.env.example

# ─── Offset GRC — copy to .env and edit. NEVER commit .env ────────────────────

# Which product this instance is. One of: assure | align | anchor
PRODUCT=align

NODE_ENV=development
LOG_LEVEL=info

# ─── HTTP ─────────────────────────────────────────────────────────────────────
PORT=8080
# Public URL users browse to. Used for OIDC/SAML redirects and email links.
PUBLIC_URL=https://localhost:8443

# ─── Database ─────────────────────────────────────────────────────────────────
DATABASE_URL=file:./data/offset.db

# ─── Secrets ──────────────────────────────────────────────────────────────────
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SESSION_SECRET=change_me_32_bytes_hex
# Encrypts secret columns (SMTP password, IdP client secret) at rest.
FIELD_ENC_KEY=change_me_32_bytes_hex

# Session lifetime in hours
SESSION_TTL_HOURS=12

# ─── Licence ──────────────────────────────────────────────────────────────────
# Path to the Ed25519-signed licence file. Absent = 14-day trial.
LICENSE_FILE=./license.key
LICENSE_ENFORCE=false

# ─── Background worker ────────────────────────────────────────────────────────
# How often the worker looks for due work, in seconds.
WORKER_POLL_SECONDS=30
# Local hour (0-23) for the nightly jobs: readiness snapshot and backup.
DAILY_JOB_HOUR=2

BACKUP_ENABLED=true
BACKUP_DIR=./backups
# Backups to keep, of every kind together. Older ones are deleted.
BACKUP_KEEP=3

# Days of audit log to keep. 0 keeps everything, which is the default —
# an audit trail is evidence, so deleting it has to be a deliberate choice.
AUDIT_RETENTION_DAYS=0

# Who may say who the real client is (X-Forwarded-For). The address goes into
# the audit trail and the sign-in limits, so only proxies you name are
# believed. The default, loopback, is a proxy on this same machine. Name
# others as addresses or CIDR ranges, comma-separated.
# TRUST_PROXY=loopback

# ─── SSO (optional — leave blank for local accounts only) ─────────────────────
OIDC_ISSUER=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
# Maps IdP group/role claim -> app role. JSON object.
SSO_ROLE_MAP={}

# ─── SMTP (optional — notifications are off unless set) ───────────────────────
SMTP_HOST=
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=
NOTIFY_DIGEST_HOUR=7