glass beadian
aa5e262f3a
Self-hosted multi-platform broadcast newsroom for activist collectives: publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style column wall with hostile-content-safe rendering, live control room with Auto Director, bridged chat governance with polls and quorum, distributed sandboxed transcode workers, encrypted content-addressed archive, monthly analytics. MIT licensed. See README.md and docs/.
27 lines
1.5 KiB
Text
27 lines
1.5 KiB
Text
# occupymedia.cc deployment secrets — copy to .env on the box, fill every :? value.
|
|
# NEVER commit the filled .env.
|
|
|
|
# --- Cloudflare (already provisioned; tunnel + DNS + R2 buckets exist) ---
|
|
CLOUDFLARE_ACCOUNT_ID=e50adafec3c6aee02a328f28b967f699
|
|
CLOUDFLARE_TUNNEL_TOKEN=<fromkeepass-or-ask-coordinator> # occupymedia tunnel e5695d8b-…
|
|
|
|
# --- R2 (S3 API token: dashboard → R2 → Manage API Tokens → Object Read & Write,
|
|
# scoped to the four occupymedia-* buckets) ---
|
|
R2_ACCESS_KEY=<paste R2 Access Key ID>
|
|
R2_SECRET_KEY=<paste R2 Secret Access Key>
|
|
|
|
# --- Database ---
|
|
POSTGRES_PASSWORD=<generate: openssl rand -hex 24>
|
|
# Runtime-only role provisioned by migration 003. Set its production password
|
|
# with owner access; never reuse POSTGRES_PASSWORD or the development default.
|
|
DATABASE_URL=postgres://sp_app:<runtime-password>@postgres:5432/occupymedia
|
|
SCHEDULER_DATABASE_URL=postgres://sp_app:<runtime-password>@postgres:5432/occupymedia
|
|
# SUPER_DATABASE_URL is passed only to the offline migration CLI, never services.
|
|
PEERTUBE_DB_PASSWORD=<generate: openssl rand -hex 24> # also paste into peertube.env
|
|
SESSION_SECRET=<generate: openssl rand -base64 32>
|
|
|
|
# --- Client-side envelope encryption for the media archive ---
|
|
# One random 32-byte base64 key. It wraps EVERY stored blob (DEK/KEK envelope).
|
|
# Lose it = archive unreadable. Rotate = full re-encrypt. Store in the password manager.
|
|
S3_KEK=<generate ONCE: openssl rand -base64 32>
|
|
SUPERPOSTER_KEK=<same bytes as S3_KEK, base64>
|