103 lines
4.7 KiB
Bash
103 lines
4.7 KiB
Bash
 
|
# Packet Station production settings on the production VM (native, no Docker).
|
||
|
|
# deploy/vm/install.sh --stack prod copies this to /etc/packetstation/packetstation.env
|
||
|
|
# (root:packetstation 0640) if that file does not exist yet. It never overwrites it.
|
||
|
|
# It holds no secret: passwords and keys are files in /etc/packetstation/secrets.
|
||
|
|
# Starting packetstation-worker with this file polls VISUAL production on its schedule.
|
||
|
|
# Spencer's first start of the worker is the approval.
|
||
|
|
#
|
||
|
|
# systemd reads this file (EnvironmentFile=). One KEY=value per line. Comments on their own lines.
|
||
|
|
# Quote a value with spaces in double quotes. A value with a backslash goes in single quotes.
|
||
|
|
# Not read from here: STATIC_DIR, PS_BUILD, WORKER_BEAT_FILE, TZ (ps-launch.sh sets them).
|
||
|
|
|
||
|
|
# ---- Stack and site ----
|
||
|
|
# prod, test, ci or dev. Guards against crossing stacks.
|
||
|
|
STACK=prod
|
||
|
|
# The VISUAL site in every call. The docker-1 test stack runs with PESCO.
|
||
|
|
SITE_ID=PESCO
|
||
|
|
# Site time zone for schedules and display. The processes run in UTC.
|
||
|
|
SITE_TZ=America/Denver
|
||
|
|
# Public URL, used in links and mail.
|
||
|
|
PUBLIC_URL=https://packetstation.pescoinc.biz
|
||
|
|
# NPM on docker-1, as the VM sees it. Only this address may set X-Forwarded-*. install.sh also
|
||
|
|
# opens port 8000 to this address only (packetstation-firewall.service). Must be an IP address.
|
||
|
|
TRUSTED_PROXY_HOST=192.168.101.12
|
||
|
|
# DEBUG, INFO, WARNING or ERROR. Logs go to the journal.
|
||
|
|
LOG_LEVEL=INFO
|
||
|
|
|
||
|
|
# ---- PostgreSQL 16 on this VM, over the local socket (roles made by install.sh) ----
|
||
|
|
# A folder means the Unix socket. PostgreSQL listens on no TCP port.
|
||
|
|
PG_HOST=/var/run/postgresql
|
||
|
|
PG_PORT=5432
|
||
|
|
PG_DATABASE=packetstation
|
||
|
|
PG_APP_USER=ps_app
|
||
|
|
PG_APP_PASSWORD_FILE=/etc/packetstation/secrets/postgres_app_password
|
||
|
|
PG_MIGRATE_USER=ps_migrate
|
||
|
|
PG_MIGRATE_PASSWORD_FILE=/etc/packetstation/secrets/postgres_migrate_password
|
||
|
|
|
||
|
|
# ---- Keys and folders ----
|
||
|
|
# The services get the secrets as systemd credentials and ps-launch.sh points these at them.
|
||
|
|
# The paths here are the files those credentials are loaded from.
|
||
|
|
SESSION_KEY_FILE=/etc/packetstation/secrets/session_key
|
||
|
|
SEAL_KEY_FILE=/etc/packetstation/secrets/seal_key
|
||
|
|
# Stored files (drawings, MTRs, reports, data books). Owned by packetstation, 0750.
|
||
|
|
ASSETS_DIR=/var/lib/packetstation/assets
|
||
|
|
# Nightly dumps (ps-backup). The worker's backup-check job reads the markers here.
|
||
|
|
BACKUP_DIR=/var/backups/packetstation
|
||
|
|
