82680d9430
deploy/README.md described a rewrites() block that no longer exists, and told the reader to verify the image bucket's anonymous-download policy was set - which is precisely the exposure that was closed. Following it would have re-opened every stored image to the public internet. Replaced with what is actually true: /minio-images is a session-gated route handler with per-user key-prefix ownership, the bucket must have no anonymous policy, and MinIO must stay bound to loopback. Also noted that the suggested `mc anonymous get` check does not work on this host - the alias has no credentials and returns Access Denied either way - and gave an external curl that actually tells you something. The same stale rationale sat in deploy.sh's build comment. Building without the env file is still right, just for a different reason: nothing needs baking in. Added the MCP and OAuth journal greps, an unauthenticated discovery check, and a note that a 307 there means /.well-known fell out of PUBLIC_ROUTES. Documented in .env.example that NEXTAUTH_URL must be the exact public origin with no trailing slash, since it is now the OAuth issuer and MCP resource identifier, plus the MCP_CHATGPT_TOOLS opt-out. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W1Ee4Mc1X1SX8HgYa52zu7
37 lines
1.4 KiB
Plaintext
37 lines
1.4 KiB
Plaintext
# Database
|
|
DATABASE_URL="postgresql://drinktracker:YOUR_PASSWORD@localhost:5432/drinktracker"
|
|
POSTGRES_USER="drinktracker"
|
|
POSTGRES_PASSWORD="YOUR_PASSWORD"
|
|
POSTGRES_DB="drinktracker"
|
|
|
|
# NextAuth
|
|
# Must be the exact public origin, with NO trailing slash. Beyond login redirects
|
|
# it is the OAuth `issuer` and the MCP `resource` identifier, and connectors
|
|
# compare both byte-for-byte - a mismatch fails discovery with no useful error.
|
|
NEXTAUTH_URL="http://localhost:3000"
|
|
NEXTAUTH_SECRET="generate-with: openssl rand -base64 32"
|
|
AUTH_TRUST_HOST="true" # Set to true when behind a reverse proxy
|
|
|
|
|
|
# MinIO / S3-compatible storage
|
|
MINIO_ENDPOINT="localhost"
|
|
MINIO_PORT="9000"
|
|
MINIO_ACCESS_KEY="generate-a-strong-access-key"
|
|
MINIO_SECRET_KEY="generate-a-strong-secret-key"
|
|
MINIO_BUCKET="drink-images"
|
|
MINIO_USE_SSL="false"
|
|
|
|
# Encryption (for API key storage)
|
|
ENCRYPTION_KEY="generate-with: openssl rand -hex 32"
|
|
|
|
# AI Gateway (Switchboard)
|
|
# OpenAI-compatible router that picks the best model per request. LAN-only, plain HTTP.
|
|
# Each user adds their own gateway API key in Settings; this is only the endpoint.
|
|
SWITCHBOARD_BASE_URL="http://192.168.2.11:8787/v1"
|
|
|
|
# MCP server (optional)
|
|
# The `search` and `fetch` tools exist only for ChatGPT's deep-research mode.
|
|
# Their generic names can muddy tool selection when several connectors are
|
|
# attached at once, so set this to 0 on a Claude-only deployment to drop them.
|
|
# MCP_CHATGPT_TOOLS="0"
|