Initial commit on Forgejo

Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.

config/runtime.exs

@@ -0,0 +1,251 @@
+import Config
+
+# config/runtime.exs is executed for all environments, including
+# during releases. It is executed after compilation and before the
+# system starts, so it is typically used to load production configuration
+# and secrets from environment variables or elsewhere. Do not define
+# any compile-time configuration in here, as it won't be applied.
+# The block below contains prod specific runtime configuration.
+
+# ## Using releases
+#
+# If you use `mix release`, you need to explicitly enable the server
+# by passing the PHX_SERVER=true when you start it:
+#
+#     PHX_SERVER=true bin/tarakan start
+#
+# Alternatively, you can use `mix phx.gen.release` to generate a `bin/server`
+# script that automatically sets the env var above.
+if System.get_env("PHX_SERVER") do
+  config :tarakan, TarakanWeb.Endpoint, server: true
+end
+
+config :tarakan, TarakanWeb.Endpoint,
+  http: [port: String.to_integer(System.get_env("PORT", "4000"))]
+
+github_runtime_config =
+  [
+    client_id: System.get_env("GITHUB_CLIENT_ID"),
+    client_secret: System.get_env("GITHUB_CLIENT_SECRET"),
+    api_token: System.get_env("GITHUB_TOKEN")
+  ]
+  |> Enum.reject(fn {_key, value} -> is_nil(value) end)
+
+if github_runtime_config != [] do
+  config :tarakan, :github, github_runtime_config
+end
+
+if mirror_dir = System.get_env("MIRROR_DIR") do
+  config :tarakan, Tarakan.RepositoryMirror, root: mirror_dir
+end
+
+if hosted_dir = System.get_env("HOSTED_DIR") do
+  config :tarakan, Tarakan.HostedRepositories, root: hosted_dir
+end
+
+git_ssh_runtime_config =
+  [
+    enabled: System.get_env("GIT_SSH_ENABLED") in ~w(true 1),
+    port: System.get_env("GIT_SSH_PORT") && String.to_integer(System.get_env("GIT_SSH_PORT")),
+    host_key_dir: System.get_env("GIT_SSH_HOST_KEY_DIR")
+  ]
+  |> Enum.reject(fn {_key, value} -> is_nil(value) end)
+
+if System.get_env("GIT_SSH_ENABLED") do
+  config :tarakan, Tarakan.GitSSH, git_ssh_runtime_config
+end
+
+gitlab_runtime_config =
+  [
+    base_url: System.get_env("GITLAB_URL"),
+    client_id: System.get_env("GITLAB_CLIENT_ID"),
+    client_secret: System.get_env("GITLAB_CLIENT_SECRET")
+  ]
+  |> Enum.reject(fn {_key, value} -> is_nil(value) end)
+
+if gitlab_runtime_config != [] do
+  config :tarakan, :gitlab, gitlab_runtime_config
+end
+
+# The OAuth client posts the client_secret and user bearer tokens to the
+# GitLab base URL, so in prod it must use TLS. Plain http stays allowed in
+# dev/test for local self-hosted instances.
+if config_env() == :prod do
+  case System.get_env("GITLAB_URL") do
+    nil ->
+      :ok
+
+    "https://" <> _rest ->
+      :ok
+
+    url ->
+      raise """
+      environment variable GITLAB_URL must use an https:// URL in prod, got: #{inspect(url)}
+      """
+  end
+end
+
+if config_env() == :dev do
+  # Reload browser tabs when matching files change.
+  config :tarakan, TarakanWeb.Endpoint,
+    live_reload: [
+      web_console_logger: true,
+      patterns: [
+        # Static assets, except user uploads
+        ~r"priv/static/(?!uploads/).*\.(js|css|png|jpeg|jpg|gif|svg)$"E,
+        # Gettext translations
+        ~r"priv/gettext/.*\.po$"E,
+        # Router, Controllers, LiveViews and LiveComponents
+        ~r"lib/tarakan_web/router\.ex$"E,
+        ~r"lib/tarakan_web/(controllers|live|components)/.*\.(ex|heex)$"E
+      ]
+    ]
+end
+
+if config_env() == :prod do
+  database_url =
+    System.get_env("DATABASE_URL") ||
+      raise """
+      environment variable DATABASE_URL is missing.
+      For example: ecto://USER:PASS@HOST/DATABASE
+      """
+
+  maybe_ipv6 = if System.get_env("ECTO_IPV6") in ~w(true 1), do: [:inet6], else: []
+
+  # verify_peer TLS to Postgres, on by default in prod (system CAs). Set
+  # DATABASE_SSL=false for a co-located DB on a private network (docker compose).
+  repo_ssl? = System.get_env("DATABASE_SSL", "true") in ~w(true 1)
+
+  repo_opts = [
+    url: database_url,
+    pool_size: String.to_integer(System.get_env("POOL_SIZE") || "10"),
+    # For machines with several cores, consider starting multiple pools of `pool_size`
+    # pool_count: 4,
+    socket_options: maybe_ipv6
+  ]
+
+  repo_opts =
+    if repo_ssl? do
+      Keyword.merge(repo_opts,
+        ssl: true,
+        ssl_opts: [verify: :verify_peer, cacerts: :public_key.cacerts_get()]
+      )
+    else
+      repo_opts
+    end
+
+  config :tarakan, Tarakan.Repo, repo_opts
+
+  # The secret key base is used to sign/encrypt cookies and other secrets.
