# See config/README.md for info on this config format.

env:

_env: <%=env == 'production' ? '' : "_#{env}"%>

_test_env_num: <%=env == 'test' ? ENV['TEST_ENV_NUMBER'] : '' %>

unit_test: <%=!!ENV['UNIT_TEST']%>

ci: <%=!!ENV['CI']%>

root_dir: <%=__dir__%>

name: <%=`hostname`.strip%>

rack_env: :<%=env%>

rack_envs:

- :development

- :production

- :adhoc

- :staging

- :test

- :levelbuilder

- :integration

#### Third-party API credentials / configuration

# OAuth provider credentials, used by Omniauth for authentication.

dashboard_facebook_key: !Secret

dashboard_facebook_secret: !Secret

dashboard_google_key: !Secret

dashboard_google_secret: !Secret

dashboard_microsoft_key: !Secret

dashboard_microsoft_secret: !Secret

dashboard_clever_key: !Secret

dashboard_clever_secret: !Secret

dashboard_classlink_key: !Secret

dashboard_classlink_secret: !Secret

# Recaptcha

recaptcha_site_key: !Secret

recaptcha_secret_key: !Secret

# Twilio

twilio_auth: !Secret

twilio_auth_test: !Secret

twilio_messaging_service: !Secret

twilio_phone_test_forward:

twilio_phone_test_to:

twilio_sid: !Secret

twilio_sid_test: !Secret

# Jotform

jotform_api_key: !Secret

jotform_min_dates:

jotform_forms:

academic_year_1:

day_1: 92125650301142

facilitator: 91372090131144

post_workshop: 92125916725157

academic_year_2:

day_1: 92125614667157

facilitator: 91372090131144

post_workshop: 92125916725157

academic_year_3:

day_1: 92125413150141

facilitator: 91372090131144

post_workshop: 92125916725157

academic_year_4:

day_1: 92125122319145

facilitator: 91372090131144

post_workshop: 92125916725157

academic_year_1_2:

day_1: 92125650301142

day_2: 92125614667157

facilitator: 91372090131144

post_workshop: 92125916725157

academic_year_3_4:

day_1: 92125413150141

day_2: 92125122319145

facilitator: 91372090131144

post_workshop: 92125916725157

virtual_1:

day_1: 92175136628158

facilitator: 92175282703154

post_workshop: 92174983603160

virtual_2:

day_1: 92175665906164

facilitator: 92175282703154

post_workshop: 92174983603160

virtual_3:

day_1: 92175784085164

facilitator: 92175282703154

post_workshop: 92174983603160

virtual_4:

day_1: 92175722303149

facilitator: 92175282703154

post_workshop: 92174983603160

virtual_5:

day_1: 92175483700154

facilitator: 92175282703154

post_workshop: 92174983603160

virtual_6:

day_1: 92175857756170

facilitator: 92175282703154

post_workshop: 92174983603160

virtual_7:

day_1: 92175683174161

facilitator: 92175282703154

post_workshop: 92174983603160

virtual_8:

day_1: 92175542003146

facilitator: 92175282703154

post_workshop: 92174983603160

local:

day_0: 81307473693159

day_1: 81236323593153

day_2: 81368536787170

day_3: 81368909887175

day_4: 81368069687170

day_5: 81495142793161

facilitator: 81276605393158

local_summer:

day_0: 90986490369171

day_1: 90986506471163

day_2: 90986458251165

day_3: 90986477669179

day_4: 90986953273169

day_5: 90986517815167

facilitator: 91372090131144

post_course:

2018-2019: 90486182774164

csf:

pre201: 90066184161150

post201: 90065524560150

facilitator: 91405279991164

# HubSpot

hubspot_portal_id: !Secret

hubspot_admin_interest_form_id: !Secret

# PagerDuty

pagerduty_token: !Secret

# Pardot

pardot_password:

pardot_user_key:

pardot_username:

pardot_private_key:

pardot_client_id:

pardot_client_secret:

