@@ -0,0 +1,562 @@
# In this file, we load production configuration and secrets
# from environment variables. You can also hardcode secrets,
# although such is generally not recommended and you have to
# remember to add this file to your .gitignore.
import Config
# Allow any secret to be provided via a file (`<NAME>_FILE`, e.g. Docker secrets / systemd
# LoadCredential) instead of a plain env var. See bonfire-app#1663.
alias Bonfire.Common.EnvSecrets
IO . puts ( " Preparing runtime config... " )
System . get_env ( " MIX_QUIET " ) || IO . puts ( " 🔥 Welcome to Bonfire! " )
yes? = ~w( true yes 1 )
no? = ~w( false no none 0 )
# flavour = System.get_env("FLAVOUR", "classic")
host = System . get_env ( " HOSTNAME " , " localhost " )
server_port = String . to_integer ( System . get_env ( " SERVER_PORT " , " 4000 " ) )
public_port = String . to_integer ( System . get_env ( " PUBLIC_PORT " , " 4000 " ) )
test_instance? = System . get_env ( " TEST_INSTANCE " ) in yes?
federate? = test_instance? or System . get_env ( " FEDERATE " ) in yes?
hosts =
" #{ host } , #{ System . get_env ( " EXTRA_DOMAINS " ) } "
|> String . replace ( [ " ` " , " " ] , " " )
|> String . split ( " , " )
|> Enum . map ( & " // #{ &1 } " )
EnvSecrets . env_or_file ( " DATABASE_URL " ) || EnvSecrets . env_or_file ( " CLOUDRON_POSTGRESQL_URL " ) ||
EnvSecrets . env_or_file ( " POSTGRES_PASSWORD " ) ||
EnvSecrets . env_or_file ( " CLOUDRON_POSTGRESQL_PASSWORD " ) ||
System . get_env ( " MIX_QUIET " ) || System . get_env ( " CI " ) ||
raise """
Environment variables for database are missing.
For example: DATABASE_URL=ecto://USER:PASS@HOST/DATABASE
You can also set POSTGRES_PASSWORD (required),
and POSTGRES_USER (default: postgres) and POSTGRES_HOST (default: localhost)
"""
## load extensions' runtime configs (and behaviours) directly via extension-provided modules
Bonfire.Common.Config.LoadExtensionsConfig . load_configs ( [ Bonfire.RuntimeConfig ] )
##
secret_key_base =
EnvSecrets . env_or_file ( " SECRET_KEY_BASE " ) || System . get_env ( " MIX_QUIET " ) ||
System . get_env ( " CI " ) ||
raise """
environment variable SECRET_KEY_BASE is missing.
You can generate one by calling: mix phx.gen.secret
"""
signing_salt =
EnvSecrets . env_or_file ( " SIGNING_SALT " ) || System . get_env ( " MIX_QUIET " ) || System . get_env ( " CI " ) ||
raise """
environment variable SIGNING_SALT is missing.
"""
encryption_salt =
EnvSecrets . env_or_file ( " ENCRYPTION_SALT " ) || System . get_env ( " MIX_QUIET " ) ||
System . get_env ( " CI " ) ||
raise """
environment variable ENCRYPTION_SALT is missing.
