dev_agentandClaude Opus 5.5
f1e7503f94
Require MEALQUEST_VAPID_PUBLIC_KEY, MEALQUEST_VAPID_PRIVATE_KEY_FILE and
MEALQUEST_VAPID_SUBJECT at boot. Both keys are unpadded base64url P-256
keys, the encoding webpush-go reads; boot derives the public point from the
private key and refuses a pair that does not match. The subject must be
mailto:<address> or an https:// URL.
internal/push stores subscriptions by endpoint: GET
/api/v1/push/vapid-public-key serves only the public key, POST
/api/v1/push/subscriptions upserts {endpoint, keys.p256dh, keys.auth,
user_agent}, and DELETE removes by endpoint, answering 204 whether or not
it was stored. cmd/vapidgen prints a new key pair. deploy/compose.yaml
mounts the vapid_private_key secret.
Maestro task e8a7b1f4-327a-478b-88c7-5d265afda153.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
96 lines
4.7 KiB
Bash
96 lines
4.7 KiB
Bash
# MealQuest production environment: the template for deploy/.env (never
|
|
# committed). The service fails fast: a missing or invalid required variable
|
|
# stops it at boot with the variable named. Creating deploy/.env: CTXD
|
|
# project mealquest, RUNBOOKS.MD "Stack and first deploy" > "3. Environment
|
|
# file".
|
|
#
|
|
# Secrets are never set here. They live in deploy/secrets/ (never committed),
|
|
# one value per file, owned by the container user 10001:10001 with mode
|
|
# 0600: secret_key, oidc_client_secret, google_client_secret and
|
|
# vapid_private_key. SearXNG's
|
|
# searxng.env is the exception: compose reads it itself, so it is owned by
|
|
# the host account that runs compose, mode 0600. Creating them: CTXD project
|
|
# mealquest, RUNBOOKS.MD "Stack and first deploy" > "4. Secrets".
|
|
#
|
|
# deploy/compose.yaml mounts them at /run/secrets/<name> and points the
|
|
# *_FILE variables at them.
|
|
|
|
# --- Compose -----------------------------------------------------------------
|
|
|
|
# Host address the service is published on, as <address>:8090. Production
|
|
# binds the LAN address 10.60.1.14 only; 127.0.0.1 suits a dev machine.
|
|
MEALQUEST_BIND_ADDRESS=127.0.0.1
|
|
|
|
# --- Service -----------------------------------------------------------------
|
|
|
|
# Public origin the household opens. Fixes the OIDC redirect URI
|
|
# (<url>/auth/callback) and the Secure cookies. Must be https:// (plain
|
|
# http:// is accepted only for localhost, 127.0.0.1 and [::1]).
|
|
MEALQUEST_PUBLIC_URL=https://mealquest.cubecraftlabs.com
|
|
|
|
# How long a graceful shutdown may take before in-flight requests are cut.
|
|
MEALQUEST_SHUTDOWN_TIMEOUT=10s
|
|
|
|
# Optional. Comma-separated IPs/CIDRs of reverse proxies whose
|
|
# X-Forwarded-For/-Proto headers are honoured. Production lists Traefik;
|
|
# unset trusts no peer.
|
|
MEALQUEST_TRUSTED_PROXY=10.60.1.33
|
|
|
|
# IANA zone the household settings are created with on first boot. Required
|
|
# until those settings exist; ignored afterwards (change the zone in
|
|
# household settings instead).
|
|
MEALQUEST_DEFAULT_TZ=America/New_York
|
|
|
|
# --- Authentik OIDC ----------------------------------------------------------
|
|
|
|
# Issuer of the Authentik application "mealquest". Discovered at boot, so it
|
|
# must be reachable from the container. Must be https://.
|
|
MEALQUEST_OIDC_ISSUER=https://auth.cubecraftlabs.com/application/o/mealquest/
|
|
MEALQUEST_OIDC_CLIENT_ID=mealquest
|
|
# Comma-separated Authentik groups whose members may sign in.
|
|
MEALQUEST_OIDC_ALLOWED_GROUPS=mealquest-admin
|
|
|
|
# --- Google Calendar (Push to Calendar) ------------------------------------
|
|
|
|
# Client ID of the Google OAuth web client (CTXD project mealquest,
|
|
# RUNBOOKS.MD "Google Calendar OAuth client"). Required: the service will
|
|
# not start without it and the client secret file. Its authorized redirect
|
|
# URI is <MEALQUEST_PUBLIC_URL origin>/api/v1/integrations/google/callback.
|
|
MEALQUEST_GOOGLE_CLIENT_ID=<client id>.apps.googleusercontent.com
|
|
|
|
# --- Web Push (VAPID) ------------------------------------------------------
|
|
|
|
# Required: the service will not start without the public key, the subject
|
|
# and the private key file, or with a private key that does not belong to
|
|
# the public key. `go run ./cmd/vapidgen` prints a new pair: its
|
|
# MEALQUEST_VAPID_PUBLIC_KEY line goes here, its private key line alone
|
|
# into deploy/secrets/vapid_private_key. Both are unpadded base64url P-256
|
|
# keys. Key pair: CTXD project mealquest, RUNBOOKS.MD "VAPID keys (Web
|
|
# Push)". Replacing the pair invalidates every browser's subscription.
|
|
MEALQUEST_VAPID_PUBLIC_KEY=<base64url VAPID public key>
|
|
# The push services' contact for this sender: mailto:<address> or https://.
|
|
MEALQUEST_VAPID_SUBJECT=mailto:<owner address>
|
|
|
|
# Optional session lifetimes. A session ends after IDLE unused and always MAX
|
|
# after sign-in; MAX must be at least IDLE. Defaults: 720h and 4320h.
|
|
MEALQUEST_SESSION_IDLE=720h
|
|
MEALQUEST_SESSION_MAX=4320h
|
|
|
|
# --- Set by deploy/compose.yaml; do not set here -----------------------------
|
|
#
|
|
# MEALQUEST_HTTP_ADDR=:8080
|
|
# MEALQUEST_DATA_DIR=/data
|
|
# MEALQUEST_SECRET_KEY_FILE=/run/secrets/secret_key
|
|
# Base64 of 32 random bytes; encrypts secrets at rest (AES-256-GCM).
|
|
# MEALQUEST_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
|
|
# The Authentik provider's client secret.
|
|
# MEALQUEST_GOOGLE_CLIENT_SECRET_FILE=/run/secrets/google_client_secret
|
|
# The Google OAuth web client's secret.
|
|
# MEALQUEST_VAPID_PRIVATE_KEY_FILE=/run/secrets/vapid_private_key
|
|
# The VAPID private key printed by `go run ./cmd/vapidgen`.
|
|
# MEALQUEST_SEARXNG_URL=http://searxng:8080
|
|
# The SearXNG recipe-search sidecar on the compose network. The Settings
|
|
# screen pre-fills it as the SearXNG URL until one is saved; the saved
|
|
# provider and base URL come from PATCH /api/v1/settings/recipe-search.
|
|
# See CTXD project mealquest, RUNBOOKS.MD "Recipe search (SearXNG)".
|