Hello World DAO

Appearance

Checking access...

Environment Variables ​

NOTE (2026-04-09): PERSONA_API_KEY references below are outdated — Persona was disqualified as KYC provider. New provider: Didit. Environment variables will be updated when Didit integration is built.

NOTE (2026-04-11): VITE_AUTH_SERVICE_CANISTER_ID references below are deprecated. The auth-service canister was decommissioned on 2026-04-11 (AUTH-005.1). Authentication has migrated to PostgreSQL sessions in oracle-bridge. Suites validate sessions via HTTP cookies to oracle-bridge — no canister env var needed. Existing VITE_AUTH_SERVICE_CANISTER_ID entries are unused and will be removed in a future cleanup.

This document lists all environment variables used across the Hello World DAO LLC platform.

Frontend (React + Vite) ​

Located in frontend/app/www/:

  • .env - Base configuration
  • .env.local - Local overrides (gitignored)
  • .env.staging - Staging environment
  • .env.production - Production environment

Canister Configuration ​

VariableDescriptionExample
VITE_USER_SERVICE_CANISTER_IDUser service canister principalj4rvr-3aaaa-aaaao-qkvfq-cai
VITE_AUTH_SERVICE_CANISTER_IDDEPRECATED 2026-04-11 — auth-service decommissioned (AUTH-005.1). Sessions handled by oracle-bridge.(unused)
VITE_INTERNET_IDENTITY_CANISTER_IDInternet Identity canisterrdmx6-jaaaa-aaaaa-aaadq-cai
VITE_NETWORKTarget network (local | ic)ic

OAuth Configuration ​

VariableDescriptionWhere to Get
VITE_GOOGLE_CLIENT_IDGoogle OAuth client IDGoogle Cloud Console
VITE_GITHUB_CLIENT_IDGitHub OAuth client IDGitHub Developer Settings
VITE_GITHUB_CLIENT_SECRETGitHub OAuth client secretGitHub Developer Settings

Security Notes:

  • Client IDs are safe to expose (public)
  • Client Secrets in VITE_ variables are bundled into the app
  • Rotate credentials every 90 days
  • Use different credentials per environment

Oracle Bridge ​

VariableDescriptionDefault
VITE_ORACLE_BRIDGE_URLOracle bridge service URLhttp://localhost:8787
VITE_ORACLE_BRIDGE_API_TOKENAPI authentication token(empty for local)

Environment Values:

EnvironmentURL
Localhttp://localhost:8787
Staginghttps://staging-oracle.helloworlddao.com
Productionhttps://oracle.helloworlddao.com

Analytics ​

VariableDescriptionDefault
VITE_POSTHOG_API_KEYPostHog project key-
VITE_POSTHOG_API_HOSTPostHog API hosthttps://us.i.posthog.com

Cross-App Navigation (FOS-1.2.7) ​

VariableDescriptionDefault
VITE_THINK_TANK_URLURL for "Open Think Tank" navigationhttp://127.0.0.1:5174

Environment Values:

EnvironmentThink Tank URL
Localhttp://127.0.0.1:5174
Staginghttps://staging-think-tank.helloworlddao.com (TBD)
Productionhttps://think-tank.helloworlddao.com (TBD)

UI Configuration ​

VariableDescriptionOptions
VITE_DESIGN_VARIANTTheme variantsunrise, sunset, ocean, forest

Example .env.local ​

bash
# Local Development
VITE_USER_SERVICE_CANISTER_ID=uxrrr-q7777-77774-qaaaq-cai
VITE_AUTH_SERVICE_CANISTER_ID=lqy7q-dh777-77777-aaaaq-cai
VITE_INTERNET_IDENTITY_CANISTER_ID=rdmx6-jaaaa-aaaaa-aaadq-cai
VITE_NETWORK=local
VITE_ORACLE_BRIDGE_URL=http://localhost:8787
VITE_DESIGN_VARIANT=sunrise

think-tank-suite (React + Vite) ​

The productivity suite application (think-tank-suite/) shares authentication with the other DAO suites via cookie-based sessions issued by oracle-bridge.

