first commit

.env.example

@@ -0,0 +1,56 @@
+# NEXPA SourceHub 3.8 Production Candidate
+SOURCEHUB_MAX_UPLOAD_MB=500
+SOURCEHUB_ALLOWED_HOSTS=localhost,127.0.0.1,sourcehub.nexpa-ai.com
+
+# ---------- Database ----------
+# SOURCEHUB_DATABASE_URL=postgresql+psycopg://sourcehub:CHANGE_ME@postgres:5432/sourcehub
+SOURCEHUB_DATA_DIR=data
+
+# ---------- Storage ----------
+SOURCEHUB_STORAGE_BACKEND=local
+SOURCEHUB_STORAGE_DIR=storage
+# SOURCEHUB_STORAGE_BACKEND=minio
+# SOURCEHUB_MINIO_ENDPOINT=minio:9000
+# SOURCEHUB_MINIO_ACCESS_KEY=CHANGE_ME
+# SOURCEHUB_MINIO_SECRET_KEY=CHANGE_ME_LONG
+# SOURCEHUB_MINIO_BUCKET=nexpa-sourcehub
+# SOURCEHUB_MINIO_SECURE=false
+
+# ---------- Authentication ----------
+SOURCEHUB_AUTH_MODE=mock
+SOURCEHUB_SESSION_SECRET=CHANGE_ME_TO_LONG_RANDOM_VALUE
+SOURCEHUB_SESSION_HTTPS_ONLY=false
+SOURCEHUB_CSRF_ENABLED=false
+
+# Production OIDC
+# SOURCEHUB_AUTH_MODE=oidc
+# SOURCEHUB_SESSION_HTTPS_ONLY=true
+# SOURCEHUB_CSRF_ENABLED=true
+# SOURCEHUB_OIDC_METADATA_URL=https://<NEXPA-CORE>/.well-known/openid-configuration
+# SOURCEHUB_OIDC_CLIENT_ID=<CLIENT_ID>
+# SOURCEHUB_OIDC_CLIENT_SECRET=<CLIENT_SECRET>
+# SOURCEHUB_OIDC_ROLE_CLAIM=roles
+
+# ---------- Download security ----------
+SOURCEHUB_DOWNLOAD_SECRET=CHANGE_ME_TO_ANOTHER_LONG_RANDOM_VALUE
+SOURCEHUB_DOWNLOAD_TTL_SECONDS=300
+
+# ---------- Malware scan ----------
+SOURCEHUB_MALWARE_SCAN=disabled
+# SOURCEHUB_MALWARE_SCAN=clamd
+# SOURCEHUB_CLAMD_HOST=clamav
+# SOURCEHUB_CLAMD_PORT=3310
+
+# ---------- Gitea ----------
+# SOURCEHUB_GITEA_BASE_URL=https://git.example.com
+# SOURCEHUB_GITEA_TOKEN=<TOKEN>
+
+# ---------- Deployment executor ----------
+SOURCEHUB_DEPLOY_MODE=disabled
+# SOURCEHUB_DEPLOY_MODE=webhook
+# SOURCEHUB_DEPLOY_WEBHOOK_SECRET=<LONG_SHARED_SECRET>
+# SOURCEHUB_DEPLOY_TARGETS_JSON={"core:PRODUCTION BASELINE":"https://deploy.internal/sourcehub/core"}
+
+# ---------- Security headers ----------
+SOURCEHUB_ENABLE_HSTS=false
+# Production behind HTTPS: true