All-In-One-Free-SEO-Tool/.env.example at main · IamRamgarhia/All-In-One-Free-SEO-Tool · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# Path to the SQLite file. Defaults to ./data.db when unset.
# SEO_DB_PATH=/var/lib/seo/data.db

# === Google integration (optional but highly recommended) ===
# When these are set, every user of this instance gets one-click
# "Sign in with Google" — no Google Cloud Console setup required from them.
# When unset, users are prompted to paste their own Client ID / Secret in
# Settings → Google instead.
#
# How to get these (one-time, ~5 min):
# 1. https://console.cloud.google.com/projectcreate
# 2. Enable: Search Console API, Analytics Data API, Analytics Admin API
# 3. https://console.cloud.google.com/apis/credentials/consent
#    - User Type: External; add yourself as Test User (good for ≤100 users
#      without verification — submit for verification when you outgrow it)
# 4. https://console.cloud.google.com/apis/credentials → Create OAuth client
#    - Type: Web application
#    - Authorized redirect URI: http://localhost:3000/api/google/callback
#      (replace with your real host when deployed)
# 5. Paste the Client ID + Secret below
#
# GOOGLE_OAUTH_CLIENT_ID=123-abc.apps.googleusercontent.com
# GOOGLE_OAUTH_CLIENT_SECRET=GOCSPX-...

# === Access control ===
# Two modes, and you only need one.
#
# 1. One shared password (the original, fine for one person):
#      APP_PASSWORD=something-long-you-will-remember
#
# 2. Real accounts (what an agency wants): leave APP_PASSWORD as it is,
#    open the app, and go to Settings → Team. Whoever registers first
#    becomes the owner and invites everyone else. Each person gets their
#    own login, a role, and access to only the clients they're assigned.
#    Accounts supersede APP_PASSWORD — once they exist, the shared
#    password no longer gets anyone in.
#
# Nothing to configure here for either. The two below are optional.

# Signs session cookies. Generated into .seo-session-secret on first boot
# if unset. Set it explicitly only if you run more than one replica —
# each would otherwise generate its own and reject the other's cookies.
# Losing it logs everyone out and nothing else; it is NOT the encryption
# key and no stored data depends on it.
# SEO_SESSION_SECRET=

# Force the Secure flag on the session cookie. Normally unnecessary —
# it's set automatically when the request arrives over HTTPS
# (x-forwarded-proto is honoured). Only needed if TLS terminates
# somewhere the app can't see. Do NOT set it on a plain-http LAN
# install: the browser would never send the cookie back, and the user
# would bounce off the login page forever.
# SEO_COOKIE_SECURE=1

# Allow the WordPress connection to point at a private address.
#
# By default the app refuses to call an endpoint on localhost, a LAN
# range (10.x, 192.168.x, 172.16-31.x) or link-local 169.254.x. That
# guard exists because the WordPress URL is stored in the database and
# gets fetched with your connection key in a header — pointed at
# http://169.254.169.254/ on a cloud VM, it would hand that key to the
# instance metadata service.
#
# Set this to 1 if your WordPress genuinely is on a private address:
# in the same docker compose stack, or on your own LAN. That is a normal
# self-hosted setup and is otherwise impossible to connect.
#
# Only turn it on if you control every address the app can be pointed
# at. On a machine where someone else can edit the client's WordPress
# URL, leave it off. Non-http protocols stay refused either way.
# SEO_ALLOW_PRIVATE_WP_ENDPOINT=1