Located in think-tank-suite/:

  • .env.local.example - Template with documentation
  • .env.local - Local overrides (gitignored)

Canister Configuration ​

VariableDescriptionExample
VITE_IC_HOSTIC replica URLhttp://127.0.0.1:4943
VITE_FOUNDERY_OS_CORE_CANISTER_IDProductivity data canisteruxrrr-q7777-77774-qaaaq-cai
VITE_ORACLE_BRIDGE_URLOracle bridge session APIhttp://localhost:8787

Cross-App Navigation (FOS-1.2.7) ​

VariableDescriptionDefault
VITE_DAO_FRONTEND_URLURL for "Back to DAO" navigationhttp://127.0.0.1:5173

Environment Values:

EnvironmentDAO Frontend URL
Localhttp://127.0.0.1:5173
Staginghttps://staging.helloworlddao.com
Productionhttps://www.helloworlddao.com

Example .env.local ​

bash
# Local Development
VITE_IC_HOST=http://127.0.0.1:4943
VITE_FOUNDERY_OS_CORE_CANISTER_ID=your-canister-id-here
VITE_ORACLE_BRIDGE_URL=http://localhost:8787
VITE_DAO_FRONTEND_URL=http://127.0.0.1:5173

Shared Authentication ​

think-tank-suite uses the same oracle-bridge session API as every other suite (cookie-based, PostgreSQL-backed). When users authenticate:

  1. Login credentials are POSTed to oracle-bridge /api/auth/login
  2. oracle-bridge validates against PostgreSQL and sets an HttpOnly session cookie scoped to .helloworlddao.com (production) or per-origin (local dev)
  3. ProtectedRoute validates the cookie via /api/auth/session on every navigation
  4. Expired sessions trigger a redirect to the login flow

Important (local dev): Cookie sharing across suites only works in production where every suite is on a *.helloworlddao.com subdomain. For local dev (different 127.0.0.1:port origins), users must log in to each application separately — same credentials, independent sessions.

Oracle Bridge (Node.js) ​

Located in oracle-bridge/:

  • .env.example - Template with documentation
  • .env - Actual configuration (gitignored)

Server Configuration ​

VariableDescriptionDefault
NODE_ENVEnvironment modeproduction
PORTHTTP server port8787

SMTP Configuration (Email) ​

VariableDescriptionExample
SMTP_HOSTSMTP server host127.0.0.1
SMTP_PORTSMTP server port1025
SMTP_USERSMTP usernameemail@domain.com
SMTP_PASSSMTP password(Proton Bridge password)
SMTP_FROM_NOREPLYNo-reply sender addressnoreply@domain.com
SMTP_FROM_CONTACTContact sender addresscontact@domain.com

Security Configuration ​

VariableDescriptionNotes
SIGNING_PRIVATE_KEY_BASE64Ed25519 signing keyBase64 encoded
API_KEYAPI authentication keyGenerate securely
CANISTER_PUBLIC_KEYSCanister signature verificationJSON map

Canister Public Keys Format:

json
{
  "rrkah-fqaaa-aaaaa-aaaaq-cai": "Ylx8BF+FVY7nZxE8TN3nPvLF8NJCz3qPxNBBmVMj2g0=",
  "user-service-id": "pubkey2",
  "membership-id": "pubkey3"
}

External API Keys ​

VariableDescriptionService
PERSONA_API_KEYKYC verificationPersona
COMPLYADVANTAGE_API_KEYAML screeningComplyAdvantage
CIRCLE_API_KEYPayment processingCircle

Rate Limiting ​

VariableDescriptionDefault
TEMP_KEY_RATE_LIMITMax temp key requests per 24h5

Recommended Values:

EnvironmentValue
Local/Dev100
Staging10
Production5

Example .env ​

bash
# Server
NODE_ENV=production
PORT=8787

# SMTP (Proton Mail Bridge)
SMTP_HOST=127.0.0.1
SMTP_PORT=1025
SMTP_USER=email@helloworlddao.com
SMTP_PASS=bridge-password-here
SMTP_FROM_NOREPLY=noreply@helloworlddao.com
SMTP_FROM_CONTACT=contact@helloworlddao.com

