154 lines
6.4 KiB
Bash
154 lines
6.4 KiB
Bash
# Packet Station test stack settings. Copy to ~/packetstation/test/stack.env on docker-1
|
|
# (Gitea issue 38). It holds no secret: passwords live in SECRETS_DIR as files.
|
|
# Start: docker compose -p packetstation-test --env-file ~/packetstation/test/stack.env \
|
|
# -f deploy/compose.yaml -f deploy/compose.proxy.yaml up -d
|
|
# The test stack never points at VISUAL production.
|
|
# Comments sit on their own lines. Do not put a comment after a value.
|
|
|
|
# ---- Compose (read by docker compose; also passed to the containers, which ignore them) ----
|
|
# Compose project name. Keeps prod and test volumes apart.
|
|
PROJECT_NAME=packetstation-test
|
|
# This file's own path. Compose hands it to the containers as env_file.
|
|
ENV_FILE=/home/spencerm/packetstation/test/stack.env
|
|
# Image to run. Always a tested release tag, never latest.
|
|
IMAGE=gt.pescoinc.biz/spencerm/packetstation:vX.Y.Z
|
|
# App alias on npm_default. NPM forwards to http://<alias>:8000.
|
|
APP_ALIAS=packetstation-test-app
|
|
# Host folder of secret files. Readable by uid 10001; the folders above it are 0750.
|
|
SECRETS_DIR=/home/spencerm/packetstation/test/secrets
|
|
# Host PEM file with the PESCO CA chain. Mounted at /etc/ssl/pesco/ca.pem.
|
|
CA_BUNDLE_FILE=/home/spencerm/packetstation/test/ca/pesco-ca.pem
|
|
# Host backup folder, mounted read-only in the worker. Compose sets BACKUP_DIR=/backups inside.
|
|
BACKUP_DIR=/home/spencerm/packetstation/test/backups
|
|
|
|
# ---- Stack and site ----
|
|
# prod, test, ci or dev. Guards against crossing stacks.
|
|
STACK=test
|
|
# Site key.
|
|
SITE_ID=PESCO
|
|
# Site time zone for schedules and display. Containers run in UTC.
|
|
SITE_TZ=America/Denver
|
|
# Public URL, used in links and mail.
|
|
PUBLIC_URL=https://packetstation-test.pescoinc.biz
|
|
# Only this container may set X-Forwarded-*. The app re-resolves it. Empty trusts nobody.
|
|
TRUSTED_PROXY_HOST=npm_app_1
|
|
# DEBUG, INFO, WARNING or ERROR. Logs go to stdout.
|
|
LOG_LEVEL=INFO
|
|
# Worker heartbeat file read by its healthcheck. /tmp is a tmpfs.
|
|
WORKER_BEAT_FILE=/tmp/packetstation-worker.beat
|
|
# Where the worker reads work orders: visualkit (the real VISUAL through VisualKit) or fixture (CI only; prod refuses it).
