Initial commit on Forgejo

Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.

.env.example

@@ -0,0 +1,69 @@
+# Copy to .env at the app root (/opt/tarakan/.env or repo root).
+# Compose: docker compose --project-directory . -f deploy/docker/compose.yml …
+
+# REQUIRED — sign/encrypt secret. Generate with: mix phx.gen.secret
+SECRET_KEY_BASE=
+
+# REQUIRED — the public hostname the app is served on (no scheme).
+PHX_HOST=localhost
+
+# Port the app listens on inside and outside the container.
+PORT=4000
+
+# Host interface for Docker's published Phoenix port. Keep loopback-only when
+# Caddy/nginx runs on the same host.
+BIND_IP=127.0.0.1
+
+# Database connections per app instance. Five is appropriate for a 2 GB VPS.
+POOL_SIZE=5
+
+# PostgreSQL credentials (used by both the db and app services).
+POSTGRES_USER=tarakan
+POSTGRES_PASSWORD=change-me
+POSTGRES_DB=tarakan
+
+# DATABASE_SSL=true enables verify_peer TLS to Postgres (default in prod runtime).
+# Docker Compose sets DATABASE_SSL=false because app and db share a private network.
+# DATABASE_SSL=false
+
+# Comma-separated reverse-proxy IPs/CIDRs allowed to set X-Forwarded-For.
+# Required for correct per-client rate limits behind Caddy/nginx/Traefik.
+# TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12,127.0.0.1
+
+# Optional container bind address (default :: — dual-stack, all interfaces).
+# Keep this at the default in Docker; use BIND_IP above to restrict the host port.
+# PHX_IP=::
+
+# RECOMMENDED in production — a GitHub token lifts the API limit to 5k req/hr
+# and enables the nightly bulk repository sync (a classic PAT, no scopes
+# needed for public data).
+GITHUB_TOKEN=
+
+# OPTIONAL — GitHub OAuth sign-in. Leave blank to disable that login button.
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+
+# REQUIRED in production — scoped Elektrine PAT with write:email permission.
+# Create it under Elektrine Account → Developer and keep it out of git.
+ELEKTRINE_EMAIL_API_URL=https://elektrine.com
+ELEKTRINE_EMAIL_API_KEY=
+
+# OPTIONAL — bounty marketplace fiat escrow. Without these, only
+# credit-funded bounties are available.
+# STRIPE_SECRET_KEY=sk_live_...
+# STRIPE_WEBHOOK_SECRET=whsec_...
+
+# OPTIONAL — platform share of each bounty (0.0–1.0). Default 0.15.
+# MARKET_TAKE_RATE=0.15
+
+# OPTIONAL — git over SSH (git@host:owner/name.git). HTTPS cloning works
+# without this. Publishing the port is handled by the compose file.
+#
+# The daemon's host key is generated on first boot into the `ssh` volume and
+# must survive deploys: replacing it looks exactly like a man-in-the-middle to
+# every client that has connected before, and git will refuse until the user
+# edits known_hosts. scripts/deploy/backup.sh captures it.
+# GIT_SSH_ENABLED=true
+# GIT_SSH_PORT=2222
+# Narrow the published interface if the daemon should not be world-reachable.
+# GIT_SSH_BIND_IP=0.0.0.0