# Honeybadger

honeybadger_api_token:

cronjobs_honeybadger_api_key: !Secret

dashboard_honeybadger_api_key: !Secret

pegasus_honeybadger_api_key: !Secret

# Zendesk

zendesk_dev_token: !Secret

# Webpurify

webpurify_api_endpoint: https://api1.webpurify.com/services/rest

webpurify_key: !Secret

# Github

github_access_token: !Secret

github_webhook_secret:

# Google API credentials (various)

google_maps_client_id: !Secret

google_maps_api_key:

google_maps_secret: !Secret

ga_account: !Secret

ga_profile_id: !Secret

google_safe_browsing_key: !Secret

gdrive_export_secret: !Secret

# Mapbox

mapbox_upload_token:

mapbox_access_token: !Secret

# Crowdin

crowdin_codeorg_api_key:

crowdin_projects:

codeorg:

id: 26074

source_language: 'enus'

hour-of-code:

id: 55536

source_language: 'en'

codeorg-markdown:

id: 314545

source_language: 'en'

codeorg-restricted:

id: 464582

source_language: 'en'

codeorg-testing:

id: 346087

source_language: 'en'

codeorg-markdown-testing:

id: 547997

source_language: 'en'

hour-of-code-test:

id: 634038

source_language: 'en'

codeorg-restricted-test:

id: 634320

source_language: 'en'

crowdin_project_test_mapping:

codeorg: codeorg-testing

codeorg-markdown: codeorg-markdown-testing

codeorg-restricted: codeorg-restricted-test

hour-of-code: hour-of-code-test

# Azure AI Content Safety

azure_ai_content_safety_endpoint: https://cdo-ai-content-safety.cognitiveservices.azure.com

azure_ai_content_safety_key: !Secret

# Credentials for SauceLabs.com, used for running selenium tests against

# multiple browsers

saucelabs_username:

saucelabs_authkey:

saucelabs_tunnel_name:

# Credentials for AWS Device Farm, used as an alternative to SauceLabs for

# running selenium tests against multiple browsers.

# device_farm_desktop_project_arn is the ARN of a Desktop Browser Testing project,

# created via the AWS Device Farm console or CLI.

device_farm_desktop_project_arn:

# device_farm_mobile_project_arn is the ARN of a Mobile Device Testing project,

# used for running mobile browser tests (iPhone, iPad, etc.).

device_farm_mobile_project_arn:

# Credentials for applitools.com, used for running automated visual tests

applitools_eyes_api_key: !Secret

applitools_eyes_api_key_view:

# Slack API credentials

slack_set_last_dtt_green_token:

slack_start_build_token:

slack_endpoint: !Secret

slack_token: !Secret

slack_bot_token: !Secret

slack_log_room: <%=env%>

hip_chat_logging: false

# Azure keys for speech service

azure_speech_service_key: !Secret

azure_speech_service_region: !Secret

# Configuration Options for Pusher.com integration

# Optional for most devs, very useful if working on Internet Simulator

use_pusher: false

pusher_app_id: !Secret

pusher_application_key: !Secret

pusher_application_secret: !Secret

# Configuration options for Acapela-Group.com integration

use_acapela:

acapela_login:

acapela_storage_app:

acapela_storage_password:

acapela_ephemeral_app:

acapela_ephemeral_password:

# Credentials for new relic logging. Used to log apps build times.

new_relic_license_key:

newrelic_logging: false

# Enables OpenTelemetry instrumentation and exporting to the OpenTelemetry Collector. See `dashboard/engines/observability/` for more details.

enable_opentelemetry: false

# Sentry trace and error reporting.

enable_sentry: false

# DSN for the Dashboard Rails backend Sentry project.

dashboard_sentry_dsn: !Secret

# DSN for the apps/ webpack bundle Sentry project.

frontend_apps_sentry_dsn: !Secret

# DSN for the frontend/apps/studio Vite app Sentry project.

frontend_studio_sentry_dsn: !Secret

# Credentials for Google-federated AWS access.

# (Deprecated: move these configuration values to AWS config file)

aws_role:

google_client_id:

google_client_secret:

