dev_agentandClaude Opus 5.5
89574333e8
By owner directive (2026-10-08), all runbook information lives in the CTXD project mealquest, file RUNBOOKS.MD, never in the repository. Delete deploy/RUNBOOK.md, whose content is merged into that CTXD file, and point the comments in deploy/.env.example, deploy/compose.yaml and deploy/systemd/mealquest-media-backup.sh at RUNBOOKS.MD instead. Maestro task e81ed994-a510-48e6-9cf6-e76d5d81f56c. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
95 lines
4.5 KiB
Bash
95 lines
4.5 KiB
Bash
# MealQuest production environment. Copy to deploy/.env (never committed)
|
|
# and replace the placeholders. The service fails fast: a missing or invalid
|
|
# required variable stops it at boot with the variable named.
|
|
#
|
|
# Secrets are never set here. They live in deploy/secrets/ (never committed),
|
|
# one value per file, owned by the container user and readable only by it:
|
|
#
|
|
# mkdir -p deploy/secrets && chmod 700 deploy/secrets
|
|
# head -c 32 /dev/urandom | base64 > deploy/secrets/secret_key
|
|
# printf '%s\n' '<Authentik client secret>' > deploy/secrets/oidc_client_secret
|
|
# printf '%s\n' '<Google OAuth client secret>' > deploy/secrets/google_client_secret
|
|
# sudo chown 10001:10001 deploy/secrets/* && sudo chmod 600 deploy/secrets/*
|
|
#
|
|
# SearXNG's secret key is the exception: compose reads it itself, so it
|
|
# stays owned by you (mode 0600). Create it after the chown above:
|
|
#
|
|
# (umask 077; printf 'SEARXNG_SECRET=%s\n' "$(openssl rand -hex 32)" > deploy/secrets/searxng.env)
|
|
#
|
|
# deploy/compose.yaml mounts them at /run/secrets/<name> and points the
|
|
# *_FILE variables at them.
|
|
|
|
# --- Compose -----------------------------------------------------------------
|
|
|
|
# Host address the service is published on, as <address>:8090. Production
|
|
# binds the LAN address 10.60.1.14 only; 127.0.0.1 suits a dev machine.
|
|
MEALQUEST_BIND_ADDRESS=127.0.0.1
|
|
|
|
# --- Service -----------------------------------------------------------------
|
|
|
|
# Public origin the household opens. Fixes the OIDC redirect URI
|
|
# (<url>/auth/callback) and the Secure cookies. Must be https:// (plain
|
|
# http:// is accepted only for localhost, 127.0.0.1 and [::1]).
|
|
MEALQUEST_PUBLIC_URL=https://mealquest.cubecraftlabs.com
|
|
|
|
# How long a graceful shutdown may take before in-flight requests are cut.
|
|
MEALQUEST_SHUTDOWN_TIMEOUT=10s
|
|
|
|
# Optional. Comma-separated IPs/CIDRs of reverse proxies whose
|
|
# X-Forwarded-For/-Proto headers are honoured. Production lists Traefik;
|
|
# unset trusts no peer.
|
|
MEALQUEST_TRUSTED_PROXY=10.60.1.33
|
|
|
|
# IANA zone the household settings are created with on first boot. Required
|
|
# until those settings exist; ignored afterwards (change the zone in
|
|
# household settings instead). Confirm the household's zone before the first
|
|
# deploy.
|
|
MEALQUEST_DEFAULT_TZ=America/New_York
|
|
|
|
# --- Authentik OIDC ----------------------------------------------------------
|
|
|
|
# Issuer of the Authentik application "mealquest". Discovered at boot, so it
|
|
# must be reachable from the container. Must be https://.
|
|
MEALQUEST_OIDC_ISSUER=https://auth.cubecraftlabs.com/application/o/mealquest/
|
|
MEALQUEST_OIDC_CLIENT_ID=mealquest
|
|
# Comma-separated Authentik groups whose members may sign in.
|
|
MEALQUEST_OIDC_ALLOWED_GROUPS=mealquest-admin
|
|
|
|
# --- Google Calendar (Push to Calendar) ------------------------------------
|
|
|
|
# Client ID of the Google OAuth web client (CTXD project mealquest,
|
|
# RUNBOOKS.MD "Google Calendar OAuth client"). Required: the service will
|
|
# not start without it and the client secret file. Its authorized redirect
|
|
# URI is <MEALQUEST_PUBLIC_URL origin>/api/v1/integrations/google/callback.
|
|
MEALQUEST_GOOGLE_CLIENT_ID=<client id>.apps.googleusercontent.com
|
|
|
|
# Optional session lifetimes. A session ends after IDLE unused and always MAX
|
|
# after sign-in; MAX must be at least IDLE. Defaults: 720h and 4320h.
|
|
MEALQUEST_SESSION_IDLE=720h
|
|
MEALQUEST_SESSION_MAX=4320h
|
|
|
|
# --- Set by deploy/compose.yaml; do not set here -----------------------------
|
|
#
|
|
# MEALQUEST_HTTP_ADDR=:8080
|
|
# MEALQUEST_DATA_DIR=/data
|
|
# MEALQUEST_SECRET_KEY_FILE=/run/secrets/secret_key
|
|
# Base64 of 32 random bytes; encrypts secrets at rest (AES-256-GCM).
|
|
# MEALQUEST_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
|
|
# The Authentik provider's client secret.
|
|
# MEALQUEST_GOOGLE_CLIENT_SECRET_FILE=/run/secrets/google_client_secret
|
|
# The Google OAuth web client's secret.
|
|
# MEALQUEST_SEARXNG_URL=http://searxng:8080
|
|
# The SearXNG recipe-search sidecar on the compose network. The Settings
|
|
# screen pre-fills it as the SearXNG URL until one is saved; the saved
|
|
# provider and base URL come from PATCH /api/v1/settings/recipe-search.
|
|
# See CTXD project mealquest, RUNBOOKS.MD "Recipe search (SearXNG)".
|
|
|
|
# --- Planned; not read by the service yet -------------------------------------
|
|
#
|
|
# Added to deploy/compose.yaml and this file by the features that use them.
|
|
#
|
|
# Web Push (Feature 19). Generate the key pair with cmd/vapidgen.
|
|
# MEALQUEST_VAPID_PUBLIC_KEY=<base64url VAPID public key>
|
|
# MEALQUEST_VAPID_PRIVATE_KEY_FILE=/run/secrets/vapid_private_key
|
|
# MEALQUEST_VAPID_SUBJECT=mailto:<owner address>
|