# Security
SIGNING_PRIVATE_KEY_BASE64=your-base64-private-key
API_KEY=your-secure-api-key

# Canister Auth
CANISTER_PUBLIC_KEYS={"user-service-id":"pubkey1"}

# External APIs
PERSONA_API_KEY=persona_live_xxx
COMPLYADVANTAGE_API_KEY=xxx
CIRCLE_API_KEY=xxx

# Rate Limiting
TEMP_KEY_RATE_LIMIT=5

notification-service (Node.js) ​

Located in notification-service/:

  • .env.example - Template with documentation
  • .env - Actual configuration (gitignored)

Port: 3100. Cluster: AX42-U founderyos namespace (k3s). Repo: Hello-World-Co-Op/notification-service.

Server Configuration ​

VariableDescriptionDefault
NODE_ENVEnvironment modeproduction
PORTHTTP server port3100
SERVICE_TOKENBearer token required by callers (validated by Traefik ForwardAuth in production)(set per env)

Resend (Email Provider) ​

VariableDescriptionNotes
RESEND_API_KEYResend API key — see ~/.config/cloudflare/... style memory entryWithout this, the service runs in stub mode — requests succeed but no real email is sent. Useful for local dev + CI.
RESEND_FROM_HWDAODAO sender addressnoreply@notifications.helloworlddao.com
RESEND_FROM_FOSFOS sender addressnoreply@notifications.founderyos.dev

Example .env ​

bash
NODE_ENV=development
PORT=3100
SERVICE_TOKEN=local-dev-token
# Leave RESEND_API_KEY unset for stub mode (no real email sent)

payment-gateway (Node.js) ​

Located in payment-gateway/:

  • .env.example - Template with documentation
  • .env - Actual configuration (gitignored)

Port: 3200. Cluster: AX42-U platform namespace (k3s). DB: Neon PostgreSQL (own project — not shared with oracle-bridge). Repo: Hello-World-Co-Op/payment-gateway.

Server Configuration ​

VariableDescriptionDefault
NODE_ENVEnvironment modeproduction
PORTHTTP server port3200
SERVICE_TOKENBearer token required by callers (validated by Traefik ForwardAuth in production)(set per env)
DATABASE_URLNeon Postgres connection string(set per env)

Provider Keys (filled in per PLATFORM-007 stories) ​

VariableDescriptionStory
STRIPE_SECRET_KEYStripe API keyPLATFORM-007.2
STRIPE_CONNECT_CLIENT_IDStripe Connect application IDPLATFORM-007.6
STRIPE_WEBHOOK_SECRETStripe webhook signing secretPLATFORM-007.2
ICP_LEDGER_CANISTER_IDICP/DOM ledger canisterPLATFORM-007.7

Tests run with no env vars (npm test). npm run dev requires SERVICE_TOKEN + DATABASE_URL.

Example .env ​

bash
NODE_ENV=development
PORT=3200
SERVICE_TOKEN=local-dev-token
DATABASE_URL=postgresql://user:pass@ep-...neon.tech/payment_gateway
# Provider keys per-story — see PLATFORM-007

GitHub Actions Secrets ​

Configure these in repository Settings → Secrets and variables → Actions:

Deployment Secrets ​

SecretDescriptionUsed By
DFX_IDENTITY_PEMdfx identity private keyAll canister deploys
DFX_IDENTITY_PRINCIPALdfx identity principalDeployment workflows
CYCLES_WALLET_IDCycles wallet canister IDCycles top-up

OAuth Secrets ​

SecretDescriptionFrontend Name
OAUTH_GOOGLE_CLIENT_IDGoogle OAuth IDVITE_GOOGLE_CLIENT_ID
OAUTH_GITHUB_CLIENT_IDGitHub OAuth IDVITE_GITHUB_CLIENT_ID
OAUTH_GITHUB_CLIENT_SECRETGitHub OAuth secretVITE_GITHUB_CLIENT_SECRET

Note: GitHub doesn't allow secrets starting with GITHUB_, so OAuth secrets use OAUTH_ prefix.

