Native VM install kit: systemd units, launcher, install and upgrade scripts; backups, restore and doctor without docker exec; DEPLOY.md VM, NPM and NFS sections
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,101 @@
|
||||
# Packet Station test settings on the test VM (native, no Docker).
|
||||
# deploy/vm/install.sh --stack test copies this to /etc/packetstation/packetstation.env
|
||||
# (root:packetstation 0640) if that file does not exist yet. It never overwrites it.
|
||||
# It holds no secret: passwords and keys are files in /etc/packetstation/secrets.
|
||||
# The test VM never points at VISUAL production. It reads VISUAL DEV.
|
||||
#
|
||||
# systemd reads this file (EnvironmentFile=). One KEY=value per line. Comments on their own lines.
|
||||
# Quote a value with spaces in double quotes. A value with a backslash goes in single quotes.
|
||||
# Not read from here: STATIC_DIR, PS_BUILD, WORKER_BEAT_FILE, TZ (ps-launch.sh sets them).
|
||||
|
||||
# ---- Stack and site ----
|
||||
# prod, test, ci or dev. Guards against crossing stacks.
|
||||
STACK=test
|
||||
# The VISUAL site in every call. The docker-1 test stack runs with PESCO.
|
||||
SITE_ID=PESCO
|
||||
# Site time zone for schedules and display. The processes run in UTC.
|
||||
SITE_TZ=America/Denver
|
||||
# Public URL, used in links and mail.
|
||||
PUBLIC_URL=https://packetstation-test.pescoinc.biz
|
||||
# NPM on docker-1, as the VM sees it. Only this address may set X-Forwarded-*. install.sh also
|
||||
# opens port 8000 to this address only (packetstation-firewall.service). Must be an IP address.
|
||||
TRUSTED_PROXY_HOST=192.168.101.12
|
||||
# DEBUG, INFO, WARNING or ERROR. Logs go to the journal.
|
||||
LOG_LEVEL=INFO
|
||||
|
||||
# ---- PostgreSQL 16 on this VM, over the local socket (roles made by install.sh) ----
|
||||
# A folder means the Unix socket. PostgreSQL listens on no TCP port.
|
||||
PG_HOST=/var/run/postgresql
|
||||
PG_PORT=5432
|
||||
PG_DATABASE=packetstation
|
||||
PG_APP_USER=ps_app
|
||||
PG_APP_PASSWORD_FILE=/etc/packetstation/secrets/postgres_app_password
|
||||
PG_MIGRATE_USER=ps_migrate
|
||||
PG_MIGRATE_PASSWORD_FILE=/etc/packetstation/secrets/postgres_migrate_password
|
||||
|
||||
# ---- Keys and folders ----
|
||||
# The services get the secrets as systemd credentials and ps-launch.sh points these at them.
|
||||
# The paths here are the files those credentials are loaded from.
|
||||
SESSION_KEY_FILE=/etc/packetstation/secrets/session_key
|
||||
SEAL_KEY_FILE=/etc/packetstation/secrets/seal_key
|
||||
# Stored files (drawings, MTRs, reports, data books). Owned by packetstation, 0750.
|
||||
ASSETS_DIR=/var/lib/packetstation/assets
|
||||
# Nightly dumps (ps-backup). The worker's backup-check job reads the markers here.
|
||||
BACKUP_DIR=/var/backups/packetstation
|
||||
# The archive NFS mount (Gitea issue 7). Uncomment once the share is mounted here and
|
||||
# `ps-run doctor` can write to it. Unset turns the archive off. The folder under it is set by an
|
||||
# Admin on the Admin page, File locations.
|
||||
#ARCHIVE_ROOT=/mnt/packetstation-archive
|
||||
|
||||
# ---- Uploads and storage ----
|
||||
UPLOAD_MAX_BYTES=26214400
|
||||
UPLOAD_MAX_BYTES_BOM=5242880
|
||||
ASSETS_QUOTA_WARN_PCT=85
|
||||
# 0 measures the file system under ASSETS_DIR.
|
||||
ASSETS_QUOTA_BYTES=0
|
||||
|
||||
# ---- ClamAV (optional, off: Gitea issue 19) ----
|
||||
# Empty means no scan. On a VM, clamd would run from the clamav-daemon package on 127.0.0.1.
|
||||
#CLAMAV_HOST=127.0.0.1
|
||||
CLAMAV_PORT=3310
|
||||
CLAMAV_TIMEOUT_SECONDS=30
|
||||
|
||||
# ---- LDAP (PESCO Active Directory) ----
|
||||
LDAP_URL="ldaps://DC-02.PESCO.COM:636 ldaps://PDC-1.PESCO.COM:636"
|
||||
LDAP_BASE_DN=DC=PESCO,DC=com
|
||||
LDAP_BIND_DN=CN=svc-packetstation,OU=System_Accounts,OU=Admin,DC=PESCO,DC=com
|
||||
LDAP_PASSWORD_FILE=/etc/packetstation/secrets/ldap_bind_password
|
||||
LDAP_USER_FILTER="(|(sAMAccountName={0})(userPrincipalName={0}))"
|
||||
LDAP_GROUP_BASE_DN=OU=PacketStation,OU=Groups,OU=PESCO_FARMINGTON,DC=PESCO,DC=com
|
||||
# The PESCO CA chain. install.sh --ca-bundle puts it here and in the system trust store.
|
||||
LDAP_CA_BUNDLE=/etc/packetstation/ca/pesco-ca.pem
|
||||
LDAP_STARTTLS=false
|
||||
LDAP_ALLOW_INSECURE=false
|
||||
|
||||
# ---- Mail (relay app-03, no auth) ----
|
||||
SMTP_HOST=app-03.pesco.com
|
||||
SMTP_PORT=25
|
||||
SMTP_FROM=[email protected]
|
||||
SMTP_STARTTLS=true
|
||||
SMTP_CA_BUNDLE=/etc/packetstation/ca/pesco-ca.pem
|
||||
# The test VM never mails people about test data. The Admin "Send a test" still sends.
|
||||
NOTIFY_DRY_RUN=true
|
||||
|
||||
# ---- VisualKit (VISUAL ERP, read only) ----
|
||||
# VISUAL DEV. The test VM never points at production. Single quotes keep the backslash.
|
||||
VISUAL_SERVER='vsql.pesco.com\DEV'
|
||||
VISUAL_DATABASE=PESCOINCDEV
|
||||
VISUAL_USER=visualkit_ro
|
||||
VISUAL_PASSWORD_FILE=/etc/packetstation/secrets/visualkit_password
|
||||
# no until vsql has a trusted certificate (Gitea issue 5). The PESCO CA is in the VM's system
|
||||
# store (install.sh --ca-bundle), which the ODBC driver reads, so yes works once vsql has one.
|
||||
VISUAL_ENCRYPT=no
|
||||
VISUAL_DRIVER="ODBC Driver 18 for SQL Server"
|
||||
|
||||
# ---- MFilesKit (M-Files, read only) ----
|
||||
MFILES_URL=https://mfiles.pescoinc.biz/REST
|
||||
MFILES_VAULT_GUID={BB69270D-023E-4EA8-B899-AD20B1349702}
|
||||
MFILES_USERNAME=mfileskitRO
|
||||
# ps-launch.sh exports MFILES_PASSWORD from this file (the worker's credential).
|
||||
MFILES_PASSWORD_FILE=/etc/packetstation/secrets/mfileskit_password
|
||||
# Leave MFILES_CA_BUNDLE unset: mfiles.pescoinc.biz has a public Let's Encrypt certificate.
|
||||
Reference in New Issue
Block a user