# Default AWS region for the application.

aws_region: us-east-1

# Override the endpoint used for S3, typically to point to an emulated local

# instance of the service; LocalStack, MinIO, etc. Particularly useful for

# developers without AWS credentials; see `/docker/developers` for more,

# particularly `docker-compose.minio.yml`

aws_s3_endpoint:

aws_s3_access_key_id:

aws_s3_secret_access_key:

aws_s3_emulated: false

# Amazon Future Engineer integration

afe_pardot_form_handler_url:

csta_jotform_api_key: !Secret

csta_jotform_form_id: !Secret

### Service configurations (urls, endpoints, etc)

freegeoip_host:

solr_server: localhost

# S3 bucket and (environment-specific) path-prefix configuration

assets_bucket: cdo-dist

assets_bucket_prefix: <%=env%>

files_s3_bucket: cdo-v3-files

files_s3_directory: files<%=_env%>

animations_s3_bucket: cdo-v3-animations

animations_s3_directory: animations<%=_env%>

assets_s3_bucket: cdo-v3-assets

assets_s3_directory: assets<%=_env%>

sources_s3_bucket: cdo-v3-sources

sources_s3_directory: sources<%=_env%>

libraries_s3_bucket: cdo-v3-libraries

libraries_s3_directory: libraries<%=_env%>

videos_s3_bucket: videos.code.org

videos_url: //videos.code.org

# Dashboard Redis instance (uses ElastiCache on prod)

#

# Please use the CDO.redis_url instance for all your dashboard Redis needs, just use

# a redis key prefix for new namespacing. Do not introduce new Redis instances unless

# you have a specific technical need for why this can't simply be on the main instance.

redis_url: redis://localhost:6379/0

# SESSION_STORE_MIGRATION_DELETE_ME

# We are migrating from session_store to redis. Its the same definitions, but with a new

# name to reflect that multiple dashboard features will be using the same instance.

#

# We expect the migration to be complete after November 2025, at which point we can remove

# this component (and delete session_store.yml.erb)

old_session_store_server:

# Memcached (ElastiCache)

memcached_endpoint:

memcached_hosts:

# Netsim

netsim_redis_groups:

netsim_enable_metrics: false

netsim_max_routers: 20

netsim_shard_expiry_seconds: 7200

# DynamoDB table names for dcdo/gatekeeper

dcdo_table_name: dcdo_<%=env%>

gatekeeper_table_name: gatekeeper_<%=env%>

# Allows DCDO settings via cookies. See: `Rack::CookieDCDO`

use_cookie_dcdo: false

# Allows Geolocation to be altered via cookies.

# See: 'lib/cdo/rack/geolocation_override.rb'

# and: 'dashboard/test/ui/features/xteam/gdpr_dialog.feature'

use_geolocation_override: false

# Poste (internal transactional email processing framework)

poste_host: '<%= code_org_url.sub('//', '') %>'

poste_attachment_dir:

poste_smtp_password: !Secret

poste_smtp_server: email-smtp.us-east-1.amazonaws.com

poste_smtp_user: !Secret

poste_secret: !Secret

# Chef defaults

chef_managed: false

chef_local_mode: false

chef_node_name: cdo-ci

chef_org_name: code-dot-org

chef_client_key: <%="#{ENV['HOME']}/.chef/#{chef_node_name}.pem"%>

chef_validation_client_name: <%="#{chef_org_name}-validator"%>

chef_validation_key: <%="#{ENV['HOME']}/.chef/#{chef_validation_client_name}.pem"%>

chef_server_url: '<%="https://code-org.saas.chef.io/organizations/#{chef_org_name}"%>'

# Cloudfront keys for private content

cloudfront_key_pair_id: !Secret

cloudfront_private_key: !Secret

# Discourse configuration

discourse_sso_secret:

### Application configuration defaults

# Installs bin/i18n dependencies

build_i18n: false

i18n_backend:

cache:

app_servers: {}

rack_mini_profiler_enabled:

https_development:

default_scheme: '<%=(env == 'development') || ci ? 'http:' : 'https:'%>'

allowed_iframe_ancestors: 'https://*.schoology.com http://*.disney.com http://*.diznee.net cuantrix.mx <%=pegasus_site_host%> <%=dashboard_site_host%> curriculum.code.org https://*.iap.lausd.net'

skip_locales:

secret_pictures_csv:

no_https_store:

pd_teacher_application_list_secret_key:

