insforge/insforge-oss repository overview

# =============================================================================
# InsForge Environment Configuration
# =============================================================================
# Copy this file to .env and fill in your values:
#   cp .env.example .env
#
# Security Notes:
# - Never commit .env to version control
# - Use strong, unique secrets in production
# - Rotate secrets regularly
# =============================================================================

# -----------------------------------------------------------------------------
# Server Configuration
# -----------------------------------------------------------------------------
PORT=7130

# Max body size for JSON payloads (default: 100mb)
# High default ensures "out-of-the-box" reliability for large metadata/storage requests.
# Users can decrease this for hardened security on low-resource environments.
MAX_JSON_BODY_SIZE=100mb

# Max body size for URL-encoded payloads (default: 10mb)
MAX_URLENCODED_BODY_SIZE=10mb

# -----------------------------------------------------------------------------
# PostgreSQL Configuration
# -----------------------------------------------------------------------------
# These are optional - defaults are shown below
# In production, use strong passwords and consider external database services
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_DB=insforge

# -----------------------------------------------------------------------------
# Ports (Configurable)
# -----------------------------------------------------------------------------

# PostgreSQL
POSTGRES_PORT=5432

# PostgREST API
POSTGREST_PORT=5430

# Main application ports
APP_PORT=7130
AUTH_PORT=7131
UI_PORT=7132

# Deno serverless runtime
DENO_PORT=7133

# API Base URLs - Update if running on different host/port
API_BASE_URL=http://localhost:7130
VITE_API_BASE_URL=http://localhost:7130

# -----------------------------------------------------------------------------
# Authentication & Security
# -----------------------------------------------------------------------------
# JWT_SECRET: Must be at least 32 characters. Use a secure random generator!
# Example: openssl rand -base64 32
JWT_SECRET=your-secret-key-here-must-be-32-char-or-above

# Admin credentials - CHANGE THESE IN PRODUCTION!
[email protected]
ADMIN_PASSWORD=change-this-password

# Encryption key for secrets and database encryption
# IMPORTANT: Set this to a separate 32+ character secret from JWT_SECRET.
# If not set, JWT_SECRET is used as fallback — but rotating JWT_SECRET will
# permanently corrupt all stored secrets (API keys, OAuth tokens, etc.).
# Generate with: openssl rand -base64 32
ENCRYPTION_KEY=

# API Key for authenticated requests
# Must start with 'ik_' prefix and be at least 32 characters
# Optional - will be auto-generated if not provided
ACCESS_API_KEY=ik_your-api-key-here-32-chars-minimum

# Cloud API Host (Optional)
# Only needed if using cloud features
CLOUD_API_HOST=https://api.insforge.dev

# -----------------------------------------------------------------------------
# Deployment Configuration (Optional)
# -----------------------------------------------------------------------------
# Required for self-hosted site deployments and custom domains.
# Legacy deployments also require AWS_S3_BUCKET to be configured.
VERCEL_TOKEN=
VERCEL_TEAM_ID=
VERCEL_PROJECT_ID=

# -----------------------------------------------------------------------------
# AWS Config Bucket Configuration (Optional)
# -----------------------------------------------------------------------------
# Used for loading remote configuration files from S3
# If not provided, defaults will be used
AWS_CONFIG_BUCKET=insforge-config
AWS_CONFIG_REGION=us-east-2



# -----------------------------------------------------------------------------
# Storage Configuration
# -----------------------------------------------------------------------------
# Storage options:
# - Local filesystem: Leave AWS_S3_BUCKET empty (default)
# - AWS S3: Set AWS_S3_BUCKET, AWS_REGION, and AWS credentials
# - S3-compatible (Wasabi, MinIO, etc.): Set S3_* variables
#
# Local storage directory (default: ./insforge-storage relative to cwd)
# In Docker this is set to /insforge-storage automatically via the Dockerfile.
# PaaS deployments (Zeabur, Render, etc.) should set this to match the
# persistent volume mount path.
# STORAGE_DIR=./insforge-storage
#
# AWS credentials (used by CloudWatch logging and as fallback for storage)
AWS_ACCESS_KEY_ID=
AWS_REGION=
AWS_S3_BUCKET=
AWS_SECRET_ACCESS_KEY=

# Max upload file size in bytes (default: 52428800 = 50MB)
# Examples: 10485760 = 10MB, 104857600 = 100MB
MAX_FILE_SIZE=

# S3-compatible storage credentials (for Wasabi, MinIO, R2, etc.)
# These take precedence over AWS_* variables if set
S3_ACCESS_KEY_ID=
S3_ENDPOINT_URL=
S3_SECRET_ACCESS_KEY=

