[codex] remove ngrok tunnel support

README.md

@@ -33,7 +33,7 @@ https://github.com/user-attachments/assets/ba7b91b9-1984-49f2-afc6-7fcda1100b31
 - Command palette
 - Event tagging, resizing, duplicating, reordering
 - Drag & drop
-- 2-way sync with Google Calendar (hosted or local via Ngrok)
+- 2-way sync with Google Calendar
 - Google OAuth authentication
 - User session management with Supertokens
 - Email capture via Kit

docs/architecture/repo-architecture.md

@@ -105,7 +105,6 @@ The web talks to the backend through:
 3. register HTTP routes (SSE is opened per authenticated `GET /api/events/stream`)
 4. start Mongo
 5. listen on the configured port
-6. optionally connect ngrok
 
 ## Main Architectural Patterns
 

docs/development/deploy.md

@@ -39,7 +39,7 @@ bun run build:backend --environment staging
 
 The backend build uses `Bun.build()` to produce a single bundled file at `build/backend/app.js`,
 alongside a `.env` file copied from the selected environment and a minimal `node_modules/`
-containing only the required native modules (`saslprep`, `@ngrok/ngrok`).
+containing only required native modules such as `saslprep`.
 
 Runtime entrypoint:
 
@@ -51,6 +51,6 @@ Bun loads `.env` from the working directory, so `cd` into the build dir before r
 
 Deployment notes:
 
-- backend requires MongoDB, SuperTokens, and Google credentials
+- backend requires MongoDB and SuperTokens; Google credentials are optional and only needed for Google auth and Google Calendar sync
 - if you run behind a reverse proxy, configure buffering/timeouts for long-lived `text/event-stream` responses (SSE)
-- ngrok is only relevant for local watch/debug flows, not normal hosted deploys
+- Google Calendar webhook notifications require `BASEURL` to be a public HTTPS API URL

docs/development/local-development.md

@@ -61,22 +61,24 @@ Important variables:
 - `BASEURL`
 - `PORT`
 - `MONGO_URI`
-- `GOOGLE_CLIENT_ID`
-- `GOOGLE_CLIENT_SECRET`
 - `SUPERTOKENS_URI`
 - `SUPERTOKENS_KEY`
-- `TOKEN_GCAL_NOTIFICATION`
 - `TOKEN_COMPASS_SYNC`
 - `FRONTEND_URL`
 - `CORS` (parsed into `ENV.ORIGINS_ALLOWED`)
 
 Optional but behavior-changing:
 
-- `NGROK_AUTHTOKEN`
-- `NGROK_DOMAIN`
+- `GOOGLE_CLIENT_ID`
+- `GOOGLE_CLIENT_SECRET`
+- `TOKEN_GCAL_NOTIFICATION`
 - `EMAILER_API_SECRET`
 - `EMAILER_USER_TAG_ID`
 
+Google is disabled unless both `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`
+are set. When Google is enabled and `BASEURL` uses HTTPS,
+`TOKEN_GCAL_NOTIFICATION` is required for Google Calendar webhook validation.
+
 Derived backend values:
 
 - `DB` is not supplied directly; backend derives it from `NODE_ENV`
@@ -106,11 +108,13 @@ Source:
 Important variables:
 
 - `API_BASEURL`
-- `GOOGLE_CLIENT_ID`
 - `NODE_ENV`
 - `POSTHOG_KEY`
 - `POSTHOG_HOST`
 
+`GOOGLE_CLIENT_ID` is optional. When it is missing, the web app hides Google
+sign-in and Google Calendar connection actions.
+
 `BACKEND_BASEURL` is derived from `API_BASEURL`.
 
 Webpack behavior (`packages/web/webpack.config.mjs`):
@@ -167,15 +171,19 @@ Compass supports both:
 
 When testing changes around event loading, explicitly decide which user state you are modeling.
 
-## Ngrok Notes
+## Google Calendar Webhook Notes
 
-Ngrok is optional for general local development but relevant for Google notification/watch flows. The backend env schema requires both ngrok auth token and static domain together if ngrok is enabled.
+Compass does not start a local tunnel automatically. Google Calendar webhook
+watch flows use `BASEURL` directly. If `BASEURL` is not a publicly routable
+HTTPS URL, Google sign-in, Google Calendar connect, and initial import can
+still work, but live Google-to-Compass notifications are skipped because the
+base URL is not public HTTPS.
 