"""
cute_gifs_dir = System . get_env ( " CUTE_GIFS_DIR " , " data/uploads/cute-gifs/ " )
config :bonfire ,
# how many nested replies to show
thread_default_max_depth : String . to_integer ( System . get_env ( " THREAD_DEPTH " , " 3 " ) ) ,
feed_live_update_many_preload_mode : :async_actions ,
host : host ,
default_cache_hours : String . to_integer ( System . get_env ( " BONFIRE_CACHE_HOURS " , " 3 " ) ) ,
app_name : System . get_env ( " APP_NAME " , " Bonfire " ) ,
ap_base_path : System . get_env ( " AP_BASE_PATH " , " /pub " ) ,
# github_app_client_id: System.get_env("GITHUB_APP_CLIENT_ID", "Iv1.8d612e6e5a2149c9"),
github_token : EnvSecrets . env_or_file ( " GITHUB_TOKEN " ) ,
show_debug_errors_in_dev : System . get_env ( " SHOW_DEBUG_IN_DEV " ) ,
encryption_salt : encryption_salt ,
signing_salt : signing_salt ,
root_path : File . cwd! ( ) ,
cute_gifs : [
num : length ( Path . wildcard ( cute_gifs_dir <> " *.gif " ) ) ,
dir : cute_gifs_dir
]
if System . get_env ( " ENABLE_STATIC_CACHING " ) not in yes? do
config :bonfire_ui_common , Bonfire.UI.Common.StaticGenerator , modularity : :disabled
end
phx_server = System . get_env ( " PHX_SERVER " )
plug_server = System . get_env ( " PLUG_SERVER " )
use_cowboy? = plug_server == " cowboy "
use_socket_file? = plug_server == " cowboy_socket "
socket_file_path = System . get_env ( " SOCKET_FILE_PATH " , " /tmp/bonfire_socket " )
phx_compress? = System . get_env ( " PHX_COMPRESS_HTTP " ) not in no?
if System . get_env ( " DISABLE_LOG " ) in yes? do
# to suppress non-captured logs in tests (eg. in setup_all)
config :logger , backends : [ ]
end
http_options =
cond do
use_socket_file? ->
[
ip : { :local , socket_file_path } ,
port : 0 ,
compress : phx_compress? ,
transport_options : [
post_listen_callback : fn _ ->
File . touch! ( socket_file_path )
File . chmod! ( socket_file_path , 0o660 )
end ,
socket_opts : [ ]
]
]
use_cowboy? ->
[
# only bind the app to localhost when serving behind a proxy
# ip: (if public_port != server_port, do: {127, 0, 0, 1}),
port : server_port ,
compress : phx_compress? ,
transport_options : [
max_connections : 16_384 ,
socket_opts : [ :inet6 ]
]
]
true ->
# for
[
port : server_port ,
http_options : [
compress : phx_compress?
]
]
end
config :bonfire , Bonfire.Web.Endpoint ,
server :
phx_server not in no? and
( config_env ( ) != :test or test_instance? or phx_server in yes? ) ,
url : [
host : host ,
port : public_port
] ,
check_origin : hosts ,
# check_origin: false,
adapter :
if ( use_cowboy? ,
do : Phoenix.Endpoint.Cowboy2Adapter ,
else : Bandit.PhoenixAdapter
) ,
http : http_options ,
thousand_island : [ transport_ports : [ hibernate_after : to_timeout ( second : 15 ) ] ] ,
secret_key_base : secret_key_base ,
live_view : [ signing_salt : signing_salt ]
if test_instance? do
test_instance_hostname = System . get_env ( " TEST_INSTANCE_HOSTNAME " , " localhost " )
test_instance_server_port =
String . to_integer ( System . get_env ( " TEST_INSTANCE_SERVER_PORT " , " 4002 " ) )
config :bonfire , Bonfire.Web.FakeRemoteEndpoint ,
url : [
host : test_instance_hostname ,
port :
if ( test_instance_hostname != " localhost " ,
do : public_port ,
else : test_instance_server_port
)
] ,
http : [
port : test_instance_server_port
] ,
secret_key_base : secret_key_base
end
# HTTP client(s) configuration
finch_conn_opts = [ case_sensitive_headers : true ]
finch_conn_opts =
finch_conn_opts ++
case System . get_env ( " HTTP_PROXY_URL " ) do
nil ->
[ ]
uri ->
uri =
uri
|> URI . parse ( )
[ proxy : { String . to_existing_atom ( uri . scheme ) , uri . host , uri . port , [ ] } ]