# CloudFront signed URLs (Optional, AWS S3 only)
# When AWS_CLOUDFRONT_URL is set, storage downloads are served through
# CloudFront with signed URLs instead of S3 presigned URLs. Ignored when
# S3_ENDPOINT_URL is set (CloudFront does not front S3-compatible providers).
# Setup: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html
#
# AWS_CLOUDFRONT_URL: CloudFront distribution domain (e.g. https://d1234abcd.cloudfront.net)
# AWS_CLOUDFRONT_KEY_PAIR_ID: Trusted key group key-pair ID (e.g. K2JCJMDEHXQW5F)
# AWS_CLOUDFRONT_PRIVATE_KEY: PEM private key. Use \n for newlines when kept on one line.
# If URL is set but key pair or private key is missing, downloads fall back to S3 presigned URLs.
AWS_CLOUDFRONT_URL=
AWS_CLOUDFRONT_KEY_PAIR_ID=
AWS_CLOUDFRONT_PRIVATE_KEY=

# -----------------------------------------------------------------------------
# Logging Configuration
# -----------------------------------------------------------------------------
# CloudWatch Logging: Set AWS_REGION + AWS credentials above
# File-based Logging: Configure LOGS_DIR below (used when AWS credentials not provided)
# Directory where log files will be stored (defaults to ./logs)
LOGS_DIR=


# -----------------------------------------------------------------------------
# AI/LLM Configuration
# -----------------------------------------------------------------------------
# OpenRouter API - Get your API key from https://openrouter.ai/keys
# Used for AI-powered features and model gateway
OPENROUTER_API_KEY=

# -----------------------------------------------------------------------------
# Stripe Payments Configuration (Optional)
# -----------------------------------------------------------------------------
# Developer-owned Stripe secret keys. Test key is used for implementation and
# validation. Live key is used only for explicit go-live flows.
STRIPE_LIVE_SECRET_KEY=
STRIPE_TEST_SECRET_KEY=

# -----------------------------------------------------------------------------
# Analytics Configuration
# -----------------------------------------------------------------------------
# PostHog - Only needed for local development
# Get your key from https://posthog.com/settings/project
VITE_PUBLIC_POSTHOG_KEY=

# -----------------------------------------------------------------------------
# OAuth Configuration (Optional)
# -----------------------------------------------------------------------------
# Enable social login by configuring one or more providers below.
# Each provider requires registering an application in their developer console.
#
# Google OAuth
# Console: https://console.cloud.google.com/
# Redirect URI: http://localhost:7130/auth/google/callback
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# GitHub OAuth
# Console: https://github.com/settings/developers
# Redirect URI: http://localhost:7130/auth/github/callback
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# Microsoft OAuth (Azure AD)
# Console: https://portal.azure.com/
# Redirect URI: http://localhost:7130/auth/microsoft/callback
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=

# Discord OAuth
# Console: https://discord.com/developers/applications
# Redirect URI: http://localhost:7130/auth/discord/callback
DISCORD_CLIENT_ID=
DISCORD_CLIENT_SECRET=

# LinkedIn OAuth
# Console: https://www.linkedin.com/developers/apps
# Redirect URI: http://localhost:7130/auth/linkedin/callback
LINKEDIN_CLIENT_ID=
LINKEDIN_CLIENT_SECRET=

# X (Twitter) OAuth
# Console: https://developer.twitter.com/en/portal/dashboard
# Redirect URI: http://localhost:7130/auth/x/callback
X_CLIENT_ID=
X_CLIENT_SECRET=

# Apple OAuth (Sign in with Apple)
# Console: https://developer.apple.com/account/resources/identifiers/list
# APPLE_CLIENT_ID: Your Services ID (e.g., com.yourapp.service)
# APPLE_CLIENT_SECRET: JSON string with teamId, keyId, and privateKey
#   Format: {"teamId":"XXX","keyId":"YYY","privateKey":"-----BEGIN PRIVATE KEY-----\n..."}
# Redirect URI: http://localhost:7130/auth/apple/callback
APPLE_CLIENT_ID=
APPLE_CLIENT_SECRET=

# -----------------------------------------------------------------------------
# Multi-tenant Cloud Configuration
# -----------------------------------------------------------------------------
# These are only used for the cloud-hosted solution
# Leave empty for self-hosted deployments
DEPLOYMENT_ID=
PROJECT_ID=
APP_KEY=

# -----------------------------------------------------------------------------
# Serverless Functions Configuration
# -----------------------------------------------------------------------------
# Deno Deploy - For hosting serverless edge functions
# Get your token from: https://dash.deno.com/account#access-tokens
# Get your org ID from: https://dash.deno.com/
DENO_SUBHOSTING_TOKEN=
DENO_SUBHOSTING_ORG_ID=

# ─── Compute Services (Fly.io) ──────────────────────────────────────────────
# Deploy Docker containers with persistent URLs.
# Full setup + architecture: https://docs.insforge.dev/core-concepts/compute/architecture
#
# Setup — both FLY_API_TOKEN and FLY_ORG are required. FLY_ORG must be YOUR
# Fly org slug; leaving it blank or as "insforge" will fail with an opaque
# Fly auth error because that's our internal org. Compute auto-enables when
# both are set.
#   1. Create a Fly.io account: https://fly.io
#   2. Find your org slug: fly orgs list
#   3. Create an API token scoped to that org: fly tokens create org -o <your-org>
#   4. Set FLY_API_TOKEN=<token> and FLY_ORG=<your-org>
#
# Optional: Set COMPUTE_DOMAIN only if you own a wildcard domain pointed at
# Fly (e.g. *.compute.yourdomain.com CNAME'd to fly.dev). Leave unset to use
# Fly's own .fly.dev hostname, which works out of the box.