# The archive NFS mount (Gitea issue 7). Uncomment once the share is mounted here and
|
||
|
|
# `ps-run doctor` can write to it. Unset turns the archive off. The folder under it is set by an
|
||
|
|
# Admin on the Admin page, File locations.
|
||
|
|
#ARCHIVE_ROOT=/mnt/packetstation-archive
|
||
|
|
|
||
|
|
# ---- Uploads and storage ----
|
||
|
|
UPLOAD_MAX_BYTES=26214400
|
||
|
|
UPLOAD_MAX_BYTES_BOM=5242880
|
||
|
|
ASSETS_QUOTA_WARN_PCT=85
|
||
|
|
# 0 measures the file system under ASSETS_DIR.
|
||
|
|
ASSETS_QUOTA_BYTES=0
|
||
|
|
|
||
|
|
# ---- ClamAV (optional, off: Gitea issue 19) ----
|
||
|
|
# Empty means no scan. On a VM, clamd would run from the clamav-daemon package on 127.0.0.1.
|
||
|
|
#CLAMAV_HOST=127.0.0.1
|
||
|
|
CLAMAV_PORT=3310
|
||
|
|
CLAMAV_TIMEOUT_SECONDS=30
|
||
|
|
|
||
|
|
# ---- LDAP (PESCO Active Directory) ----
|
||
|
|
LDAP_URL="ldaps://DC-02.PESCO.COM:636 ldaps://PDC-1.PESCO.COM:636"
|
||
|
|
LDAP_BASE_DN=DC=PESCO,DC=com
|
||
|
|
LDAP_BIND_DN=CN=svc-packetstation,OU=System_Accounts,OU=Admin,DC=PESCO,DC=com
|
||
|
|
LDAP_PASSWORD_FILE=/etc/packetstation/secrets/ldap_bind_password
|
||
|
|
LDAP_USER_FILTER="(|(sAMAccountName={0})(userPrincipalName={0}))"
|
||
|
|
LDAP_GROUP_BASE_DN=OU=PacketStation,OU=Groups,OU=PESCO_FARMINGTON,DC=PESCO,DC=com
|
||
|
|
# The PESCO CA chain. install.sh --ca-bundle puts it here and in the system trust store.
|
||
|
|
LDAP_CA_BUNDLE=/etc/packetstation/ca/pesco-ca.pem
|
||
|
|
LDAP_STARTTLS=false
|
||
|
|
LDAP_ALLOW_INSECURE=false
|
||
|
|
|
||
|
|
# ---- Mail (relay app-03, no auth) ----
|
||
|
|
SMTP_HOST=app-03.pesco.com
|
||
|
|
SMTP_PORT=25
|
||
|
|
SMTP_FROM=[email protected]
|
||
|
|
SMTP_STARTTLS=true
|
||
|
|
SMTP_CA_BUNDLE=/etc/packetstation/ca/pesco-ca.pem
|
||
|
|
# Production sends mail.
|
||
|
|
NOTIFY_DRY_RUN=false
|
||
|
|
|
||
|
|
# ---- VisualKit (VISUAL ERP, read only) ----
|
||
|
|
# Production, set explicitly. Never on the test VM.
|
||
|
|
VISUAL_SERVER=vsql.pesco.com
|
||
|
|
VISUAL_DATABASE=PESCOINC
|
||
|
|
VISUAL_USER=visualkit_ro
|
||
|
|
VISUAL_PASSWORD_FILE=/etc/packetstation/secrets/visualkit_password
|
||
|
|
# no until vsql has a trusted certificate (Gitea issue 5). The PESCO CA is in the VM's system
|
||
|
|
# store (install.sh --ca-bundle), which the ODBC driver reads, so yes works once vsql has one.
|
||
|
|
VISUAL_ENCRYPT=no
|
||
|
|
VISUAL_DRIVER="ODBC Driver 18 for SQL Server"
|
||
|
|
|
||
|
|
# ---- MFilesKit (M-Files, read only) ----
|
||
|
|
MFILES_URL=https://mfiles.pescoinc.biz/REST
|
||
|
|
MFILES_VAULT_GUID={BB69270D-023E-4EA8-B899-AD20B1349702}
|
||
|
|
MFILES_USERNAME=mfileskitRO
|
||
|
|
# ps-launch.sh exports MFILES_PASSWORD from this file (the worker's credential).
|
||
|
|
MFILES_PASSWORD_FILE=/etc/packetstation/secrets/mfileskit_password
|
||
|
|
# Leave MFILES_CA_BUNDLE unset: mfiles.pescoinc.biz has a public Let's Encrypt certificate.
|