end
finch_pools = %{
:default = > [
# Number of connections to maintain in each pool (HTTP1)
size : String . to_integer ( System . get_env ( " FINCH_POOL_SIZE " , " 50 " ) ) ,
# Number of pools to start (increasing is only useful for HTTP2, which we don't use by default)
count : String . to_integer ( System . get_env ( " FINCH_POOL_COUNT " , " 1 " ) ) ,
# 10 min by default
pool_max_idle_time : String . to_integer ( System . get_env ( " FINCH_POOL_MAX_IDLE_TIME " , " 600000 " ) ) ,
conn_opts : finch_conn_opts
] ,
" https://icons.duckduckgo.com " = > [
conn_opts : [
transport_opts : [ size : 8 , timeout : to_timeout ( second : 3 ) , conn_opts : finch_conn_opts ]
]
] ,
" https://www.google.com/s2/favicons " = > [
conn_opts : [
transport_opts : [ size : 8 , timeout : to_timeout ( second : 3 ) , conn_opts : finch_conn_opts ]
]
]
}
# config :tesla, adapter: Tesla.Adapter.Hackney
config :bonfire , :finch_pools , finch_pools
if config_env ( ) != :test or federate? do
config :tesla , :adapter , { Tesla.Adapter.Finch , name : Bonfire.Finch , pools : finch_pools }
end
oban_notifier =
case System . get_env ( " OBAN_NOTIFIER " , " postgres " ) do
" pg " -> Oban.Notifiers.PG
" phoenix " -> Oban.Notifiers.Phoenix
_postgres -> Oban.Notifiers.Postgres
end
# disable insert notifications?
oban_insert_trigger = System . get_env ( " OBAN_INSERT_TRIGGER " , " true " ) in [ " true " , " 1 " , " yes " ]
# with insert_trigger enabled, polling is just a safety net for future-scheduled jobs and missed
# notifications — 30s is sufficient and avoids constant background DB queries
oban_stage_interval = System . get_env ( " OBAN_STAGE_INTERVAL_MS " , " 30000 " ) |> String . to_integer ( )
# average ms a producer waits before fetching more jobs after a trigger; jitter applies (0-2x actual)
oban_dispatch_cooldown = System . get_env ( " OBAN_DISPATCH_COOLDOWN_MS " , " 5 " ) |> String . to_integer ( )
# Set OBAN_TESTING=inline to run jobs synchronously on insert (useful for e2e tests — makes federation between servers effectively instant so tests don't need to poll and wait).
# Set to "manual" to disable automatic job execution entirely (useful for unit tests).
oban_testing = case System . get_env ( " OBAN_TESTING " ) do
" inline " -> [ testing : :inline ]
" manual " -> [ testing : :manual ]
_ -> [ ]
end
config :bonfire , Oban ,
notifier : oban_notifier ,
repo : Bonfire.Common.Repo ,
insert_trigger : oban_insert_trigger ,
stage_interval : oban_stage_interval ,
dispatch_cooldown : oban_dispatch_cooldown ,
queues : [
federator_incoming_mentions :
String . to_integer ( System . get_env ( " QUEUE_SIZE_AP_IN_MENTIONS " , " 3 " ) ) ,
federator_incoming_follows :
String . to_integer ( System . get_env ( " QUEUE_SIZE_AP_IN_FOLLOWS " , " 2 " ) ) ,
federator_incoming : String . to_integer ( System . get_env ( " QUEUE_SIZE_AP_IN " , " 3 " ) ) ,
federator_incoming_unverified :
String . to_integer ( System . get_env ( " QUEUE_SIZE_AP_IN_UNVERIFIED " , " 1 " ) ) ,
federator_outgoing : String . to_integer ( System . get_env ( " QUEUE_SIZE_AP_OUT " , " 3 " ) ) ,
remote_fetcher : String . to_integer ( System . get_env ( " QUEUE_SIZE_AP_FETCH " , " 1 " ) ) ,
import : String . to_integer ( System . get_env ( " QUEUE_SIZE_IMPORT " , " 1 " ) ) ,
deletion : String . to_integer ( System . get_env ( " QUEUE_SIZE_DELETION " , " 1 " ) ) ,
database_prune : String . to_integer ( System . get_env ( " QUEUE_SIZE_DB_PRUNE " , " 1 " ) ) ,
static_generator : String . to_integer ( System . get_env ( " QUEUE_SIZE_STATIC_GEN " , " 1 " ) ) ,
