55 lines
3.1 KiB
Markdown
55 lines
3.1 KiB
Markdown
# TODO
|
|
|
|
## Production Environment Variables
|
|
|
|
Cloudflare `vars` currently covers the non-secret values in `wrangler.jsonc`.
|
|
Cloudflare Secrets are currently empty, so production still needs the following
|
|
runtime values configured before deploy.
|
|
|
|
### Required For Current Production Path
|
|
|
|
| Variable | How to get it | Configure as |
|
|
| --- | --- | --- |
|
|
| `BETTER_AUTH_SECRET` | Generate a high-entropy production secret, for example `openssl rand -base64 32`. | Cloudflare Secret |
|
|
| `RESEND_API_KEY` | Create or retrieve an API key from the Resend dashboard. The current mail adapter only supports `MAIL_PROVIDER=resend`. | Cloudflare Secret |
|
|
| `CAPTCHA_SECRET_KEY` | Use the Cloudflare Turnstile Secret Key. The provided `TURNSTILE_SECRET_KEY` value should be stored under this variable name. | Cloudflare Secret |
|
|
| `GOOGLE_CLIENT_SECRET` | Open Google Auth Platform / OAuth client settings and copy the client secret for the configured `GOOGLE_CLIENT_ID`. | Cloudflare Secret |
|
|
|
|
Set with:
|
|
|
|
```bash
|
|
pnpm exec wrangler secret put BETTER_AUTH_SECRET
|
|
pnpm exec wrangler secret put RESEND_API_KEY
|
|
pnpm exec wrangler secret put CAPTCHA_SECRET_KEY
|
|
pnpm exec wrangler secret put GOOGLE_CLIENT_SECRET
|
|
```
|
|
|
|
### Configure Only If Enabling The Feature
|
|
|
|
| Variable | When needed | How to get it |
|
|
| --- | --- | --- |
|
|
| `GITHUB_CLIENT_ID` | Enable GitHub OAuth. | Create a GitHub OAuth App. |
|
|
| `GITHUB_CLIENT_SECRET` | Enable GitHub OAuth. | Generate it in the GitHub OAuth App settings. |
|
|
| `GENERIC_OAUTH_PROVIDER_ID` | Enable generic OIDC/OAuth. | Choose a provider id such as `auth0`, `zitadel`, or another stable name. |
|
|
| `GENERIC_OAUTH_DISCOVERY_URL` | Enable generic OIDC/OAuth. | Get the provider's `.well-known/openid-configuration` URL. |
|
|
| `GENERIC_OAUTH_CLIENT_ID` | Enable generic OIDC/OAuth. | Get it from the provider application settings. |
|
|
| `GENERIC_OAUTH_CLIENT_SECRET` | Enable generic OIDC/OAuth. | Get it from the provider application settings. |
|
|
| `PASSKEY_RP_ID` | Enable passkeys. | Use the relying-party domain, for example `cfw-auth.bowong.cc` or `bowong.cc`. |
|
|
| `PASSKEY_RP_NAME` | Enable passkeys. | Pick the user-facing product name, for example `MixVideo`. |
|
|
| `PASSKEY_ORIGIN` | Enable passkeys. | Use the full origin, for example `https://cfw-auth.bowong.cc`. |
|
|
| `ENABLE_JWT` | Enable Better Auth JWT plugin. | Set to `true`. Leave unset to disable. |
|
|
| `ENABLE_BEARER` | Enable Better Auth bearer plugin. | Set to `true`. Leave unset to disable. |
|
|
| `EXPO_SCHEME` | Accept Expo app origins. | Read the `scheme` from the Expo app config. |
|
|
| `SMS_PROVIDER` | Enable SMS. | Current code supports `webhook` or `twilio`. |
|
|
| `SMS_WEBHOOK_URL` | Use `SMS_PROVIDER=webhook`. | Use the SMS provider webhook endpoint. |
|
|
| `TWILIO_ACCOUNT_SID` | Use `SMS_PROVIDER=twilio`. | Get it from the Twilio Console. |
|
|
| `TWILIO_AUTH_TOKEN` | Use `SMS_PROVIDER=twilio`. | Get it from the Twilio Console. |
|
|
| `TWILIO_FROM` | Use `SMS_PROVIDER=twilio`. | Use a Twilio verified or purchased sending number. |
|
|
|
|
### Needs Cleanup
|
|
|
|
| Variable | Action |
|
|
| --- | --- |
|
|
| `OAUTH_PROVIDERS` | Current source code does not read this variable. Either define its semantics and implement usage, or remove it from `Env`. |
|
|
|