-
Notifications
You must be signed in to change notification settings - Fork 13
Expand file tree
/
Copy path.env.example
More file actions
117 lines (101 loc) · 4.47 KB
/
Copy path.env.example
File metadata and controls
117 lines (101 loc) · 4.47 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# Matrix OS Environment Variables
# Copy to .env and fill in values
# Required: Anthropic API key for kernel AI features
ANTHROPIC_API_KEY=sk-ant-...
# Optional: Gemini API key for image generation (Nano Banana)
GEMINI_API_KEY=
# Gateway
PORT=4000
MATRIX_HOME=
# Shell (Next.js)
NEXT_PUBLIC_GATEWAY_WS=ws://localhost:4000/ws
NEXT_PUBLIC_GATEWAY_URL=http://localhost:4000
GATEWAY_URL=http://localhost:4000
# PostHog error tracking (optional)
# Server/Hono captures use POSTHOG_TOKEN; browser captures use NEXT_PUBLIC_*.
POSTHOG_TOKEN=
POSTHOG_HOST=https://eu.i.posthog.com
NEXT_PUBLIC_POSTHOG_KEY=
NEXT_PUBLIC_POSTHOG_HOST=https://eu.i.posthog.com
NEXT_PUBLIC_POSTHOG_API_HOST=
# Clerk Authentication (shared with the dedicated matrix-os-site deployment)
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_xxx
CLERK_SECRET_KEY=sk_test_xxx
# In-app auth routes (Clerk reads these to keep sign-in/up cross-links on the
# app instead of the hosted Account Portal at accounts.matrix-os.com).
NEXT_PUBLIC_CLERK_SIGN_IN_URL=/sign-in
NEXT_PUBLIC_CLERK_SIGN_UP_URL=/sign-up
# Platform Integrations (Pipedream Connect)
PIPEDREAM_CLIENT_ID=
PIPEDREAM_CLIENT_SECRET=
PIPEDREAM_PROJECT_ID=
PIPEDREAM_ENVIRONMENT=development
PIPEDREAM_WEBHOOK_SECRET=
# Platform DB (can reuse DATABASE_URL or separate)
PLATFORM_DATABASE_URL=
# Recruiting ATS (platform PostgreSQL + matrix-os-site server routes)
# Use distinct high-entropy values; never expose these as NEXT_PUBLIC_*.
# Dedicated Neon/PostgreSQL database. Do not point this at PLATFORM_DATABASE_URL.
ATS_DATABASE_URL=
ATS_INGEST_SECRET=
ATS_ADMIN_SECRET=
# External scheduling page, for example https://cal.com/matrix-os/interview
ATS_BOOKING_BASE_URL=
MATRIX_PUBLIC_SITE_URL=https://matrix-os.com
# Gateway auth token (auto-generated in production)
MATRIX_AUTH_TOKEN=
# Owner verification (required for single-owner production deployments)
# Set to the Clerk user ID of the instance owner. Without this, any
# authenticated Clerk user can access the instance.
MATRIX_CLERK_USER_ID=
# ----------------------------------------------------------------------------
# Customer VPS provisioning (spec 070 — VPS-per-user, phase 1)
# Leave CUSTOMER_VPS_ENABLED=false until credentials are verified and the
# first opt-in user is ready to provision. Docs: https://matrix-os.com/docs/developer/deployment/vps-per-user
# ----------------------------------------------------------------------------
# Master flag — enables /vps/* routes and reconciliation. Keep false elsewhere.
CUSTOMER_VPS_ENABLED=false
# Phase 1: VPS cert is domain-scoped, platform proxies to https://<ip>:443.
CUSTOMER_VPS_TLS_VERIFY=false
# Hetzner Cloud — token must belong to the customer-VPS project (NOT the
# control-plane project). The SSH key name must exist in the same project.
HETZNER_API_TOKEN=
HETZNER_LOCATION=fsn1
HETZNER_SERVER_TYPE=cpx22
HETZNER_IMAGE=ubuntu-24.04
HETZNER_SSH_KEY_NAME=
# Optional golden VPS snapshot acceleration. Keep both controls disabled until
# the separately authorized disposable-provider spike and rollout gates in
# docs/dev/golden-vps-snapshots.md pass. Builds and selection are independent.
# Enabled/percentage are bootstrap defaults for a missing Postgres rollout row;
# operator mutations are durable and authoritative after initialization.
GOLDEN_SNAPSHOT_BUILDS_ENABLED=false
GOLDEN_SNAPSHOTS_ENABLED=false
GOLDEN_SNAPSHOT_ROLLOUT_PERCENT=0
GOLDEN_SNAPSHOT_ARCHITECTURE=x86
GOLDEN_SNAPSHOT_REGION=eu-central
# Defaults to HETZNER_IMAGE when unset.
GOLDEN_SNAPSHOT_BASE_IMAGE=
GOLDEN_SNAPSHOT_BASE_GENERATION=ubuntu-24.04-v1
GOLDEN_SNAPSHOT_BOOT_MODE=bios
GOLDEN_SNAPSHOT_ACTIVATION_ABI=host-v1
GOLDEN_SNAPSHOT_MINIMUM_DISK_GB=40
GOLDEN_SNAPSHOT_MAX_BUILD_ATTEMPTS=5
GOLDEN_SNAPSHOT_MAX_CONCURRENT_BUILDS=2
GOLDEN_SNAPSHOT_BUILD_LEASE_MS=300000
GOLDEN_SNAPSHOT_PROVISIONING_LEASE_MS=600000
GOLDEN_SNAPSHOT_RETENTION_LIMIT=20
GOLDEN_SNAPSHOT_FRESHNESS_MAX_AGE_MS=604800000
GOLDEN_SNAPSHOT_RECONCILIATION_BATCH_SIZE=25
GOLDEN_SNAPSHOT_RECONCILIATION_INTERVAL_MS=15000
# Required when CUSTOMER_VPS_ENABLED=true. Generate independently with: openssl rand -hex 32
# Never reuse PLATFORM_SECRET; the platform refuses to start when they match.
# This authorizes snapshot status, rollout, retry, revoke, inventory, cleanup,
# and explicitly isolated test-mode enqueue. Never expose it to release automation.
GOLDEN_SNAPSHOT_OPERATOR_SECRET=
# Cloudflare R2 — used for VPS metadata, hourly DB snapshots, and recovery.
R2_ACCOUNT_ID=
R2_ACCESS_KEY_ID=
R2_SECRET_ACCESS_KEY=
R2_BUCKET=matrixos-sync
R2_PREFIX_ROOT=matrixos-sync