# video_transcode: 1,
# boost_activities: 1,
fetch_open_science : String . to_integer ( System . get_env ( " QUEUE_SIZE_OPEN_SCIENCE_FETCH " , " 1 " ) ) ,
ghost_webhooks : String . to_integer ( System . get_env ( " QUEUE_SIZE_GHOST_WEBHOOKS " , " 2 " ) ) ,
# batched Meilisearch indexing flush (Bonfire.Search.Workers.IndexWorker);
search_index : String . to_integer ( System . get_env ( " QUEUE_SIZE_SEARCH_INDEX " , " 1 " ) )
] ,
plugins : [
# delete job history after 6 hours
{ Oban.Plugins.Pruner , max_age : 60 * 60 * 6 } ,
# rescue orphaned jobs
{ Oban.Plugins.Lifeline , rescue_after : :timer . minutes ( 60 ) } ,
{ Oban.Plugins.Cron ,
crontab :
[
{ " @daily " , ActivityPub.Pruner.PruneDatabaseWorker , max_attempts : 1 }
] ++
if Bonfire.Common.Extend . module_enabled? ( Bonfire.UI.Common.StaticGenerator ) do
#
interval = if config_env ( ) == :prod , do : 10 , else : 60
IO . puts ( " Static pages will be generated and cached every #{ interval } minutes. " )
[ { " */ #{ interval } * * * * " , Bonfire.UI.Common.StaticGenerator , max_attempts : 3 } ]
else
IO . puts ( " Static pages will not be cached " )
[ ]
end ++
if Bonfire.Common.Extend . extension_enabled? ( :bonfire_open_science ) do
IO . puts ( " Open science publications will be fetched for all users once an hour. " )
[ { " @hourly " , Bonfire.OpenScience.APIs } ]
else
IO . puts ( " Open science extension is not enabled " )
[ ]
end }
# ++
# if Bonfire.Common.Extend.module_enabled?(Bonfire.Social.TrendingLinksCacheWorker) do
# [{"@hourly", Bonfire.Social.TrendingLinksCacheWorker, max_attempts: 1}]
# else
# []
# end
]
config :activity_pub , :oban_queues ,
retries : [ federator_incoming : 2 , federator_outgoing : 3 , remote_fetcher : 1 ]
config :activity_pub , Oban ,
notifier : Oban.Notifiers.PG ,
# to avoid running it twice
queues : false ,
repo : Bonfire.Common.Repo
if oban_testing != [ ] do
config :bonfire , Oban , oban_testing
config :activity_pub , Oban , oban_testing
end
config :activity_pub , :http ,
user_agent : System . get_env ( " AP_USER_AGENT " , " #{ System . get_env ( " APP_NAME " ) || Bonfire.Application . name ( ) || " Bonfire " } federation " )
config :activity_pub , ActivityPub.Federator.HTTP.RateLimit ,
scale_ms : String . to_integer ( System . get_env ( " AP_RATELIMIT_PER_MS " , " 10000 " ) ) ,
limit : String . to_integer ( System . get_env ( " AP_RATELIMIT_NUM " , " 20 " ) )
case System . get_env ( " GRAPH_DB_URL " ) do
nil ->
nil
url ->
pool_size =
case System . get_env ( " POOL_SIZE " ) do
pool when is_binary ( pool ) and pool not in [ " " , " 0 " ] ->
String . to_integer ( pool )
# default to twice the number of CPU cores
_ ->
System . schedulers_online ( ) * 2
end
# config :bolt_sips, Bolt,
# url: url,
# basic_auth: [username: "memgraph", password: "memgraph"],
# pool_size: pool_size
config :boltx , Bolt ,
uri : url ,
auth : [ username : " memgraph " , password : " memgraph " ] ,
pool_size : pool_size
end
if ( config_env ( ) == :prod or System . get_env ( " OTEL_ENABLED " ) in yes? ) and
( System . get_env ( " OTEL_EXPORTER_OTLP_ENDPOINT " ) ||
EnvSecrets . env_or_file ( " OTEL_LIGHTSTEP_API_KEY " ) ||
EnvSecrets . env_or_file ( " OTEL_HONEYCOMB_API_KEY " ) ) do
# Enable tracing only when we have a configured endpoint
config :opentelemetry ,
span_processor : :batch ,
traces_exporter : { :opentelemetry_exporter , %{ } }
config :opentelemetry_exporter ,
otlp_protocol : :http_protobuf
otel_endpoint = System . get_env ( " OTEL_EXPORTER_OTLP_ENDPOINT " )
if otel_endpoint do
IO . puts ( " NOTE: OTLP (open telemetry) data will be sent to #{ otel_endpoint } " )
