neiam /gitgud

# GitGud configuration. Read by systemd as the service's environment;
# every value is consumed in config/runtime.exs at boot.
#
# This file is a dpkg conffile: your edits survive package upgrades.
# It is mode 0640, root:gitgud — it holds credentials.

# ── required ─────────────────────────────────────────────────────────

# Postgres. Either a URL, or the split POSTGRES_* form.
DATABASE_URL=postgres://gitgud:CHANGEME@localhost/gitgud
#POSTGRES_HOST=localhost
#POSTGRES_USER=gitgud
#POSTGRES_PASSWORD=CHANGEME
#POSTGRES_DB=gitgud

# Generate with: /opt/gitgud/bin/git_gud eval 'IO.puts(Base.encode64(:crypto.strong_rand_bytes(48)))'
SECRET_KEY_BASE=CHANGEME

# Signs CI job tokens. At least 32 bytes; changing it invalidates the
# tokens of jobs running at the time.
# Generate with: openssl rand -base64 48
GITGUD_RUNNER_JWT_SECRET=CHANGEME

# Encrypts secrets at rest (CI secrets, TOTP, import tokens, package
# signing keys). Base64 of exactly 32 bytes. Keep it safe: lose it and
# everything it encrypted is gone. GITGUD_SECRETS_KEY_ID names it (not
# "default"); when rotating, set a new key + id and list the old pair
# in GITGUD_SECRETS_OLD_KEYS=id:base64 — bin/migrate re-encrypts.
# Generate with: openssl rand -base64 32
GITGUD_SECRETS_MASTER_KEY=CHANGEME
GITGUD_SECRETS_KEY_ID=k1
#GITGUD_SECRETS_OLD_KEYS=

# The public hostname. Clone URLs, webhooks and federation all derive
# from it, so it must be what users actually type.
PHX_HOST=git.example.com

# ── commonly set ─────────────────────────────────────────────────────

PORT=4000

# Durable paths. The package creates both, owned by the service user.
GIT_REPOS_PATH=/var/lib/gitgud/repos
STORAGE_DISK_ROOT=/var/lib/gitgud/storage

# Embedded SSH daemon, off by default.
#SSH_SERVER_ENABLED=true
#SSH_PORT=2222
#SSH_EXTERNAL_PORT=22
#SSH_HOST_KEY_DIR=/var/lib/gitgud/ssh

# Bundled OCI registry, if you run one alongside.
#GITGUD_REGISTRY_HOST=registry.example.com

# Error reporting. Unset means Sentry no-ops.
#SENTRY_DSN=

# Outbound mail. Unset means mail is logged, not sent.
#SMTP_RELAY=
#SMTP_USERNAME=
#SMTP_PASSWORD=