Rotimi Best
d5b07d356e
New features: - HLS video encoding/streaming (hls routes, hls-encoder) and a media transcripts pipeline (transcripts route + media-transcript queries) - AI assistant chat vs. run model: agent-course-generation worker/queue, run-monitor pane, chat-changes card, content ask-ai bar - Per-theme course-page previews across org landing-page themes (bold, classic, corporate, editorial, etc.) with a shared course token/component set - View-as-student mode and login-link / link-invite invite flows Refactor: - Extract packages/core consolidating config (env, storage, dashboard-url), services and utils previously duplicated under apps/api/src/config - Remove legacy agent service modules (chat-tools, chat-context, context-window, document, fetch-url, lesson-content) - Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding - Add format script to tenant-router so turbo run format covers it
95 lines
3.5 KiB
Bash
95 lines
3.5 KiB
Bash
# Required
|
|
DATABASE_URL=""
|
|
REDIS_URL=""
|
|
PUBLIC_SERVER_URL=""
|
|
|
|
TRUSTED_ORIGINS=""
|
|
BETTER_AUTH_SECRET=""
|
|
|
|
AUTH_BEARER_TOKEN=""
|
|
AUTH_COOKIE_DOMAIN=""
|
|
|
|
# Email provider — used by the API only for auth-flow emails (forgot
|
|
# password, password-reset confirmation, email verification, email-change
|
|
# verification). Every other email is sent by @cio/jobs-worker; see
|
|
# apps/jobs/.env.example. Both processes can point at the same SMTP server.
|
|
SMTP_HOST=""
|
|
SMTP_PORT=""
|
|
SMTP_USER=""
|
|
SMTP_SENDER=""
|
|
SMTP_PASSWORD=""
|
|
|
|
# Optional Zoho ZeptoMail token. When set, @cio/email uses Zoho instead of
|
|
# nodemailer/SMTP. Same dual-process note as SMTP above.
|
|
# ZOHO_TOKEN=""
|
|
|
|
# Optional - MinIO (S3-compatible, for Docker / on-premise self-hosting)
|
|
# When API runs in Docker: use http://minio:9000. For local API: use http://localhost:9000
|
|
MINIO_ROOT_USER=""
|
|
MINIO_ROOT_PASSWORD=""
|
|
OBJECT_STORAGE_ENDPOINT=""
|
|
OBJECT_STORAGE_PUBLIC_ENDPOINT=""
|
|
OBJECT_STORAGE_ACCESS_KEY_ID=""
|
|
OBJECT_STORAGE_SECRET_ACCESS_KEY=""
|
|
OBJECT_STORAGE_FORCE_PATH_STYLE=""
|
|
OBJECT_STORAGE_MEDIA_PUBLIC_BASE_URL=""
|
|
|
|
# Optional - Cloudflare R2 (for hosted deployments)
|
|
CLOUDFLARE_BUCKET_ID=""
|
|
CLOUDFLARE_ACCESS_KEY=""
|
|
CLOUDFLARE_ACCOUNT_ID=""
|
|
CLOUDFLARE_BUCKET_DOMAIN=""
|
|
CLOUDFLARE_SECRET_ACCESS_KEY=""
|
|
|
|
# HMAC secret used to sign the `cio_hls` playback cookie. The same value must
|
|
# be set on the tenant-router Worker (`wrangler secret put HLS_SIGNING_SECRET`)
|
|
# so segments served from R2 at the edge verify against this signature.
|
|
# Without it the cookie endpoints return 503 and HLS playback won't start —
|
|
# uploads still work, so leave it unset for upload-only local development.
|
|
# Generate one with: node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"
|
|
HLS_SIGNING_SECRET=""
|
|
|
|
# Sentry (server-side error tracking). Leave SENTRY_DSN unset to disable.
|
|
# Skipped automatically in dev (NODE_ENV !== 'production') and self-hosted (PUBLIC_IS_SELFHOSTED=true).
|
|
SENTRY_DSN=""
|
|
SENTRY_ENVIRONMENT="production"
|
|
SENTRY_TRACES_SAMPLE_RATE="0"
|
|
|
|
# BullMQ dashboard (/admin/queues) ───────────────────────────────────────────
|
|
# In dev the dashboard is open. In production it's hidden unless ONE of the
|
|
# following is set; failing requests get 404 (not 401) so the route stays
|
|
# invisible to scanners.
|
|
#
|
|
# Comma-separated allowlist of Better Auth user emails — log in normally,
|
|
# visit /admin/queues, the middleware checks your session.
|
|
# QUEUE_DASHBOARD_ADMIN_EMAILS="you@yourdomain.com,partner@yourdomain.com"
|
|
#
|
|
# Bearer-token escape hatch for curl / scripts. Pass via
|
|
# `Authorization: Bearer <token>` or `?token=<token>`.
|
|
# QUEUE_DASHBOARD_TOKEN=""
|
|
|
|
# Enterprise (Optional)
|
|
# Required only when using Enterprise-only features (SSO, token-auth, no-tracking)
|
|
LICENSE_KEY=""
|
|
|
|
# SSO (Optional)
|
|
# For enterprise SSO with SAML (future support)
|
|
# SSO_ENCRYPTION_KEY="your-32-character-secret-key"
|
|
|
|
# AI Assistant (Optional)
|
|
# Per-provider API keys. The dashboard model picker exposes Gemini 3 Flash
|
|
# (Google) and GPT-4o (OpenAI). Anthropic is supported in code but not in the
|
|
# picker UI. Set at least one key to enable the assistant.
|
|
OPENAI_API_KEY=""
|
|
GOOGLE_API_KEY=""
|
|
ANTHROPIC_API_KEY=""
|
|
MOONSHOT_API_KEY=""
|
|
|
|
# Jina Reader — optional Bearer for higher rate limits when using fetch_documentation_url
|
|
# JINA_API_KEY=""
|
|
# AGENT_MAX_FETCHES_PER_CONVERSATION=15
|
|
# AGENT_MAX_FETCHES_PER_ORG_PER_DAY=500
|
|
|
|
# Tinybird event tracking for AI observability (optional — silently skipped when not set)
|
|
# TINYBIRD_TOKEN=""
|
|
# TINYBIRD_BASE_URL="https://api.tinybird.co" |