Dave
1b06549c91
The design spec said an unset token gets a 401 like a missing/wrong one; the implementation (and the plan's own Definition of Done) has always treated unset/misconfigured as 500, matching CRON_SECRET's own behavior. Also extends the .env.example comment to spell out that this same value must be set in Coolify's environment too, not just .env.local — this app has no local PocketBase, so the token is checked against process.env on whichever environment actually receives the request. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
30 lines
1.5 KiB
Text
30 lines
1.5 KiB
Text
# Copy to .env.local and fill in real values. .env.local is gitignored.
|
|
#
|
|
# NEVER put real credentials in this file. It is tracked by git, so anything
|
|
# written here is published to every clone and lives in history forever.
|
|
|
|
# The PocketBase instance. This one is public by design — the browser connects
|
|
# to it directly — so the URL itself is not a secret.
|
|
NEXT_PUBLIC_PB_URL=https://pocketbase.example.com
|
|
|
|
# Public address of this app. Used as a fallback when a link is generated
|
|
# without a browser Origin header. Set this to your production HTTPS domain.
|
|
NEXT_PUBLIC_APP_URL=https://planner.example.com
|
|
|
|
# Superuser credentials, used server-side only by scripts/setup-remote.ts,
|
|
# scripts/seed-demo.ts, and the /api/client/* route handlers.
|
|
PB_SUPERUSER_EMAIL=you@example.com
|
|
PB_SUPERUSER_PASSWORD=replace-me
|
|
|
|
# A long random secret for the agent API (see docs/superpowers/specs/
|
|
# 2026-09-25-phase-8-agent-api-design.md). Generate with:
|
|
# openssl rand -hex 32
|
|
# Anyone holding this can read every project and write comments/subtasks/
|
|
# moves as the owner — treat it like the superuser credentials above.
|
|
# This app has no local PocketBase — it always runs against the hosted
|
|
# Coolify instance — so this same value must ALSO be set in the deployed
|
|
# app's own environment variables in Coolify, not just in .env.local. The
|
|
# token is checked against process.env at request time on whichever
|
|
# environment is actually handling the request, so setting it in only one
|
|
# place leaves the other refusing every request with 500.
|
|
AGENT_API_TOKEN=replace-me
|