dev_agent
67e44a506a
CI / ci (push) Successful in 1m45s
Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
81 lines
3.6 KiB
Bash
81 lines
3.6 KiB
Bash
# MealQuest production environment. Copy to deploy/.env (never committed)
|
|
# and replace the placeholders. The service fails fast: a missing or invalid
|
|
# required variable stops it at boot with the variable named.
|
|
#
|
|
# Secrets are never set here. They live in deploy/secrets/ (never committed),
|
|
# one value per file, owned by the container user and readable only by it:
|
|
#
|
|
# mkdir -p deploy/secrets && chmod 700 deploy/secrets
|
|
# head -c 32 /dev/urandom | base64 > deploy/secrets/secret_key
|
|
# printf '%s\n' '<Authentik client secret>' > deploy/secrets/oidc_client_secret
|
|
# sudo chown 10001:10001 deploy/secrets/* && sudo chmod 600 deploy/secrets/*
|
|
#
|
|
# deploy/compose.yaml mounts them at /run/secrets/<name> and points the
|
|
# *_FILE variables at them.
|
|
|
|
# --- Compose -----------------------------------------------------------------
|
|
|
|
# Host address the service is published on, as <address>:8090. Production
|
|
# binds the LAN address 10.60.1.14 only; 127.0.0.1 suits a dev machine.
|
|
MEALQUEST_BIND_ADDRESS=127.0.0.1
|
|
|
|
# --- Service -----------------------------------------------------------------
|
|
|
|
# Public origin the household opens. Fixes the OIDC redirect URI
|
|
# (<url>/auth/callback) and the Secure cookies. Must be https:// (plain
|
|
# http:// is accepted only for localhost, 127.0.0.1 and [::1]).
|
|
MEALQUEST_PUBLIC_URL=https://mealquest.cubecraftlabs.com
|
|
|
|
# How long a graceful shutdown may take before in-flight requests are cut.
|
|
MEALQUEST_SHUTDOWN_TIMEOUT=10s
|
|
|
|
# Optional. Comma-separated IPs/CIDRs of reverse proxies whose
|
|
# X-Forwarded-For/-Proto headers are honoured. Production lists Traefik;
|
|
# unset trusts no peer.
|
|
MEALQUEST_TRUSTED_PROXY=10.60.1.33
|
|
|
|
# IANA zone the household settings are created with on first boot. Required
|
|
# until those settings exist; ignored afterwards (change the zone in
|
|
# household settings instead). Confirm the household's zone before the first
|
|
# deploy.
|
|
MEALQUEST_DEFAULT_TZ=America/New_York
|
|
|
|
# --- Authentik OIDC ----------------------------------------------------------
|
|
|
|
# Issuer of the Authentik application "mealquest". Discovered at boot, so it
|
|
# must be reachable from the container. Must be https://.
|
|
MEALQUEST_OIDC_ISSUER=https://auth.cubecraftlabs.com/application/o/mealquest/
|
|
MEALQUEST_OIDC_CLIENT_ID=mealquest
|
|
# Comma-separated Authentik groups whose members may sign in.
|
|
MEALQUEST_OIDC_ALLOWED_GROUPS=mealquest-admin
|
|
|
|
# Optional session lifetimes. A session ends after IDLE unused and always MAX
|
|
# after sign-in; MAX must be at least IDLE. Defaults: 720h and 4320h.
|
|
MEALQUEST_SESSION_IDLE=720h
|
|
MEALQUEST_SESSION_MAX=4320h
|
|
|
|
# --- Set by deploy/compose.yaml; do not set here -----------------------------
|
|
#
|
|
# MEALQUEST_HTTP_ADDR=:8080
|
|
# MEALQUEST_DATA_DIR=/data
|
|
# MEALQUEST_SECRET_KEY_FILE=/run/secrets/secret_key
|
|
# Base64 of 32 random bytes; encrypts secrets at rest (AES-256-GCM).
|
|
# MEALQUEST_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
|
|
# The Authentik provider's client secret.
|
|
|
|
# --- Planned; not read by the service yet -------------------------------------
|
|
#
|
|
# Added to deploy/compose.yaml and this file by the features that use them.
|
|
#
|
|
# Web Push (Feature 19). Generate the key pair with cmd/vapidgen.
|
|
# MEALQUEST_VAPID_PUBLIC_KEY=<base64url VAPID public key>
|
|
# MEALQUEST_VAPID_PRIVATE_KEY_FILE=/run/secrets/vapid_private_key
|
|
# MEALQUEST_VAPID_SUBJECT=mailto:<owner address>
|
|
#
|
|
# Google Calendar OAuth web client (Feature 16).
|
|
# MEALQUEST_GOOGLE_CLIENT_ID=<client id>.apps.googleusercontent.com
|
|
# MEALQUEST_GOOGLE_CLIENT_SECRET_FILE=/run/secrets/google_client_secret
|
|
#
|
|
# SearXNG recipe search sidecar on the compose network (Feature 07).
|
|
# MEALQUEST_SEARXNG_URL=http://searxng:8080
|