restarters.net/fly.pr-secrets.example.env at develop · TheRestartProject/restarters.net · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
# Template for the FLY_PREVIEW_SECRETS GitHub environment secret used by
# .github/workflows/pr-preview.yml (see docs/fly-deployment.md -> PR Previews).
#
# Usage:
#   1. Copy this file OUTSIDE the repo:  cp fly.pr-secrets.example.env ~/preview-secrets.env
#   2. Fill in every <...> value (comments may stay - the workflow strips them).
#   3. gh secret set FLY_PREVIEW_SECRETS --env preview < ~/preview-secrets.env
#   4. shred -u ~/preview-secrets.env
#
# Format: KEY=value, one per line, no quotes, no spaces around '='.
# The service-account JSON must be flattened to a single line (jq -c).
#
# NEVER add production-only keys here (MAIL_*, DISCOURSE_*, WIKI_*, WP_*,
# DRIP_*, analytics) and NEVER the production APP_KEY - previews generate
# their own APP_KEY at first deploy.

# Site cookie-gate password. Pick a FRESH value: the old preview password is
# permanently visible in this public repo's git history.
BASIC_AUTH_PASSWORD=<fresh-password>

# Tigris (shared image bucket) - create a READ-ONLY access key:
#   fly storage dashboard <bucket>   -> Access Keys -> new key, Read-only
# Read-only is the real enforcement behind FEATURE__IMAGE_UPLOAD=false.
# Bucket name: fly ssh console -a restarters -C "printenv AWS_BUCKET"
AWS_ACCESS_KEY_ID=<tigris-readonly-key-id>
AWS_SECRET_ACCESS_KEY=<tigris-readonly-key-secret>
AWS_BUCKET=<bucket-name>

# Google Drive backup restore - a READ-ONLY service account, NOT the
# production backup SA (which can delete backups):
#   Google Cloud console, project fixometer-1526501244792 -> Service Accounts
#   -> create (e.g. rclone-restarters-restore) -> Keys -> add JSON key.
#   Then share the backups folder with the SA's email as VIEWER.
# Folder/team-drive IDs below are the same as production's (already public
# in docs/fly-deployment.md).
GDRIVE_BACKUP_FOLDER_ID=1jk-cibm1W4EewWO1GB_SfNF3hxnaKblf
RCLONE_CONFIG_GDRIVE_TYPE=drive
RCLONE_CONFIG_GDRIVE_SCOPE=drive.readonly
RCLONE_CONFIG_GDRIVE_TEAM_DRIVE=0AGkqkEd84IsuUk9PVA
# Single line! Flatten with: jq -c . < key.json
RCLONE_CONFIG_GDRIVE_SERVICE_ACCOUNT_CREDENTIALS=<single-line-service-account-json>

# Copy from production:
#   fly ssh console -a restarters -C "printenv MAPBOX_TOKEN"
#   fly ssh console -a restarters -C "printenv GOOGLE_API_CONSOLE_KEY"
MAPBOX_TOKEN=<mapbox-token>
GOOGLE_API_CONSOLE_KEY=<google-api-console-key>

# Optional: uncomment to report preview errors to Sentry (tagged environment=preview).
# SENTRY_LARAVEL_DSN=<sentry-dsn>