|
|
FEED_SOURCE=visualkit
|
|
# Where the worker looks up drawings: mfiles (the vault through MFilesKit) or fixture (CI only; prod refuses it).
|
|
DRAWING_SOURCE=mfiles
|
|
# Fixture folder inside the containers. Only read when a source is fixture.
|
|
FIXTURE_DIR=/fixtures
|
|
|
|
# ---- PostgreSQL (roles made by deploy/postgres/initdb/01-roles.sh) ----
|
|
# postgres alias on the internal backend network.
|
|
PG_HOST=packetstation-postgres
|
|
# PostgreSQL port.
|
|
PG_PORT=5432
|
|
# Database name.
|
|
PG_DATABASE=packetstation
|
|
# Runtime role for the app and worker.
|
|
PG_APP_USER=ps_app
|
|
# Its password, from the compose secret.
|
|
PG_APP_PASSWORD_FILE=/run/secrets/postgres_app_password
|
|
# Schema owner. Used by migrate only.
|
|
PG_MIGRATE_USER=ps_migrate
|
|
# Its password, from the compose secret.
|
|
PG_MIGRATE_PASSWORD_FILE=/run/secrets/postgres_migrate_password
|
|
|
|
# ---- Keys and paths inside the container ----
|
|
# Session signing key.
|
|
SESSION_KEY_FILE=/run/secrets/session_key
|
|
# HMAC key for record seals.
|
|
SEAL_KEY_FILE=/run/secrets/seal_key
|
|
# Assets volume. Compose sets it too.
|
|
ASSETS_DIR=/data/assets
|
|
# Built frontend. Compose sets it too.
|
|
STATIC_DIR=/app/static
|
|
|
|
# ---- Uploads and storage ----
|
|
# Largest drawing, MTR or document upload, in bytes (25 MB).
|
|
UPLOAD_MAX_BYTES=26214400
|
|
# Largest BOM upload (XLSX or CSV), in bytes (5 MB).
|
|
UPLOAD_MAX_BYTES_BOM=5242880
|
|
# Open the storage alert when the assets store is this full, in percent (1 to 99).
|
|
ASSETS_QUOTA_WARN_PCT=85
|
|
# 0 measures the assets volume. A byte count measures the stored files against that many bytes.
|
|
ASSETS_QUOTA_BYTES=0
|
|
|
|
# ---- ClamAV (optional virus scan of uploads; left off by IT, Gitea issue 19) ----
|
|
# Empty means no scan. When set, start the stack with --profile clamav on every docker compose command.
|
|
# An unreachable scanner then refuses uploads until it answers.
|
|
#CLAMAV_HOST=packetstation-clamav
|
|
# clamd port.
|
|
CLAMAV_PORT=3310
|
|
# Seconds to wait for a scan.
|
|
CLAMAV_TIMEOUT_SECONDS=30
|
|
|
|
# ---- LDAP (PESCO Active Directory; CI gets the Samba DC in phase 1) ----
|
|
# Both domain controllers, tried in order.
|
|
LDAP_URL="ldaps://DC-02.PESCO.COM:636 ldaps://PDC-1.PESCO.COM:636"
|
|
# Search base for users.
|
|
LDAP_BASE_DN=DC=PESCO,DC=com
|
|
# Service account for searches.
|
|
LDAP_BIND_DN=CN=svc-packetstation,OU=System_Accounts,OU=Admin,DC=PESCO,DC=com
|
|
# Service account password, from the compose secret.
|
|
LDAP_PASSWORD_FILE=/run/secrets/ldap_bind_password
|
|
# User search filter. {0} is the escaped sign-in name.
|
|
LDAP_USER_FILTER="(|(sAMAccountName={0})(userPrincipalName={0}))"
|
|
# OU that holds the 50 PS-* groups.
|
|
LDAP_GROUP_BASE_DN=OU=PacketStation,OU=Groups,OU=PESCO_FARMINGTON,DC=PESCO,DC=com
|
|
# CA chain used to verify the controllers.
|
|
LDAP_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|
|
# false with ldaps://. true only with ldap:// on 389.
|
|
LDAP_STARTTLS=false
|
|
# Never true outside local development.
|
|
LDAP_ALLOW_INSECURE=false
|
|
|
|
# ---- Mail (relay app-03, no auth) ----
|
|
# Relay host. Empty disables mail.
|
|
SMTP_HOST=app-03.pesco.com
|
|
# Relay port.
|
|
SMTP_PORT=25
|
|
# Sender address.
|
|
SMTP_FROM=[email protected]
|
|
# Require STARTTLS.
|
|
SMTP_STARTTLS=true
|
|
# CA chain used to verify the relay.
|
|
SMTP_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|
|
# true logs notifications and sends nothing.
|
|
NOTIFY_DRY_RUN=true
|
|
|
|
# ---- VisualKit (VISUAL ERP, read only) ----
|
|
# SQL Server instance. Full name: containers have no search domain.
|
|
VISUAL_SERVER='vsql.pesco.com\DEV'
|
|
# VISUAL database.
|
|
VISUAL_DATABASE=PESCOINCDEV
|
|
# Read-only SQL login.
|
|
VISUAL_USER=visualkit_ro
|
|
# Its password, from the compose secret.
|
|
VISUAL_PASSWORD_FILE=/run/secrets/visualkit_password
|
|
# no until vsql has a trusted certificate (open question 6).
|
|
VISUAL_ENCRYPT=no
|
|
# ODBC driver name installed in the image.
|
|
VISUAL_DRIVER="ODBC Driver 18 for SQL Server"
|
|
|
|
# ---- MFilesKit (M-Files, read only; there is no test vault, so test reads production) ----
|
|
# M-Files REST endpoint.
|
|
MFILES_URL=https://mfiles.pescoinc.biz/REST
|
|
# Vault GUID.
|
|
MFILES_VAULT_GUID={BB69270D-023E-4EA8-B899-AD20B1349702}
|
|
# Read-only user. The entrypoint exports MFILES_PASSWORD from its secret file.
|
|
MFILES_USERNAME=mfileskitRO
|
|
# mfiles.pescoinc.biz has a public certificate, so leave this unset (DEPLOY.md).
|
|
# MFILES_CA_BUNDLE=
|
|
|
|
# PS_BUILD is baked into the image at build time. Do not set it here.
|
|
|
|
# Archive root (Gitea issue 7). The QNAP NFS share, mounted at this fixed path and writable by uid 10001.
|
|
# Unset or blank turns the archive off. The archive folder itself is chosen under Admin, Storage, File locations.
|
|
ARCHIVE_ROOT=
|