-
Notifications
You must be signed in to change notification settings - Fork 5
Expand file tree
/
Copy pathdeploy.config.env.example
More file actions
113 lines (99 loc) · 5.27 KB
/
Copy pathdeploy.config.env.example
File metadata and controls
113 lines (99 loc) · 5.27 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# =============================================================================
# ProjectAchilles — server deployment config
# =============================================================================
# Copy to deploy.config.env and fill in. Then run:
#
# ./scripts/deploy-server.sh # install on THIS machine
# ./scripts/deploy-remote.sh user@host # install on a remote SSH host
# ./scripts/deploy-do.sh # create a DO droplet + install
#
# The deploy script is HYBRID: any value left blank below is prompted for
# interactively. Provide everything here for a fully unattended run (ideal for
# driving from an LLM / agentic coding tool).
#
# This file contains secrets once filled — it is gitignored. Never commit it.
# =============================================================================
# ---------------------------------------------------------------------------
# Public address
# ---------------------------------------------------------------------------
# The fully-qualified domain users and agents will reach. Single-origin: the
# UI is at https://$ACHILLES_DOMAIN/ and the API at .../api. One A record must
# point this name at the server's IP (public droplet) or its internal IP
# (on-prem split-horizon DNS).
ACHILLES_DOMAIN=achilles.example.com
# Email for Let's Encrypt account + expiry notices. Required for acme-* modes.
ACME_EMAIL=admin@example.com
# ---------------------------------------------------------------------------
# TLS strategy — choose ONE
# ---------------------------------------------------------------------------
# acme-http Public droplet. Let's Encrypt HTTP-01. Needs inbound 80/443 and
# public DNS pointing at this host. Publicly-trusted, zero client setup.
# acme-dns Internal host with a public domain. Let's Encrypt DNS-01 (no
# inbound needed). Requires CADDY_DNS_* below. Publicly-trusted.
# internal Caddy's local self-signed CA. No domain/internet needed. You must
# distribute the exported root CA to browsers + agents.
# byo Bring your own cert: drop cert.pem + key.pem in deploy/caddy/certs/.
TLS_MODE=acme-http
# --- acme-dns only ---------------------------------------------------------
# Caddy DNS plugin provider name and its Go module path, plus the API token.
# Provider list: https://github.com/caddy-dns
CADDY_DNS_PROVIDER=cloudflare
CADDY_DNS_MODULE=github.com/caddy-dns/cloudflare
CADDY_DNS_TOKEN=
# ---------------------------------------------------------------------------
# Authentication (Clerk) — required
# ---------------------------------------------------------------------------
# https://dashboard.clerk.com -> your app -> API Keys
CLERK_PUBLISHABLE_KEY=pk_live_xxx
CLERK_SECRET_KEY=sk_live_xxx
# ---------------------------------------------------------------------------
# Secrets — leave blank to auto-generate (openssl rand -base64 32)
# ---------------------------------------------------------------------------
SESSION_SECRET=
ENCRYPTION_SECRET=
CLI_AUTH_SECRET=
# ---------------------------------------------------------------------------
# Elasticsearch (analytics)
# ---------------------------------------------------------------------------
# self Run a bundled ES container on this server (needs >= 4 GB RAM).
# cloud Use managed Elastic Cloud (fill ELASTICSEARCH_CLOUD_ID + _API_KEY).
ES_MODE=self
# --- ES_MODE=cloud only ----------------------------------------------------
ELASTICSEARCH_CLOUD_ID=
ELASTICSEARCH_API_KEY=
ELASTICSEARCH_INDEX_PATTERN=achilles-results-*
# Seed ~1000 synthetic records on first provision (self ES only). true/false.
SEED_ES=false
# ---------------------------------------------------------------------------
# Test library + agent source repositories
# ---------------------------------------------------------------------------
# Git-synced security test library. The default public f0_library needs no token.
TESTS_REPO_URL=https://github.com/projectachilles/f0_library.git
TESTS_REPO_BRANCH=main
# Agent source (needed for in-app Go cross-compilation of the agent binary).
AGENT_REPO_URL=https://github.com/projectachilles/ProjectAchilles.git
AGENT_REPO_BRANCH=main
# Only needed if either repo above is private. Scope: repo.
GITHUB_TOKEN=
# ---------------------------------------------------------------------------
# DigitalOcean droplet creation (scripts/deploy-do.sh only)
# ---------------------------------------------------------------------------
DO_API_TOKEN=
DO_REGION=nyc3
DO_SIZE=s-2vcpu-4gb # >= 4 GB recommended when ES_MODE=self
DO_IMAGE=ubuntu-24-04-x64
DO_DROPLET_NAME=achilles
# SSH key fingerprint(s) registered in your DO account (comma-separated).
DO_SSH_KEY_FINGERPRINT=
# If your domain's nameservers are on DigitalOcean, set true to auto-create the
# A record for ACHILLES_DOMAIN. Otherwise create the A record at your DNS host.
DO_MANAGE_DNS=false
# ---------------------------------------------------------------------------
# Remote install over SSH (scripts/deploy-remote.sh, also used by deploy-do.sh)
# ---------------------------------------------------------------------------
# SSH target. deploy-do.sh fills SSH_HOST automatically from the new droplet IP.
SSH_USER=root
SSH_HOST=
SSH_PORT=22
# Where to place the project on the remote host.
REMOTE_DIR=/opt/projectachilles