @aws-sdk requires one. S3_REGION=us-east-1 # Path-style addressing is required by MinIO and most non-AWS S3 backends. # Set to "false" only when targeting real AWS S3 (which prefers virtual-host # style). Defaults to "true" inside the API server. S3_FORCE_PATH_STYLE=true # Local-FS driver settings (only consulted when STORAGE_DRIVER=local). # Filesystem root for uploaded objects. Defaults to ./storage relative to # the API server's working directory. LOCAL_STORAGE_ROOT=./storage # HMAC key used to sign + verify upload URLs for the local driver. If # unset, the driver falls back to SESSION_SECRET. Set explicitly to rotate # upload-URL trust independently of session trust. LOCAL_STORAGE_SIGNING_SECRET= # ----------------------------------------------------------------------------- # Seeded demo accounts (OPTIONAL since the Setup Wizard exists) # ----------------------------------------------------------------------------- # When BOTH variables are set, the migrate container creates an `admin` # and `ahmed` user with these passwords on first boot and immediately # marks the install complete (skipping the wizard). When EITHER is unset, # the seed creates only roles/permissions and leaves admin creation to # the first-run wizard at /setup. SEED_ADMIN_PASSWORD= SEED_USER_PASSWORD= # Set to `true` to populate the Executive Meetings module with a full # day of realistic-looking demo meetings on first boot (useful for # screenshots, sales demos, and UI walkthroughs). Leave unset on real # self-hosted installs — the module should start empty. SEED_DEMO_MEETINGS=false # ----------------------------------------------------------------------------- # Email (optional) # ----------------------------------------------------------------------------- # Leave SMTP_HOST blank to disable outbound mail. The Executive Meetings # notifier no-ops when no SMTP config is present. SMTP_HOST= SMTP_PORT=587 SMTP_USER= SMTP_PASS= SMTP_SECURE=false SMTP_FROM=Tx OS