treg-dsh

Configuration

Environment variables (prefix TREG_, read from .env):

Var	Default	Purpose
TREG_DATABASE_URL	sqlite+aiosqlite:///./treg.db	DB URL (SQLite for dev, Postgres in prod)
TREG_SECRET_KEY	(empty)	Fernet key for secrets-at-rest; empty → an ephemeral key is minted (secrets won't survive a restart)
TREG_PUBLIC_URL	https://treg.to	treg's public base, used to build the OAuth callback URI
TREG_SESSION_SECRET	(empty)	signs the dashboard session cookie; falls back to TREG_SECRET_KEY. Set a real value in prod
TREG_GITHUB_CLIENT_ID / _SECRET	(empty)	GitHub OAuth sign-in (callback `
/auth/github/callback`); empty hides the button
TREG_GOOGLE_CLIENT_ID / _SECRET	(empty)	Google OAuth sign-in (redirect `
/auth/google/callback`); empty hides the button
TREG_INSTAGRAM_CLIENT_ID / _SECRET	(empty)	Instagram App ID and secret for direct Instagram Login (redirect `
/oauth/callback`)
TREG_META_CLIENT_ID / _SECRET	(empty)	Meta app credentials for Facebook Pages, Meta Ads, and optional Instagram page-tools
TREG_OAUTH_REVIEW_PENDING	instagram-login,page-messages	Comma-separated registry review keys whose capabilities must remain gated; hosted review state is maintained privately.
TREG_RESEND_API_KEY / TREG_EMAIL_FROM	(empty)	transactional email via Resend (OTP codes + invites); From must be a Resend-verified sender
TREG_BLOCKED_EMAIL_DOMAINS	(empty)	comma-separated email domains refused at every sign-up/sign-in door and at team creation (subdomains included, case-insensitive). Empty blocks nothing — no list ships in the code
TREG_ADMIN_TOKEN	(empty)	cross-tenant super-admin bearer; authorizes every /admin/* endpoint. Empty disables the env path (only is_superadmin users reach /admin). Keep it long + secret.
TREG_EMAIL_DEV_MODE	false	when true, /auth/email/start returns the OTP in its response (no mail sender needed) — dev/local only, never in prod.
TREG_KV_URL	(empty)	shared key-value store (Redis protocol) for counters every worker must agree on, today the per-team review-invitation budget. Empty = an in-process fallback, fine for one worker

No .env is needed for local dev — every setting has a working default (ephemeral key, sqlite).

⚠️ Back these up before moving or redeploying: the Fernet key (TREG_SECRET_KEY) and the database (Postgres in prod; treg.db for a local sqlite run). Lose the Fernet key and every stored secret becomes unrecoverable.