FLY_API_TOKEN=
FLY_ORG=
COMPUTE_DOMAIN=

# Cloud-mode compute (provisioned automatically when PROJECT_ID + CLOUD_API_HOST
# are set by insforge-cloud). Self-host users with FLY_API_TOKEN always take
# priority and do not need to set PROJECT_ID.

# =============================================================================
# End of Configuration
# =============================================================================
# After configuring this file:
# 1. Run: docker compose up -d
# 2. Check logs: docker compose logs -f
# 3. Access the dashboard at: http://localhost:7131
#
# For more information, visit: https://insforge.dev/docs
# =============================================================================

services:
  postgres:
    image: insforge/postgres-all:15.13.2
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-insforge}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-change-this-encryption-key-32chars}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
      interval: 5s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true

  postgrest:
    image: postgrest/postgrest:v12.2.12
    restart: unless-stopped
    environment:
      PGRST_DB_URI: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-insforge}
      PGRST_OPENAPI_SERVER_PROXY_URI: ${POSTGREST_OPENAPI_SERVER_PROXY_URI:-http://localhost:3000}
      PGRST_DB_SCHEMA: public
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${JWT_SECRET:-change-this-jwt-secret-min-32-characters}
      PGRST_DB_CHANNEL_ENABLED: "true"
      PGRST_DB_CHANNEL: pgrst
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:3000/ > /dev/null 2>&1 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s
    security_opt:
      - no-new-privileges:true

  insforge:
    image: insforge/insforge-oss:latest
    working_dir: /app
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      postgrest:
        condition: service_started
    environment:
      PORT: "7130"
      PROJECT_ROOT: /app
      API_BASE_URL: ${API_BASE_URL:-http://localhost:7130}
      VITE_API_BASE_URL: ${VITE_API_BASE_URL:-http://localhost:7130}
      JWT_SECRET: ${JWT_SECRET:-change-this-jwt-secret-min-32-characters}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-change-this-encryption-key-32chars}
      ADMIN_EMAIL: ${ADMIN_EMAIL:[email protected]}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-changeme123}
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DB: ${POSTGRES_DB:-insforge}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-insforge}
      POSTGREST_BASE_URL: http://postgrest:3000
      DENO_RUNTIME_URL: http://deno:7133
      LOGS_DIR: /insforge-logs
      STORAGE_DIR: /insforge-storage
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      STRIPE_TEST_SECRET_KEY: ${STRIPE_TEST_SECRET_KEY:-}
      STRIPE_LIVE_SECRET_KEY: ${STRIPE_LIVE_SECRET_KEY:-}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      DISCORD_CLIENT_ID: ${DISCORD_CLIENT_ID:-}
      DISCORD_CLIENT_SECRET: ${DISCORD_CLIENT_SECRET:-}
      MICROSOFT_CLIENT_ID: ${MICROSOFT_CLIENT_ID:-}
      MICROSOFT_CLIENT_SECRET: ${MICROSOFT_CLIENT_SECRET:-}
      LINKEDIN_CLIENT_ID: ${LINKEDIN_CLIENT_ID:-}
      LINKEDIN_CLIENT_SECRET: ${LINKEDIN_CLIENT_SECRET:-}
      X_CLIENT_ID: ${X_CLIENT_ID:-}
      X_CLIENT_SECRET: ${X_CLIENT_SECRET:-}
      APPLE_CLIENT_ID: ${APPLE_CLIENT_ID:-}
      APPLE_CLIENT_SECRET: ${APPLE_CLIENT_SECRET:-}
    volumes:
      - storage-data:/insforge-storage
      - insforge-logs:/insforge-logs
    security_opt:
      - no-new-privileges:true

  deno:
    image: insforge/deno-runtime:latest
    working_dir: /app
    restart: unless-stopped
    depends_on:
      - postgres
      - postgrest
    environment:
      PORT: "7133"
      DENO_ENV: production
      DENO_DIR: /deno-dir
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DB: ${POSTGRES_DB:-insforge}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGREST_BASE_URL: http://postgrest:3000
      WORKER_TIMEOUT_MS: ${WORKER_TIMEOUT_MS:-60000}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-change-this-encryption-key-32chars}
      JWT_SECRET: ${JWT_SECRET:-change-this-jwt-secret-min-32-characters}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      AWS_S3_BUCKET: ${AWS_S3_BUCKET:-}
      AWS_REGION: ${AWS_REGION:-}
      S3_ENDPOINT_URL: ${S3_ENDPOINT_URL:-}
    volumes:
      - deno_cache:/deno-dir
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:7133/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 60s
    security_opt:
      - no-new-privileges:true

volumes:
  postgres-data:
    driver: local
  deno_cache:
    driver: local
  storage-data:
    driver: local
  insforge-logs:
    driver: local