 ## Common Failure Modes
 
 - backend exits immediately because required env is missing
 - backend/web/cli read from `.env.local`; using `.env` instead leaves required variables unset
 - web points at the wrong API base URL
 - session exists but user profile fetch fails
-- sync endpoints work but notification/watch setup fails due to incomplete Google/ngrok setup
+- sync endpoints work but notification/watch setup is skipped because `BASEURL` is not public HTTPS
 - backend starts but `/api/health` returns `500` because `MONGO_URI` or database reachability is broken

docs/self-hosting.md

@@ -82,7 +82,7 @@ Available commands:
 
 A few settings become part of the web app when it is built, so editing them in `~/compass/.env` has no effect until you rebuild. This includes:
 
-- Google OAuth client values (`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`)
+- Optional Google OAuth client values (`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`)
 - `FRONTEND_URL`
 - `BASEURL`
 
@@ -117,7 +117,7 @@ Only the web app and backend are reachable from your browser, and only at `local
 
 ### Google Calendar Sync
 
-Google auth and Google Calendar sync are **not** configured by the local installer. Because the backend currently requires Google environment variables to start, the installer writes placeholder values so Compass can boot.
+Google auth and Google Calendar sync are **not** configured by the local installer. Compass runs in password-only mode unless you provide Google OAuth credentials.
 
 You can add your own Google OAuth client values to `~/compass/.env` and run `./compass rebuild` to try Google sign-in and the Google Calendar connect flow. However, keeping Compass continuously in sync with Google Calendar, so new or changed Google events appear automatically, requires an HTTPS backend that is reachable from the public internet. The local installer does not set that up. For that, see [Running On A Server](#running-on-a-server).
 
@@ -174,7 +174,7 @@ Compass is a web app and a backend API. In manual setup, you provide the runtime
 
 - A **Google Cloud project**, only if you want Google auth or to connect Google Calendar.
 
-The backend currently requires Google environment variables to start, even if you do not plan to use Google. Either provide real credentials from a Google Cloud project, or use placeholder strings until you set one up. Ongoing Google Calendar watch notifications need an HTTPS, publicly reachable backend, which manual local setup does not provide.
+Leave Google credentials unset for password-only mode. If you provide Google credentials, provide both the client ID and client secret. Ongoing Google Calendar watch notifications need an HTTPS, publicly reachable backend, which manual local setup does not provide.
 
 ### Manual Steps
 
@@ -201,7 +201,7 @@ The backend currently requires Google environment variables to start, even if yo
 
    - `MONGO_URI` for your MongoDB.
    - SuperTokens values for your managed SuperTokens instance or self-hosted Core. If you self-host Core, connect it to Postgres.
-   - Google credentials (`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`). Use real credentials if you have a Google Cloud project, or placeholders until you do.
+   - Optional Google credentials (`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`) if you want Google sign-in and Google Calendar sync. Leave both unset for password-only self-hosted mode.
 
    For the full list and what each variable does, see [Local Development](./development/local-development.md).
 

e2e/utils/oauth-test-utils.ts

@@ -38,6 +38,14 @@ export const prepareOAuthTestPage = async (page: Page) => {
       });
     }
 
+    if (url.includes("/config")) {
+      return route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ google: { isConfigured: true } }),
+      });
+    }
+
     // Mock all other API calls
     return route.fulfill({
       status: 200,

jest.config.js

@@ -12,6 +12,7 @@ const backendProject = {
     "^@backend/auth(/(.*)$)?": "<rootDir>/packages/backend/src/auth/$1",
     "^@backend/calendar(/(.*)$)?": "<rootDir>/packages/backend/src/calendar/$1",
     "^@backend/common(/(.*)$)?": "<rootDir>/packages/backend/src/common/$1",
+    "^@backend/config(/(.*)$)?": "<rootDir>/packages/backend/src/config/$1",
     "^@backend/dev(/(.*)$)?": "<rootDir>/packages/backend/src/dev/$1",
     "^@backend/email(/(.*)$)?": "<rootDir>/packages/backend/src/email/$1",
     "^@backend/events(/(.*)$)?": "<rootDir>/packages/backend/src/events/$1",