config :opentelemetry_exporter ,
otlp_endpoint : otel_endpoint
end
config :opentelemetry_exporter ,
# You can configure the compression type for exporting traces.
otlp_compression : :gzip ,
otlp_traces_compression : :gzip
if EnvSecrets . env_or_file ( " OTEL_LIGHTSTEP_API_KEY " ) do
IO . puts ( " NOTE: OTLP (open telemetry) data will be sent to lightstep / servicenow.com " )
# Example configuration, for more refer to: https://github.com/open-telemetry/opentelemetry-erlang/tree/main/apps/opentelemetry_exporter#application-environment
config :opentelemetry_exporter ,
otlp_traces_endpoint : " https://ingest.lightstep.com:443/traces/otlp/v0.9 " ,
otlp_headers : [
{ " lightstep-access-token " , EnvSecrets . env_or_file ( " OTEL_LIGHTSTEP_API_KEY " ) }
]
end
if EnvSecrets . env_or_file ( " OTEL_HONEYCOMB_API_KEY " ) do
IO . puts ( " NOTE: OTLP (open telemetry) data will be sent to honeycomb.io " )
config :opentelemetry , :processors ,
otel_batch_processor : %{
exporter : {
:opentelemetry_exporter ,
%{
endpoints : [
{ :https , ~c" api.honeycomb.io " , 443 ,
[
verify : :verify_peer ,
cacertfile : :certifi . cacertfile ( ) ,
depth : 3 ,
customize_hostname_check : [
match_fun : :public_key . pkix_verify_hostname_match_fun ( :https )
]
] }
] ,
headers : [
{ " x-honeycomb-team " , EnvSecrets . env_or_file! ( " OTEL_HONEYCOMB_API_KEY " ) } ,
{ " x-honeycomb-dataset " , System . get_env ( " OTEL_SERVICE_NAME " , " bonfire " ) }
] ,
protocol : :grpc
}
}
}
end
else
# Ensure OpenTelemetry is properly disabled when no endpoints are configured
config :opentelemetry ,
modularity : :disabled ,
span_processor : :simple ,
traces_exporter : :none
end
# Error reporting
case System . get_env ( " SENTRY_DSN " , " " ) do
" " ->
config :sentry , modularity : :disabled
dsn ->
IO . puts ( " NOTE: errors will be reported to Sentry. " )
config :sentry ,
dsn : dsn ,
integrations : [
oban : [
capture_errors : true ,
cron : [ enabled : true ]
]
]
if System . get_env ( " SENTRY_NAME " ) do
config :sentry , server_name : System . get_env ( " SENTRY_NAME " )
end
end
config :sentry ,
source_code_exclude_patterns : [
~r/ \/ flavours \/ / ,
~r/ \/ extensions \/ / ,
~r/ \/ deps \/ / ,
~r/ \/ _build \/ / ,
~r/ \/ priv \/ / ,
~r/ \/ test \/ /
]
case EnvSecrets . env_or_file ( " APPSIGNAL_PUSH_API_KEY " , " " ) do
" " ->
config :appsignal , :config , active : false
api_key ->
IO . puts ( " NOTE: errors and performance metrics will be reported to AppSignal. " )
config :appsignal , :config ,
otp_app : :bonfire ,
name : System . get_env ( " APPSIGNAL_APP_NAME " , " bonfire " ) ,
push_api_key : api_key ,
env : config_env ( ) ,
active : true
end
config :untangle ,
env : config_env ( ) ,
# level: :error,
to_io : System . get_env ( " UNTANGLE_TO_IO " ) in yes?
