AzuTear
48 lines
2.5 KiB
Bash
48 lines
2.5 KiB
Bash
# Nexus Production Environment Configuration
|
|
# Copy this file to .env and fill in all values before deploying.
|
|
|
|
# ── PostgreSQL ──────────────────────────────────────────
|
|
POSTGRES_DB=nexus
|
|
POSTGRES_USER=nexus
|
|
POSTGRES_PASSWORD=***
|
|
|
|
# ── Connection String (inferred from above when using compose) ──
|
|
# ConnectionStrings__Nexus=Host=localhost;Database=${POSTGRES_DB};Username=${POSTGRES_USER};Password=${POSTGRES_PASSWORD}
|
|
|
|
# ── JWT ─────────────────────────────────────────────────
|
|
# Generate with: openssl rand -base64 48
|
|
JWT_KEY=*** # at least 32 bytes (base64-encoded)
|
|
JWT_ISSUER=nexus
|
|
JWT_AUDIENCE=nexus-web
|
|
|
|
# ── Bootstrap Owner (first seed only) ───────────────────
|
|
BOOTSTRAP_OWNER_EMAIL=***
|
|
BOOTSTRAP_OWNER_PASSWORD=*** # at least 10 characters; never written to logs
|
|
|
|
# ── Trusted reverse proxies ──────────────────────────────
|
|
# Keep empty unless the API is behind a known proxy. Use one exact proxy IP
|
|
# and/or a narrow CIDR for the private container network.
|
|
FORWARDED_HEADERS_KNOWN_PROXY=
|
|
FORWARDED_HEADERS_KNOWN_NETWORK=
|
|
FORWARDED_HEADERS_FORWARD_LIMIT=1
|
|
|
|
# ── OpenClaw Integration ────────────────────────────────
|
|
# Base URL of the OpenClaw gateway.
|
|
# Direct loopback can use a trusted backend shared secret. A remote or
|
|
# host.docker.internal topology also needs a paired backend device identity.
|
|
OPENCLAW_BASE_URL=http://host.docker.internal:18789
|
|
# Version pin is fail-fast and must match the deployed Gateway.
|
|
OPENCLAW_REQUIRED_VERSION=2026.7.1
|
|
OPENCLAW_GATEWAY_TOKEN=***
|
|
OPENCLAW_GATEWAY_PASSWORD=***
|
|
# Nexus will not impersonate OpenClaw's reserved gateway-client/backend identity.
|
|
# Keep false until the pinned OpenClaw build explicitly registers the external
|
|
# `nexus` client id. A patched or future supported build may set this to true.
|
|
OPENCLAW_EXTERNAL_CLIENT_ID_SUPPORTED=false
|
|
# Remote wss:// endpoints require a confirmed SHA-256 certificate fingerprint.
|
|
OPENCLAW_TLS_FINGERPRINT=
|
|
# The persisted primary profile is the only management gate. Enable it through
|
|
# the owner-only Attach & Adopt flow after read-only adoption and scope upgrade.
|
|
# High-risk unattended command/on-exit cron payloads remain disabled by default.
|
|
OPENCLAW_ALLOW_COMMAND_CRON=false
|