TBNilles
e30c3b632a
Forges (multi-host) + tokens, project directories, and git identity now live in a private SQLite config store (internal/store, modernc.org/sqlite) on a /data named volume that is not bind-mounted or exposed, so credentials aren't reachable outside the container. New Settings page (/settings) + <settings-panel> with /api/config CRUD. Scanner reads roots fresh from the store each cycle; service resolves forges per-repo from the store and reapplies per-forge git auth on change. First run seeds the store from .env. Overturns the old no-datastore/.env-config laws (AGENT.md updated). Verified live end-to-end. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
88 lines
4.0 KiB
Bash
88 lines
4.0 KiB
Bash
# ---------------------------------------------------------------------------
|
|
# GitManager configuration. Copy this file to `.env` and fill in values.
|
|
# NEVER commit a real `.env` (it is git-ignored). See AGENT.md §1.5.
|
|
#
|
|
# NOTE: forges (URL + token), project directories, and the git identity now live
|
|
# in the config DATABASE (a private SQLite store, AGENT.md §1.3), managed in the
|
|
# app's Settings. The GITEA_*, GIT_REPO_ROOTS, and GIT_USER_* values below are
|
|
# used ONLY to seed that DB the first time the app starts with an empty store;
|
|
# after that, edit them in Settings (changing .env has no effect).
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Config store location (SQLite). docker-compose points this at a PRIVATE named
|
|
# volume that is not bind-mounted or exposed, so credentials in it are only
|
|
# reachable inside the container (AGENT.md §1.3).
|
|
GITMANAGER_DB=/data/gitmanager.db
|
|
|
|
# Address the HTTP server binds to. Localhost-only by default: there is NO
|
|
# authentication (AGENT.md §0). Only bind to a non-local interface deliberately.
|
|
LISTEN_ADDR=127.0.0.1:8080
|
|
|
|
# HTTPS (optional, but REQUIRED for the MCP connector — Claude Desktop only
|
|
# accepts https:// URLs). When HTTPS_ADDR and both cert/key are set, an HTTPS
|
|
# listener starts alongside HTTP. docker-compose sets these to the mounted certs.
|
|
# Generate a locally-trusted cert on the HOST with mkcert (installs a local CA
|
|
# your OS — and Claude Desktop — will trust), from the project root:
|
|
# winget install FiloSottile.mkcert
|
|
# mkcert -install # trust step (adds the local CA)
|
|
# mkdir certs
|
|
# mkcert -cert-file certs/localhost.pem -key-file certs/localhost-key.pem localhost 127.0.0.1 ::1
|
|
# Then connect Claude Desktop to https://localhost:8443/mcp
|
|
HTTPS_ADDR=
|
|
TLS_CERT_FILE=
|
|
TLS_KEY_FILE=
|
|
|
|
# SEED ONLY (first run) → project directories in the config DB. Comma-separated
|
|
# *container* paths (the host roots are mounted here; see docker-compose.yml).
|
|
# After first run, manage these in Settings. Example: /repos,/work/other
|
|
GIT_REPO_ROOTS=/repos
|
|
|
|
# DOCKER ONLY: the HOST folder that holds your repositories. docker-compose
|
|
# mounts it to /repos inside the container (which GIT_REPO_ROOTS points at).
|
|
# Ignored when running the binary directly. Example: C:/Users/you/Projects
|
|
REPOS_HOST_PATH=./repos
|
|
|
|
# Path to the git binary. "git" resolves it from PATH (git is installed in the
|
|
# container image).
|
|
GIT_BIN=git
|
|
|
|
# --- Repo scanner (read-only; AGENT.md §5) ---------------------------------
|
|
|
|
# How often the background scanner refreshes repo state.
|
|
SCAN_INTERVAL=30s
|
|
|
|
# Max directory depth to descend under each root when discovering repos.
|
|
SCAN_MAX_DEPTH=4
|
|
|
|
# Directory names to skip during discovery, comma-separated.
|
|
SCAN_IGNORE=node_modules,vendor,.cache
|
|
|
|
# Allow the scanner to run `git fetch` (network) to keep ahead/behind counts
|
|
# current. OFF by default — no unsolicited network. (AGENT.md §5)
|
|
SCAN_FETCH_ENABLED=false
|
|
|
|
# --- Logging (AGENT.md §7) --------------------------------------------------
|
|
|
|
# "dev" uses a readable console handler; anything else uses structured JSON.
|
|
APP_ENV=dev
|
|
|
|
# SEED ONLY (first run) → git identity in the config DB. Without an identity,
|
|
# commits inside the container fail with "empty ident". After first run, set it
|
|
# in Settings.
|
|
GIT_USER_NAME=
|
|
GIT_USER_EMAIL=
|
|
# The app configures git to authenticate to each configured forge over HTTPS
|
|
# (an http.extraheader per host), so push/fetch/pull work from the container
|
|
# without a separate SSH key or credential helper.
|
|
|
|
# Optional: also append structured logs to this file. Leave empty to disable.
|
|
LOG_FILE=
|
|
|
|
# --- Forge integration — SEED ONLY (first run) → forges in the config DB ----
|
|
# Multiple forges are now supported and managed in Settings; this pair only
|
|
# seeds the FIRST one on an empty DB. Set BOTH to enable PRs + "Merge & clean up"
|
|
# for repos whose remote host matches this URL. Token scope: repo read + PR write
|
|
# + branch delete. Writes are confirmed per AGENT.md §1.4.
|
|
GITEA_URL=
|
|
GITEA_TOKEN=
|