mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-14 20:21:09 +02:00
4fce6a3ede
Local dev secrets like MANA_STT_API_KEY had no persistent home — they lived only in the gitignored, generator-overwritten per-app .env files. Every `pnpm setup:env` wiped them, so devs had to re-paste keys after any env regeneration. Same recurring friction for MANA_LLM_API_KEY, MANA_AUTH_KEK, OAuth keys, etc. New layer: `.env.secrets` at the repo root. - Gitignored, optional, never required for the build to pass - Read by generate-env.mjs AFTER .env.development; non-empty values override the matching key, so the merged result drives every per-app .env the generator writes - Empty values fall through to the .env.development defaults — a freshly-copied .env.secrets.example is a no-op - One source of truth for all dev secrets, propagated to every app with one `pnpm setup:env` Files: - `.env.secrets.example` — committed template documenting all known secret keys (mana-stt, mana-llm, auth KEK, sync JWT, MinIO, third- party APIs). Devs `cp .env.secrets.example .env.secrets` and fill in. - `.gitignore` — ignores .env.secrets, allows .env.secrets.example - `scripts/generate-env.mjs` — loads .env.secrets if present, prints "Loaded N secrets from .env.secrets" so devs see the override taking effect - `scripts/setup-secrets.mjs` + `pnpm setup:secrets` — convenience script that SSHes to mana-server, greps the prod .env for the keys defined in .env.secrets.example, and writes them locally. Confirms before overwriting an existing .env.secrets unless --force is set; reports which keys couldn't be found on the remote so devs know what's left to fill manually - `docs/LOCAL_DEVELOPMENT.md` + `docs/ENVIRONMENT_VARIABLES.md` — walk-through and architecture diagram update Verified end-to-end: - `rm .env.secrets apps/mana/apps/web/.env && pnpm setup:env` → STT key empty (no regression for devs who haven't opted in) - `pnpm setup:secrets --force && pnpm setup:env` → STT key propagated, "Loaded 3 secrets from .env.secrets" in output - POST /api/v1/voice/transcribe with a real audio file → full transcript back via gpu-stt.mana.how, end-to-end working Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
134 lines
1.6 KiB
Text
134 lines
1.6 KiB
Text
# Dependencies
|
|
node_modules/
|
|
.pnpm-store/
|
|
|
|
# Build outputs
|
|
dist/
|
|
build/
|
|
.next/
|
|
.nuxt/
|
|
.output/
|
|
.svelte-kit/
|
|
.astro/
|
|
.expo/
|
|
android/
|
|
ios/
|
|
.netlify/
|
|
|
|
# Turbo
|
|
.turbo/
|
|
|
|
# MCP config (contains API keys)
|
|
.mcp.json
|
|
|
|
# Environment files
|
|
.env
|
|
.env.local
|
|
.env.development.local
|
|
.env.test.local
|
|
.env.production.local
|
|
.env*.local
|
|
.env.secrets
|
|
|
|
# BUT commit the central development env file + the secrets template
|
|
!.env.development
|
|
!.env.secrets.example
|
|
|
|
# IDE
|
|
.idea/
|
|
.vscode/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# OS files
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Logs
|
|
logs/
|
|
*.log
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
pnpm-debug.log*
|
|
|
|
# Testing
|
|
coverage/
|
|
.nyc_output/
|
|
test-results/
|
|
playwright-report/
|
|
.auth-state.json
|
|
|
|
# TypeScript
|
|
*.tsbuildinfo
|
|
|
|
# Drizzle compiled config files
|
|
drizzle.config.js
|
|
drizzle.config.d.ts
|
|
drizzle.config.js.map
|
|
|
|
# Compiled JS in packages (src should be TS only)
|
|
packages/*/src/**/*.js
|
|
packages/*/src/**/*.js.map
|
|
packages/*/src/**/*.d.ts
|
|
|
|
# Cache
|
|
.cache/
|
|
.parcel-cache/
|
|
.eslintcache
|
|
.prettiercache
|
|
|
|
# Expo
|
|
*.jks
|
|
*.p8
|
|
*.p12
|
|
*.key
|
|
*.mobileprovision
|
|
*.orig.*
|
|
web-build/
|
|
|
|
# Native builds (keep for reference but don't track)
|
|
# Uncomment if you want to track these:
|
|
# !android/
|
|
# !ios/
|
|
|
|
# Sentry
|
|
.sentryclirc
|
|
|
|
# Temporary files
|
|
tmp/
|
|
temp/
|
|
*.tmp
|
|
|
|
# Package manager locks (keep only pnpm)
|
|
package-lock.json
|
|
yarn.lock
|
|
|
|
# Debug
|
|
.pnpm-debug.log
|
|
|
|
# Hive mind sessions
|
|
.hive-mind/
|
|
|
|
# Claude Flow metrics
|
|
.claude-flow/
|
|
.claude-flow/metrics/
|
|
|
|
# Mac Mini deployment
|
|
.env.macmini
|
|
ssh-key-command.txt
|
|
|
|
# Python
|
|
.venv/
|
|
__pycache__/
|
|
*.py[cod]
|
|
*$py.class
|
|
*.so
|
|
.Python
|
|
pip-log.txt
|
|
pip-delete-this-directory.txt
|
|
|
|
# ML Models (large files, downloaded on demand)
|
|
mlx_models/
|
|
services/mana-sync/server
|