Config Validation: 5 critical config issues found (stale Auth0, missing SMTP/SENDGRID/FRONTEND_URL, dead AUDIT_URL)

[vybe]

Automated Config Validation Report

Date: 2026-04-24
Result: 5 must-fix issues found across .env.example and docker-compose.prod.yml

---

Critical Findings (P1)

1. AUTH0_DOMAIN — Stale config with real credentials in public repo

• docker-compose.prod.yml:43 passes ${AUTH0_DOMAIN} (no default) to the backend
• docker-compose.prod.yml:97 hardcodes dev-10tz4lo7hcoijxav.us.auth0.com as a fallback default
• docker-compose.prod.yml:98 hardcodes bFeIEm4WAwaalgSnxsfS1V6vd4gOk0li (Auth0 client ID) as a fallback default
• Auth0 was removed on 2026-01-01 (architecture docs). These vars serve no purpose, and the hardcoded real domain/client ID in a public repo is a security concern.
• Fix: Remove all AUTH0_DOMAIN, VITE_AUTH0_* env vars and build args from docker-compose.prod.yml

2. AUDIT_URL — Documented but never used

• Present in .env.example as http://audit-logger:8001
• Not referenced in any backend Python file (confirmed with grep)
• Leftover from a removed audit-logger service
• Fix: Remove AUDIT_URL= from .env.example

3. FRONTEND_URL — Used in production but missing from .env.example

• src/backend/config.py:41 — required for OAuth post-auth redirects
• src/backend/services/ssh_service.py:475 — used for SSH host auto-detection
• docker-compose.prod.yml:57 — passed to backend
• Not in .env.example, so operators following the template silently break OAuth and SSH access
• Fix: Add FRONTEND_URL= to .env.example under SERVICE URLS with a note that it's required for production OAuth and SSH access

4. SMTP fields missing when EMAIL_PROVIDER=smtp is advertised

• .env.example lists smtp as a valid EMAIL_PROVIDER option but documents none of the required SMTP fields
• src/backend/config.py:49-52 reads SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD
• Users who configure EMAIL_PROVIDER=smtp get no guidance
• Fix: Add SMTP_HOST=, SMTP_PORT=587, SMTP_USER=, SMTP_PASSWORD= to the email section in .env.example

5. SENDGRID_API_KEY missing when EMAIL_PROVIDER=sendgrid is advertised

• .env.example lists sendgrid as a valid EMAIL_PROVIDER option
• src/backend/config.py:54 reads SENDGRID_API_KEY
• Key not documented despite being the credential required for that provider
• Fix: Add SENDGRID_API_KEY= to the email section in .env.example

---

Recommended Actions (in priority order)

1. Remove Auth0 stale config from docker-compose.prod.yml — both the env vars and the build args with hardcoded domain/client ID defaults
2. Remove AUDIT_URL from .env.example — dead reference to a removed service
3. Add FRONTEND_URL to .env.example — required for production OAuth and SSH access
4. Add SMTP fields and SENDGRID_API_KEY to .env.example — both email providers are advertised but their config is undocumented

---

Also Found (Informational — no deployment failure, but worth documenting)

• GOOGLE_API_KEY — in docker-compose but not .env.example (GEMINI_API_KEY already documented; GOOGLE_API_KEY is an alias)
• VOICE_ENABLED / VOICE_MODEL / VOICE_MAX_DURATION — voice feature with no .env.example entries
• SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD — SMTP provider fields (covered in must-fix fix: add missing logging_config.py to backend Dockerfile #4)
• SLACK_APP_TOKEN / SLACK_TRANSPORT_MODE — Slack Socket Mode config, undocumented
• OTEL_SAMPLE_RATE / OTEL_PROMETHEUS_ENDPOINT — OTel tuning vars not documented
• LOG_RETENTION_DAYS / LOG_ARCHIVE_ENABLED / LOG_CLEANUP_HOUR / LOG_ARCHIVE_PATH — log archival tuning in docker-compose but not .env.example
• Slack, GitHub, Notion OAuth vars present in prod compose but absent from local compose — local dev can't test OAuth flows without manual editing
• VITE_API_BASE used in HostTelemetry.vue but docker-compose sets VITE_API_URL — harmless (component falls back to '') but inconsistent naming

---

Generated by scheduled /validate-config run

[vybe]

Superseded by #530 (2026-04-27 run, 4 issues found).