# start prod-only config
if config_env ( ) == :prod do
config :bonfire , Bonfire.Common.Repo ,
# ssl: true,
# database: System.get_env("POSTGRES_DB", "bonfire"),
# Note: keep this disabled if using ecto_dev_logger or EctoSparkles.Log instead #
log : String . to_existing_atom ( System . get_env ( " DB_QUERIES_LOG_LEVEL " , " false " ) )
end
# end prod only config
# start prod and dev only config
if config_env ( ) != :test do
config :bonfire , Bonfire.Common.Repo ,
# The timeout for establishing new connections (default: 5000)
connect_timeout : String . to_integer ( System . get_env ( " DB_CONNECT_TIMEOUT " , " 10000 " ) ) ,
# The time in milliseconds (as an integer) to wait for the query call to finish (default: 15_000)
timeout : String . to_integer ( System . get_env ( " DB_QUERY_TIMEOUT " , " 20000 " ) ) ,
# DBConnection pool tuning - CRITICAL for federation workers under load
# queue_target: Time a connection checkout request can wait in queue before DBConnection
# starts to reject new requests. Default is 50ms which is too aggressive for high-concurrency
# workloads. Setting to 5000ms matches test config and allows patient waiting under load.
queue_target : String . to_integer ( System . get_env ( " DB_QUEUE_TARGET " , " 5000 " ) ) ,
# queue_interval: How often to check if queue_target is being exceeded. Default is 1000ms.
queue_interval : String . to_integer ( System . get_env ( " DB_QUEUE_INTERVAL " , " 2000 " ) ) ,
# pool_timeout: Overall timeout for getting a connection from the pool. Default is 5000ms.
# Increasing to 30000ms allows workers to wait patiently during load spikes.
pool_timeout : String . to_integer ( System . get_env ( " DB_POOL_TIMEOUT " , " 30000 " ) ) ,
parameters : [
# Abort any statement that takes more than the specified amount of time. The timeout is measured from the time a command arrives at the server until it is completed by the server.
statement_timeout : System . get_env ( " DB_STATEMENT_TIMEOUT " , " 20000 " ) ,
# idle-in-transaction timeout: terminates any session with an open transaction that has been idle for longer than the specified amount of time. This allows any locks held by that session to be released and the connection slot to be reused. WARNING: this seems to also apply to migrations when running in a release, so needs to be high enough for DB migrations and fixtures to run.
idle_in_transaction_session_timeout : System . get_env ( " DB_IDLE_TRANSACTION_TIMEOUT " , " 120000 " )
]
end
## bonfire_livebook
if Code . ensure_loaded? ( Livebook ) do
Livebook . config_runtime ( )
end
if api_key = EnvSecrets . env_or_file ( " PIRATE_WEATHER_API_KEY " ) do
config :forecastr ,
backend : Forecastr.PirateWeather ,
appid : api_key ,
# minutes to cache
ttl : to_timeout ( minute : 14 )
end
if api_key = EnvSecrets . env_or_file ( " OPEN_WEATHER_MAP_API_KEY " ) do
config :forecastr ,
backend : Forecastr.OWM ,
appid : api_key ,
# minutes to cache
ttl : to_timeout ( minute : 14 )
end
db_ssl? = System . get_env ( " DB_SSL " ) in ~w( true yes 1 )
if db_ssl? do
ssl_opts =
case System . get_env ( " DB_CA_CERT_FILE " ) do
nil -> true
" " -> true
path -> [ cacertfile : path ]
end
config :bonfire , Bonfire.Common.Repo ,
ssl : ssl_opts
end
IO . puts ( " Runtime config ready " )
