commit d5be753cfb419aa22abc6222af9849a0a893d0d0 Author: jknapp Date: Fri May 15 06:46:18 2026 -0700 Initial commit: gitignore and env example Establishes the secrets-handling contract for this repo: real env values live in a local .env (gitignored from the first commit), and only the sanitized .env.example with placeholder values is tracked. .env.example documents the env surface for the v1 deployment: PUBLIC_URL, Authentik OIDC clients (web + MCP resource server), Postgres connection, embedder sidecar, NextAuth secret, and log level. Co-Authored-By: Claude Opus 4.7 (1M context) diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..6bc68f6 --- /dev/null +++ b/.env.example @@ -0,0 +1,48 @@ +# ============================================================================= +# shared-memory — example environment file +# Copy to `.env` and fill in real values. Never commit `.env`. +# ============================================================================= + +# ----------------------------------------------------------------------------- +# Public URL the app is reached at. +# Used for OIDC redirect URIs, MCP discovery metadata, and the Caddy site name. +# ----------------------------------------------------------------------------- +PUBLIC_URL=https://memory.example.com + +# ----------------------------------------------------------------------------- +# Authentik OIDC +# Create two Applications in Authentik (one for the Web UI, one for the MCP +# resource server). See README.md for the exact provider settings. +# ----------------------------------------------------------------------------- +OIDC_ISSUER=https://auth.example.com/application/o/shared-memory/ +OIDC_CLIENT_ID_WEB=replace-me +OIDC_CLIENT_SECRET_WEB=replace-me +OIDC_CLIENT_ID_MCP=replace-me +OIDC_AUDIENCE=shared-memory + +# ----------------------------------------------------------------------------- +# Database (Postgres 16 + pgvector) +# Default values match the docker-compose `db` service. +# ----------------------------------------------------------------------------- +POSTGRES_USER=memory +POSTGRES_PASSWORD=replace-me-with-a-strong-password +POSTGRES_DB=memory +DATABASE_URL=postgres://memory:replace-me-with-a-strong-password@db:5432/memory + +# ----------------------------------------------------------------------------- +# Embedder sidecar (added in Phase 2) +# ----------------------------------------------------------------------------- +EMBEDDER_URL=http://embedder:8080 +EMBEDDING_MODEL=Xenova/bge-small-en-v1.5 +EMBEDDING_DIM=384 + +# ----------------------------------------------------------------------------- +# NextAuth session signing — generate with: openssl rand -base64 32 +# ----------------------------------------------------------------------------- +NEXTAUTH_SECRET=replace-me-with-32-bytes-of-random + +# ----------------------------------------------------------------------------- +# App +# ----------------------------------------------------------------------------- +LOG_LEVEL=info +NODE_ENV=production diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..818d5df --- /dev/null +++ b/.gitignore @@ -0,0 +1,44 @@ +# Environment files — never commit real secrets +.env +.env.* +!.env.example +!.env.*.example + +# Node / Next.js +node_modules/ +.next/ +out/ +dist/ +build/ +*.tsbuildinfo +next-env.d.ts + +# Logs +*.log +npm-debug.log* +yarn-debug.log* +yarn-error.log* +pnpm-debug.log* + +# Package manager state +.pnpm-store/ +.yarn/ + +# IDE / OS +.vscode/ +.idea/ +.DS_Store +Thumbs.db + +# Test / coverage +coverage/ +.nyc_output/ + +# Docker / runtime +*.pid +*.seed +*.pid.lock + +# Local data volumes (if anyone bind-mounts under repo) +data/ +postgres-data/