# Configure CloudFront to serve static, custom, student-friendly page when web application returns error HTTP response.

custom_error_response: true

# Whether rake:build should rebuild the apps package

build_apps: false

# Whether rake:build should rebuild the studio package

build_studio: false

# Whether dashboard should use your local build of the apps package.

# If false, dashboard will try to use a prepackaged version from S3.

use_my_apps:

# Whether dashboard should use your local build of the studio package.

# If false, dashboard will try to use a prepackaged version from S3.

use_my_studio:

optimize_webpack_assets: true

optimize_rails_assets: true

# Improves local environment load time by loading only the i18n data for the current locale.

# Note: Not intended for production use.

lazy_load_i18n: false

# Whether to skip the slow `rake seed:all` command during `rake build`.

# Until you manually run `rake seed:all` or disable this flag, you won't

# see changes to: videos, concepts, levels, scripts, trophies, prize providers,

# callouts, hints, secret words, or secret pictures.

skip_seed_all:

# Whether to store sprocket asset cache on disk or in memory. Setting this to

# false reduces memory usage, but significantly slows down dev server startup.

cache_assets_in_memory:

# Encryption key required for decoding certain protected level sources.

# Contributors should ask a Code.org engineer for this if needed.

properties_encryption_key: !Secret

ignore_eyes_mismatches:

# Keeps from taking eyes snapshots when running feature files

disable_all_eyes_running:

build_dashboard: true

build_pegasus: true

# Dashboard

override_dashboard:

dashboard_devise_secret: !Secret

dashboard_devise_pepper: !Secret

dashboard_secret_key_base: !Secret

dashboard_host: 0.0.0.0

dashboard_port: 3000

dashboard_workers:

dashboard_web_server_name: dashboard

dashboard_sock:

puma_control_server_relative_socket_path: tmp/pumactl.sock

puma_control_server_token: !Secret

# Session timeout in days. Controls both the Devise timeout and the Rails session store (Redis) TTL.

dashboard_session_ttl_days: 40

# Pegasus

override_pegasus: 'code.org' # All deployments link to the production corporate site, now that Pegasus is deprecated.

pegasus_hostname: 'code.org'

pegasus_host:

pegasus_sock:

pegasus_port:

pegasus_web_server_name: pegasus

pegasus_workers: 8

sinatra_session_secret:

# Configures Pegasus `settings.read_only`, which affects some (legacy) routes. Not actively used(?)

read_only: false

proxy: false # If true, generated URLs will not include explicit port numbers in development

# Run dashboard-server with the level editing interface enabled (for admins)

levelbuilder_mode:

# Use different color header for local environment than the one on production to

# make it easier to tell the difference

use_local_header_color:

default_hoc_mode: false # overridden by 'hoc_mode' DCDO param, except in :test

# teacher_application_mode values: 'open', 'closing-soon', 'closed'

default_teacher_application_mode: 'closed' # overridden by 'teacher_application_mode' DCDO param, except in :test

default_courses_show_ai: false # overridden by 'courses_show_ai' DCDO param, except in :test

partners: []

# Default Rack server ports for PDF-generation scripts.

pdf_port_collate: 8081

pdf_port_markdown: 8081

# Specify `use_mailcatcher: true` if you are running mailcatcher on localhost.

# You should have also run this once:

# `gem install mailcatcher`

# And this each time you need to start mailcatcher in the background again:

# `mailcatcher --ip=0.0.0.0`

use_mailcatcher:

lint: false

# Whether to stub schools and school_districts table with much smaller data,

# saving a total of 4 min 30 sec during rake seed. Default: true (in development).

stub_school_data: false

disable_s3_image_uploads: false

channels_api_secret: !Secret

daemon: <%=name == 'production-daemon'%>

image_optim: <%=chef_managed && running_web_application?%>

# Used to export data on professional learning to gsheets

enrollments_summer_2020_gsheet_key:

csf_workshop_attendance_gsheet_key: !Secret

applications_gsheet_key:

eir_teacher_enrollments_gsheet_key: !Secret

# Referenced in Chef config, but not sure if they are still used anywhere?

# TODO: verify these are intentionally no longer used and remove references from Chef config.

build_blockly: false

browserstack_username:

browserstack_authkey:

x-dashboard_twitter_key:

x-dashboard_twitter_secret:

ga_service_account_email:

ga_api_key:

ga_api_secret:

hipchat_secret:

indiegogo_api_token:

localize_blockly: true

level_builder_port: 8082

sendy_db_reader:

sendy_db_writer:

developers_channel_id:

twilio_phone:

discourse_sso_url:

discourse_url:

pledge_map_table_id:

# SESSION_STORE_MIGRATION_DELETE_ME

#

# TODO: we no longer use these, but they are still being injected into globals.yml by chef.

# To remove them, we need to figure out where chef is getting the values from.

geocoder_read_replica_1:

geocoder_read_replica_2:

geocoder_redis_url:

level_sources_redis_url:

redis_primary:

redis_read_addresses:

redis_read_ports:

session_store_server:

#### Parameters related to CloudFormation-stack deployment

stack_name: <%=env%>

cdn_enabled: <%=chef_managed%>

# Application-stack parameters.

instance_type:

branch:

database_username:

## Redshift

redshift_cluster_id:

# Legacy Redshift configuration (for connecting with a SQL client via the `pg` gem).

redshift_host:

redshift_username:

redshift_password:

### Database configuration

devinternal_db_writer: !Secret

# Until we have a better configuration setting service, use AWS Secrets Manager to store these non-secret values.

db_cluster_id: !StackSecret

db_endpoint_writer: !StackSecret

db_endpoint_writer_port: !StackSecret

db_endpoint_proxy_writer: !StackSecret

db_endpoint_proxy_writer_port: !StackSecret

db_endpoint_proxy_reader: !StackSecret

db_endpoint_proxy_reader_port: !StackSecret

db_endpoint_proxy_reporting: !StackSecret

db_endpoint_proxy_reporting_port: !StackSecret

# Database credentials (username & password) are stored in an AWS Secret in a JSON format required by RDS Proxy:

# https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-setup.html#rds-proxy-secrets-arns

db_credential_admin: !StackSecret

db_credential_writer: !StackSecret

db_credential_reader: !StackSecret

# mysql:// URI (including credentials) to connect to ProxySQL administrative interface (which emulates a MySQL server)

db_proxy_admin:

db_writer: !Secret

dashboard_db_name: <%= "dashboard_#{env}#{_test_env_num}" %>

pegasus_db_name: <%= ENV['USE_PEGASUS_UNITTEST_DB'] ? 'pegasus_unittest' : "pegasus#{_env}" %>

# Default reader endpoints to writer endpoint.

db_reader: <%=db_writer%>

# Default DB-specific endpoints to base endpoint plus db name.

dashboard_db_reader: '<%="#{db_reader}#{dashboard_db_name}"%>'

dashboard_db_writer: '<%="#{db_writer}#{dashboard_db_name}"%>'

pegasus_db_reader: '<%="#{db_reader}#{pegasus_db_name}"%>'

pegasus_db_writer: '<%="#{db_writer}#{pegasus_db_name}"%>'

# Configurations for making calls to the Immersive Reader API on Azure

imm_reader_tenant_id: '01521c57-6696-4ac9-b8ba-d2f2955893bd'

imm_reader_client_id:

imm_reader_client_secret: !Secret

imm_reader_subdomain: cdo-immersive-reader-<%=env%>

javabuilder_private_key: !Secret

javabuilder_key_password: !Secret

# Credentials for the Spotify API, used to provide playlist data in App Labs

spotify_api_client_id: !Secret

spotify_api_client_secret: !Secret

# Credentials for the Open Weather API, used to provide weather data in App Labs

open_weather_api_key: !Secret

# Local Javabuilder configuration. Set 'use_localhost_javabuilder: true' to point to

# your Javabuilder WebSocket server running on localhost.

# Set 'local_javabuilder_stack_name: "your stack name"' to point to a deployed development

# instance of Javabuilder. This will likely be 'javabuilder-adhoc-your_branch_name'

use_localhost_javabuilder:

local_javabuilder_stack_name:

# API Key for doublethedonation.com

ddconf_api_key: !Secret

# JSON Web Key Set and private key data

jwks_data:

keys:

- kty: "RSA"

n: "o-pwMF3Hf7iy_Rev-XEf4aPxCYxYiOevIXZVrQuQPVU8JE80XcNlrq8az8c3afp4G79nAVRWDxWTsYQXTNnr-HEBBklO_w5M-h6wIgMCnA9VDJtATgIlqNJ5hIQ37U_1Mmw3oLYJVXaKhkjD-GNFTF0r6rKjeAOp4sWoKTn83r2Tyi8ZGM2l3IQ9NYsurFrAT7DALu01V5EsM_sdBezc6r-LkGyTkIQqS4qDV7qesJE9cUe2FVXfnedWLeYBCsq-tIh50XVMB1FMFa97kN3UfS3rigQYAq-LkDc3e7rHB0DqduHJNZKiHBoYOra484N4nmDYj-cSoBkDzhyu84ni4w"

e: "AQAB"

use: "sig"

alg: "RS256"

kid: "yNt3MOdUenNV_bn6IKboK2d8iJBL2hDJ_RoMhUtO33Q"

jwk_private_key_data: !Secret

# Credentials for OpenAI API

openai_evaluate_rubric_api_key: !Secret

openai_student_learning_api_key: !Secret

openai_measures_of_learning_api_key: !Secret

openai_lesson_summaries_api_key: !Secret

elevenlabs_api_key: !Secret

# Credentials for Langfuse API

tutor_langfuse_secret_key: !Secret

tutor_langfuse_public_key: !Secret

ta_langfuse_secret_key: !Secret

ta_langfuse_public_key: !Secret

# Credentials for Google Gemini API

google_gemini_ai_chat_lab_api_key: !Secret

google_gemini_ai_tutor_api_key: !Secret

# AI Gateway

ai_gateway_auth_key: !Secret

ai_gateway_auth_public_key: !Secret

ai_gateway_auth_key_passphrase: !Secret

# Credentials for Google Vertex API

google_vertex_ai_tutor_service_account_key: !Secret

google_vertex_ai_chat_service_account_key: !Secret

# AI Proxy for OpenAI API

ai_proxy_origin: https://aiproxy-test.code.org

# Statsig API keys

# These are dummy values for all environments except Production and our managed

# Test web application server, which are overridden in production.yml.erb

# and test.yml.erb. The Statsig SDK expects the prefixed key type (secret-) in

# the string, otherwise it will throw an error on initialization, even in

# local_mode.

statsig_server_secret_key: 'secret-fake-key'

statsig_api_client_key: 'client-fake-key'

statsig_api_client_key_session_replay: 'client-fake-key'

# MailGun/MailJet API keys

mailjet_api_key:

mailjet_secret_key:

mailgun_api_key:

### ActiveJob configuration

# ActiveJob queues

active_job_queues:

:default: :default

:mailers: :mailers

:mailjet: :mailjet

# ActiveJob Queue Adapter

active_job_queue_adapter: :delayed_job

# Number of workers to start when running `rake build:start_active_job_workers`:

active_job_backend_n_workers_to_start: 10

active_job_backend_rolling_restart_in_n_batches: 2

# aiproxy credentials

aiproxy_api_key: !Secret

# CDO Contentful engine configs for Marketing space

contentful_space_id: "90t6bu6vlf76"

contentful_api_key: !Secret

contentful_hostname: cdn.contentful.com

# CDO Contentful engine configs for CSforALL space

contentful_cs_for_all_access_token: !Secret

contentful_cs_for_all_space: 27jkibac934d

contentful_cs_for_all_namespace: master

contentful_cs_for_all_api_url: preview.contentful.com

# HoC/HoAI tracking configuration. See `dashboard/engines/hoc_legacy`

hoc_tracking_enabled: true

# Demo student IDs and adhoc curriculum overrides for demo sections.

# Curriculum override hashes are keyed by demo type.

# See Policies::DemoSections for usage.

demo_student_ids:

demo_section_units:

demo_section_unit_groups:

# Dummy course for attaching resources to just-in-time PL content

jit_pl_course_name: 'just-in-time-pl'