Blame · Line-by-line history

`config.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

config.tsBlame153 lines · 1 contributor

Normal view Raw

fc1817aClaude	1	import { join } from "path";
	2
	3	export const config = {
	4	get port() {
	5	return Number(process.env.PORT \|\| 3000);
	6	},
	7	get databaseUrl() {
	8	return process.env.DATABASE_URL \|\| "";
	9	},
	10	get gitReposPath() {
	11	return process.env.GIT_REPOS_PATH \|\| join(process.cwd(), "repos");
	12	},
	13	get gatetestUrl() {
a4e1564Claude	14	return process.env.GATETEST_URL \|\| "https://gatetest.ai/api/events/push";
fc1817aClaude	15	},
e883329Claude	16	get gatetestApiKey() {
	17	return process.env.GATETEST_API_KEY \|\| "";
	18	},
fc1817aClaude	19	get crontechDeployUrl() {
	20	return (
	21	process.env.CRONTECH_DEPLOY_URL \|\|
ba93444Claude	22	"https://crontech.ai/api/webhooks/gluecron-push"
fc1817aClaude	23	);
	24	},
43cf9b0Claude	25	/**
ba93444Claude	26	* BLK-016 — only fire the Crontech deploy webhook for pushes to this
	27	* `<owner>/<name>`. Every other repo's push is ignored. Override per
	28	* environment via `CRONTECH_REPO`.
	29	*/
	30	get crontechRepo() {
	31	return process.env.CRONTECH_REPO \|\| "ccantynz-alt/crontech";
	32	},
	33	/**
	34	* Shared HMAC secret for the outbound deploy webhook to Crontech's
	35	* `POST /api/webhooks/gluecron-push` endpoint. Used to compute the
	36	* `X-Gluecron-Signature: sha256=<hex>` header on every fire. Default
	37	* empty → header is omitted and Crontech will reject with 401 (treated
	38	* as a failed deploy).
43cf9b0Claude	39	*/
	40	get gluecronWebhookSecret() {
	41	return process.env.GLUECRON_WEBHOOK_SECRET \|\| "";
	42	},
e883329Claude	43	get anthropicApiKey() {
	44	return process.env.ANTHROPIC_API_KEY \|\| "";
	45	},
24cf2caClaude	46	/** Email provider: "log" (dev, writes to stderr) or "resend" (HTTPS). */
	47	get emailProvider() {
	48	const v = (process.env.EMAIL_PROVIDER \|\| "log").toLowerCase();
	49	return v === "resend" ? "resend" : "log";
	50	},
	51	/** "From" address for outbound email. */
	52	get emailFrom() {
	53	return process.env.EMAIL_FROM \|\| "gluecron <no-reply@gluecron.local>";
	54	},
	55	/** Resend API key (only used when EMAIL_PROVIDER=resend). */
	56	get resendApiKey() {
	57	return process.env.RESEND_API_KEY \|\| "";
	58	},
	59	/** Canonical base URL for outbound links in emails + webhooks. */
60323c5Claude	60	/** SSH server port. 0 disables SSH (default 2222 in dev, 22 in prod via SSH_PORT). */
	61	get sshPort() {
	62	const v = process.env.SSH_PORT;
	63	if (v === "0") return 0;
	64	return Number(v \|\| 2222);
	65	},
	66	/**
	67	* PEM-encoded Ed25519 (or RSA) private key for the SSH host.
	68	* If unset, an ephemeral key is generated on startup (fine for dev,
	69	* but clients will see "host key changed" warnings on restart —
	70	* set SSH_HOST_KEY in production).
	71	*
	72	* Multi-line keys in env vars: use literal newlines or \\n escapes,
	73	* both are normalised in ssh-server.ts.
	74	*/
	75	get sshHostKey() {
	76	return process.env.SSH_HOST_KEY \|\| "";
	77	},
24cf2caClaude	78	get appBaseUrl() {
	79	return (process.env.APP_BASE_URL \|\| "http://localhost:3000").replace(
	80	/\/+$/,
	81	""
	82	);
	83	},
845fd8aClaude	84	/**
	85	* Root directory for OCI container registry blob + manifest storage.
	86	* Layout:
	87	* ${ociStorePath}/blobs/sha256/<hex64> — finished layer/config blobs
	88	* ${ociStorePath}/manifests/<name>/<ref> — image manifests by tag or digest
	89	* ${ociStorePath}/uploads/<uuid> — in-progress chunked uploads
	90	*/
	91	get ociStorePath() {
	92	return process.env.OCI_STORE_PATH \|\| join(process.cwd(), "oci-store");
	93	},
1df50d5Claude	94	/**
	95	* Base URL used to construct preview URLs for PR builds.
	96	* When set, the preview-builder will run and serve static files; when unset,
	97	* previews are URL-only (no build runs).
	98	*
	99	* Production: set to e.g. "https://previews.gluecron.com"
	100	*/
	101	get previewDomain() {
	102	return process.env.PREVIEW_DOMAIN \|\| "";
	103	},
2df1f8cClaude	104	/**
	105	* WebAuthn relying-party ID (domain only, no scheme/port). Derived from
	106	* appBaseUrl unless overridden. Passkeys issued for one RP ID can't be
	107	* replayed against another, so this must be stable.
	108	*/
	109	get webauthnRpId() {
	110	if (process.env.WEBAUTHN_RP_ID) return process.env.WEBAUTHN_RP_ID;
	111	try {
	112	return new URL(this.appBaseUrl).hostname;
	113	} catch {
	114	return "localhost";
	115	}
	116	},
	117	/** WebAuthn expected origin (must include scheme + port). */
	118	get webauthnOrigin() {
	119	return process.env.WEBAUTHN_ORIGIN \|\| this.appBaseUrl;
	120	},
	121	/** Human-facing RP name shown by the browser. */
	122	get webauthnRpName() {
	123	return process.env.WEBAUTHN_RP_NAME \|\| "gluecron";
	124	},
13cbd17Claude	125	/**
	126	* Redis / Valkey connection URL for cross-instance SSE fan-out.
	127	* When set, `src/lib/sse.ts` uses Redis pub/sub so SSE events reach all
	128	* server instances behind the load balancer. Falls back to in-process
	129	* delivery when unset.
	130	*/
	131	get redisUrl() {
	132	return process.env.REDIS_URL \|\| process.env.VALKEY_URL \|\| "";
	133	},
6efae38Claude	134	/**
	135	* AI Auto-Issue Opener (src/lib/ai-auto-issues.ts). When set to "1",
	136	* every git push is scanned for TODOs, hardcoded secrets, SQL injection
	137	* patterns, and debug console.log calls; matching findings automatically
	138	* open issues in the repository. Off by default.
	139	*/
	140	get aiAutoIssues() {
	141	return process.env.AI_AUTO_ISSUES === "1";
	142	},
da3fc18Claude	143	/**
	144	* Dependency CVE scanner — when set to "1", the post-receive hook fires
	145	* `scanDependencies()` on every push that touches a recognized manifest
	146	* file (package.json, requirements.txt, Cargo.toml, go.mod, Gemfile).
	147	* Results open security issues automatically. Fire-and-forget; never
	148	* blocks a push.
	149	*/
	150	get dependencyScanEnabled() {
	151	return process.env.DEPENDENCY_SCAN_ENABLED === "1";
	152	},
fc1817aClaude	153	};