+  # A default value is used in config/dev.exs and config/test.exs but you
+  # want to use a different value for prod and you most likely don't want
+  # to check this value into version control, so we use an environment
+  # variable instead.
+  secret_key_base =
+    System.get_env("SECRET_KEY_BASE") ||
+      raise """
+      environment variable SECRET_KEY_BASE is missing.
+      You can generate one by calling: mix phx.gen.secret
+      """
+
+  host = System.get_env("PHX_HOST") || "example.com"
+
+  # Published in /.well-known/security.txt (RFC 9116).
+  config :tarakan, :security_contact, System.get_env("SECURITY_CONTACT") || "security@#{host}"
+
+  config :tarakan, :dns_cluster_query, System.get_env("DNS_CLUSTER_QUERY")
+
+  # Comma-separated IPs/CIDRs of reverse proxies allowed to set X-Forwarded-*
+  # headers. Example: TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12
+  # Loopback is always trusted: the Caddy deployment proxies from the same
+  # host and must be able to assert X-Forwarded-Proto/For.
+  trusted_proxies =
+    Tarakan.TrustedProxies.parse(System.get_env("TRUSTED_PROXIES")) ++
+      Tarakan.TrustedProxies.parse("127.0.0.1,::1")
+
+  config :tarakan, :trusted_proxies, trusted_proxies
+
+  # Bind address. Defaults to dual-stack IPv6 (`::`), which also accepts IPv4.
+  # Set PHX_IP=127.0.0.1 to bind loopback-only behind a same-host reverse proxy.
+  # Any valid IPv4/IPv6 literal is accepted; a malformed value fails fast rather
+  # than silently binding all interfaces.
+  phx_ip = System.get_env("PHX_IP", "::")
+
+  listen_ip =
+    case :inet.parse_address(String.to_charlist(phx_ip)) do
+      {:ok, ip} ->
+        ip
+
+      {:error, _reason} ->
+        raise """
+        environment variable PHX_IP is invalid: #{inspect(phx_ip)}
+        Expected an IPv4 or IPv6 address, e.g. "::", "0.0.0.0", or "127.0.0.1".
+        """
+    end
+
+  config :tarakan, TarakanWeb.Endpoint,
+    url: [host: host, port: 443, scheme: "https"],
+    http: [
+      # See the documentation on https://bandit.hexdocs.pm/Bandit.html#t:options/0
+      ip: listen_ip
+    ],
+    secret_key_base: secret_key_base
+
+  elektrine_email_api_key =
+    System.get_env("ELEKTRINE_EMAIL_API_KEY") ||
+      raise "environment variable ELEKTRINE_EMAIL_API_KEY is missing"
+
+  config :tarakan, Tarakan.Mailer,
+    adapter: Tarakan.Mailer.ElektrineAdapter,
+    api_key: elektrine_email_api_key,
+    base_url: System.get_env("ELEKTRINE_EMAIL_API_URL", "https://elektrine.com")
+
+  # Bounty marketplace (fiat escrow). Optional: credit-funded bounties work
+  # without Stripe keys; fiat funding stays unavailable until they are set.
+  if stripe_secret_key = System.get_env("STRIPE_SECRET_KEY") do
+    config :tarakan, :stripe_secret_key, stripe_secret_key
+  end
+
+  if stripe_webhook_secret = System.get_env("STRIPE_WEBHOOK_SECRET") do
+    config :tarakan, :stripe_webhook_secret, stripe_webhook_secret
+  end
+
+  # Plan price ids for subscription checkout (config.exs placeholders are
+  # never valid Stripe objects).
+  if stripe_price_enterprise = System.get_env("STRIPE_PRICE_ENTERPRISE") do
+    config :tarakan, :stripe_price_enterprise, stripe_price_enterprise
+  end
+
+  if take_rate = System.get_env("MARKET_TAKE_RATE") do
+    config :tarakan, :market_take_rate, String.to_float(take_rate)
+  end
+
+  # ## SSL Support
+  #
+  # To get SSL working, you will need to add the `https` key
+  # to your endpoint configuration:
+  #
+  #     config :tarakan, TarakanWeb.Endpoint,
+  #       https: [
+  #         ...,
+  #         port: 443,
+  #         cipher_suite: :strong,
+  #         keyfile: System.get_env("SOME_APP_SSL_KEY_PATH"),
+  #         certfile: System.get_env("SOME_APP_SSL_CERT_PATH")
+  #       ]
+  #
+  # The `cipher_suite` is set to `:strong` to support only the
+  # latest and more secure SSL ciphers. This means old browsers
+  # and clients may not be supported. You can set it to
+  # `:compatible` for wider support.
+  #
+  # `:keyfile` and `:certfile` expect an absolute path to the key
+  # and cert in disk or a relative path inside priv, for example
+  # "priv/ssl/server.key". For all supported SSL configuration
+  # options, see https://plug.hexdocs.pm/Plug.SSL.html#configure/1
+  #
+  # SSL is forced in production via the `:trusted_ssl` config in
+  # config/prod.exs: the endpoint plugs TarakanWeb.Plugs.ForwardedProto
+  # (trusted-proxy-gated X-Forwarded-Proto rewrite) followed by Plug.SSL
+  # (HSTS + http->https redirect). See `Plug.SSL` for the available options.
+end