torqvoice/.env.example

# Database
DATABASE_URL="postgresql://torqvoice:torqvoice@db:5432/torqvoice"
# Docker only (docker-compose.yml): the password of the `db` service, put into
# the app's DATABASE_URL there as it is, so letters and digits only
# (`openssl rand -hex 24`); a `/`, `@`, `#` or `%` breaks the URL. Set it
# before the first start; unset, it is `torqvoice`, and the port is bound to
# 127.0.0.1 so nothing outside the host can try it.
# POSTGRES_PASSWORD=""

# Authentication (generate with: openssl rand -hex 32)
BETTER_AUTH_SECRET="your-secret-here"

# App URL (used by both the app and Better Auth)
NEXT_PUBLIC_APP_URL="http://localhost:3000"

# Where uploaded files and the app's other data live. Unset, it is `data`
# beside the app, which is where everything has always been written; set it to
# put uploads on a disk with room on them. Files already written to the old
# place keep being found, so this can be turned on at any time.
#
# In Docker, move the volume with it: the compose file mounts
# `/app/data/uploads`, and a DATA_ROOT pointing anywhere else would write into
# the container instead, where a redeploy loses it.
# DATA_ROOT="/var/lib/torqvoice"

# Scheduled backups (Settings → Integrations). Both are optional.
# The Docker image ships restic at /usr/local/bin/restic. An install that runs
# outside Docker points this at its own restic binary; unset, `restic` is
# looked up on the PATH.
# RESTIC_BIN="/usr/local/bin/restic"
# Where the Local folder destination keeps its repositories, for self-hosted
# installs only. Unset, it is `backups` under DATA_ROOT, which the compose file
# mounts as a volume of its own. A folder on another disk is a better place.
# BACKUP_LOCAL_ROOT="/mnt/backup-disk/torqvoice"
# The largest backup data file a restore or the restore point explorer reads
# into memory, in MiB; 128 unless set. Parsed, a file takes three to five times
# its size in heap, so raise this only on a server with the memory for it. A
# backup whose data file is over the limit still runs, and says so in its log.
# BACKUP_MAX_DATA_FILE_MB=128

# Set to true only when Cloudflare proxies every request AND the origin
# refuses traffic that did not come through it (Cloudflare IP ranges allowed
# at the firewall or in nginx).
#
# Behind Cloudflare this is required, not optional: the proxy sets X-Real-IP
# from the connection it sees, which is a Cloudflare edge address shared by
# thousands of visitors, so leaving this off collapses everyone into a handful
# of rate-limit buckets and real users start getting 429s.
#
# Without the origin lock it is worse than useless, because cf-connecting-ip is
# then just a header anyone reaching the box directly can write for themselves.
TRUST_CF_CONNECTING_IP=false

# Integrations (Settings → Integrations)
# Key that seals third-party tokens at rest (generate with: openssl rand -hex 32).
# Without it the key is derived from BETTER_AUTH_SECRET, with a warning at startup.
INTEGRATIONS_ENCRYPTION_KEY=""
# OAuth apps the platform registers with each provider. Leave empty on a
# self-hosted install to have each workshop enter its own app credentials.
GOOGLE_INTEGRATION_CLIENT_ID=""
GOOGLE_INTEGRATION_CLIENT_SECRET=""

MICROSOFT_INTEGRATION_CLIENT_ID=""
MICROSOFT_INTEGRATION_CLIENT_SECRET=""
ZOOM_INTEGRATION_CLIENT_ID=""
ZOOM_INTEGRATION_CLIENT_SECRET=""
# Intuit development keys reach sandbox companies, production keys live ones;
# the connector works out which it was given.
QUICKBOOKS_INTEGRATION_CLIENT_ID=""
QUICKBOOKS_INTEGRATION_CLIENT_SECRET=""
# The app registered in Fiken under Rediger konto, API. While it is in
# development only the Fiken users listed on the app can connect.
FIKEN_INTEGRATION_CLIENT_ID=""
FIKEN_INTEGRATION_CLIENT_SECRET=""
# One Open Labor Project key for every workshop on this install. Unset, each
# workshop pastes its own key when it connects the labor guide. Set, a
# workshop that leaves its key empty uses this one, lookups made with it are
# shared between workshops, and each workshop gets the daily number of
# lookups below (40 unless set).
# OPEN_LABOR_PROJECT_API_KEY=""
# REPAIR_DATA_SERVER_KEY_DAILY_LOOKUPS=40
# Torqvoice Codes, the fault code service Torqvoice runs (cloud only: a
# self-hosted install shows the card greyed out and cannot connect it).
# Where the service answers, never typed by a workshop; in the dev
# containers it is http://torqvoice-codes:8090 (http://localhost:8090 from
# the host).
# TORQVOICE_CODES_URL="http://torqvoice-codes:8090"
# A key for every workshop, with read:codes, read:fixes and write:fixes
# (sharing fixes needs the last two). Set, every workshop is connected with
# it on its first page load, sees no key field, and stays disconnected if it
# disconnects. Unset, the connect page asks for a key.
# TORQVOICE_CODES_API_TOKEN=""
# Development only: cloud-only connectors to show on a self-hosted dev
# machine without putting the app in cloud mode. Ignored by any production
# build (it needs `next dev`).
# TORQVOICE_DEV_CLOUD_CONNECTORS="torqvoice-codes"