Oracle Bridge Secrets ​

SecretDescription
ORACLE_SIGNING_KEYEd25519 private key (base64)
ORACLE_API_KEYAPI authentication key
PERSONA_API_KEYPersona KYC API key

Analytics Secrets ​

SecretDescription
POSTHOG_API_KEYPostHog project key

dfx Configuration ​

Network settings are in ops-infra/dfx.networks.json:

json
{
  "local": {
    "bind": "127.0.0.1:4943",
    "type": "ephemeral"
  },
  "testnet": {
    "providers": ["https://ic0.app"]
  },
  "mainnet": {
    "providers": ["https://ic0.app"]
  }
}

Most canister repos symlink to this shared config.

Local Development Setup ​

1. Suite Setup (per suite) ​

bash
cd <repo-root>/<suite-name>     # e.g. dao-suite, marketing-suite, ...

# Copy example files
cp .env.example .env
cp .env.local.example .env.local

# Edit with your local canister IDs
nano .env.local

2. Oracle Bridge Setup ​

bash
cd <repo-root>/oracle-bridge

# Copy example file
cp .env.example .env

# Configure for local development
nano .env

Minimum local config:

bash
NODE_ENV=development
PORT=8787
TEMP_KEY_RATE_LIMIT=100
# Leave other fields empty for local dev

3. notification-service Setup (optional for local dev) ​

bash
cd <repo-root>/notification-service
cp .env.example .env
# Stub mode is fine — leave RESEND_API_KEY unset
npm install && npm run dev    # http://localhost:3100

4. payment-gateway Setup (optional for local dev) ​

bash
cd <repo-root>/payment-gateway
cp .env.example .env
# Set SERVICE_TOKEN + DATABASE_URL (Neon Postgres) to run dev mode
npm install && npm run dev    # http://localhost:3200

5. Get Local Canister IDs ​

After deploying canisters locally:

bash
# Get user-service canister ID
cd <repo-root>/user-service
dfx canister id user_service --network local

# Get membership canister ID
cd <repo-root>/membership
dfx canister id membership --network local

# Get foundery-os-core canister ID (when available)
cd <repo-root>/foundery-os-core
dfx canister id foundery_os_core --network local

Update each suite's .env.local files with these IDs.

Environment-Specific Values ​

Local Development ​

bash
VITE_NETWORK=local
VITE_ORACLE_BRIDGE_URL=http://localhost:8787
TEMP_KEY_RATE_LIMIT=100

Staging ​

bash
VITE_NETWORK=ic
VITE_ORACLE_BRIDGE_URL=https://staging-oracle.helloworlddao.com
TEMP_KEY_RATE_LIMIT=10

Production ​

bash
VITE_NETWORK=ic
VITE_ORACLE_BRIDGE_URL=https://oracle.helloworlddao.com
TEMP_KEY_RATE_LIMIT=5

Security Best Practices ​

  1. Never commit secrets - All .env files (except .example) are gitignored
  2. Use GitHub Secrets - Store production secrets in repository settings
  3. Rotate regularly - OAuth credentials every 90 days
  4. Environment separation - Different credentials per environment
  5. Minimal exposure - Only include secrets needed for each service

Troubleshooting ​

"Canister ID not found" ​

Ensure you've deployed canisters and updated .env.local:

bash
dfx canister id user_service --network local

"Network error" connecting to Oracle Bridge ​

  1. Verify oracle-bridge is running: npm run dev
  2. Check VITE_ORACLE_BRIDGE_URL matches the running port
  3. Ensure no firewall blocking localhost:8787

"OAuth login failed" ​

  1. Verify OAuth credentials in .env
  2. Check OAuth app redirect URIs match your development URL
  3. For GitHub, ensure correct scopes are configured

Hello World DAO

Copyright 2024-present