spencermandClaude Opus 5.5
77d40f6c05
- Issue 3 (Q4b): the registered-device cookie stays; no device certificate. - Issue 19 (Q22): upload limits stay; ClamAV stays off in both stacks, the workstations run Microsoft Defender. - Issue 20 (Q23): the storage alert stays at 85 percent; phase 9 mails it to PS-Admins. - Issue 38 (OPS2): the test stack stays under ~/packetstation/test on docker-1. test.env.example, the compose header, README, CLAUDE.md, DEPLOY.md and SECURITY.md give that path and the actual modes. The production layout is asked on issue 38. All four confirm the built defaults, so no code changed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
150 lines
6.1 KiB
Bash
150 lines
6.1 KiB
Bash
# Packet Station production stack settings. Copy to /etc/packetstation/prod/stack.env
|
|
# (root:root 0644). It holds no secret: passwords live in SECRETS_DIR as files.
|
|
# Start: docker compose -p packetstation --env-file /etc/packetstation/prod/stack.env \
|
|
# -f deploy/compose.yaml -f deploy/compose.proxy.yaml up -d
|
|
# Starting this stack polls VISUAL production on its schedule. That start is the approval.
|
|
# Comments sit on their own lines. Do not put a comment after a value.
|
|
|
|
# ---- Compose (read by docker compose; also passed to the containers, which ignore them) ----
|
|
# Compose project name. Keeps prod and test volumes apart.
|
|
PROJECT_NAME=packetstation
|
|
# This file's own path. Compose hands it to the containers as env_file.
|
|
ENV_FILE=/etc/packetstation/prod/stack.env
|
|
# Image to run. Always a tested release tag, never latest.
|
|
IMAGE=gt.pescoinc.biz/spencerm/packetstation:vX.Y.Z
|
|
# App alias on npm_default. NPM forwards to http://<alias>:8000.
|
|
APP_ALIAS=packetstation-app
|
|
# Host folder of secret files, root:10001 mode 0440.
|
|
SECRETS_DIR=/etc/packetstation/prod/secrets
|
|
# Host PEM file with the PESCO CA chain. Mounted at /etc/ssl/pesco/ca.pem.
|
|
CA_BUNDLE_FILE=/etc/packetstation/ca/pesco-ca.pem
|
|
# Host backup folder, mounted read-only in the worker. Compose sets BACKUP_DIR=/backups inside.
|
|
BACKUP_DIR=/var/backups/packetstation/packetstation
|
|
|
|
# ---- Stack and site ----
|
|
# prod, test, ci or dev. Guards against crossing stacks.
|
|
STACK=prod
|
|
# Site key.
|
|
SITE_ID=farmington
|
|
# Site time zone for schedules and display. Containers run in UTC.
|
|
SITE_TZ=America/Denver
|
|
# Public URL, used in links and mail.
|
|
PUBLIC_URL=https://packetstation.pescoinc.biz
|
|
# Only this container may set X-Forwarded-*. The app re-resolves it. Empty trusts nobody.
|
|
TRUSTED_PROXY_HOST=npm_app_1
|
|
# DEBUG, INFO, WARNING or ERROR. Logs go to stdout.
|
|
LOG_LEVEL=INFO
|
|
# Worker heartbeat file read by its healthcheck. /tmp is a tmpfs.
|
|
WORKER_BEAT_FILE=/tmp/packetstation-worker.beat
|
|
# Where the worker reads work orders: visualkit (the real VISUAL through VisualKit) or fixture (CI only; prod refuses it).
|
|
FEED_SOURCE=visualkit
|
|
# Where the worker looks up drawings: mfiles (the vault through MFilesKit) or fixture (CI only; prod refuses it).
|
|
DRAWING_SOURCE=mfiles
|
|
# Fixture folder inside the containers. Only read when a source is fixture.
|
|
FIXTURE_DIR=/fixtures
|
|
|
|
# ---- PostgreSQL (roles made by deploy/postgres/initdb/01-roles.sh) ----
|
|
# postgres alias on the internal backend network.
|
|
PG_HOST=packetstation-postgres
|
|
# PostgreSQL port.
|
|
PG_PORT=5432
|
|
# Database name.
|
|
PG_DATABASE=packetstation
|
|
# Runtime role for the app and worker.
|
|
PG_APP_USER=ps_app
|
|
# Its password, from the compose secret.
|
|
PG_APP_PASSWORD_FILE=/run/secrets/postgres_app_password
|
|
# Schema owner. Used by migrate only.
|
|
PG_MIGRATE_USER=ps_migrate
|
|
# Its password, from the compose secret.
|
|
PG_MIGRATE_PASSWORD_FILE=/run/secrets/postgres_migrate_password
|
|
|
|
# ---- Keys and paths inside the container ----
|
|
# Session signing key.
|
|
SESSION_KEY_FILE=/run/secrets/session_key
|
|
# HMAC key for record seals.
|
|
SEAL_KEY_FILE=/run/secrets/seal_key
|
|
# Assets volume. Compose sets it too.
|
|
ASSETS_DIR=/data/assets
|
|
# Built frontend. Compose sets it too.
|
|
STATIC_DIR=/app/static
|
|
|
|
# ---- Uploads and storage ----
|
|
# Largest drawing, MTR or document upload, in bytes (25 MB).
|
|
UPLOAD_MAX_BYTES=26214400
|
|
# Largest BOM upload (XLSX or CSV), in bytes (5 MB).
|
|
UPLOAD_MAX_BYTES_BOM=5242880
|
|
# Open the storage alert when the assets store is this full, in percent (1 to 99).
|
|
ASSETS_QUOTA_WARN_PCT=85
|
|
# 0 measures the assets volume. A byte count measures the stored files against that many bytes.
|
|
ASSETS_QUOTA_BYTES=0
|
|
|
|
# ---- ClamAV (optional virus scan of uploads; left off by IT, Gitea issue 19) ----
|
|
# Empty means no scan. When set, start the stack with --profile clamav on every docker compose command.
|
|
# An unreachable scanner then refuses uploads until it answers.
|
|
#CLAMAV_HOST=packetstation-clamav
|
|
# clamd port.
|
|
CLAMAV_PORT=3310
|
|
# Seconds to wait for a scan.
|
|
CLAMAV_TIMEOUT_SECONDS=30
|
|
|
|
# ---- LDAP (PESCO Active Directory; CI gets the Samba DC in phase 1) ----
|
|
# Both domain controllers, tried in order.
|
|
LDAP_URL="ldaps://DC-02.PESCO.COM:636 ldaps://PDC-1.PESCO.COM:636"
|
|
# Search base for users.
|
|
LDAP_BASE_DN=DC=PESCO,DC=com
|
|
# Service account for searches.
|
|
LDAP_BIND_DN=CN=svc-packetstation,OU=System_Accounts,OU=Admin,DC=PESCO,DC=com
|
|
# Service account password, from the compose secret.
|
|
LDAP_PASSWORD_FILE=/run/secrets/ldap_bind_password
|
|
# User search filter. {0} is the escaped sign-in name.
|
|
LDAP_USER_FILTER="(|(sAMAccountName={0})(userPrincipalName={0}))"
|
|
# OU that holds the 50 PS-* groups.
|
|
LDAP_GROUP_BASE_DN=OU=PacketStation,OU=Groups,OU=PESCO_FARMINGTON,DC=PESCO,DC=com
|
|
# CA chain used to verify the controllers.
|
|
LDAP_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|
|
# false with ldaps://. true only with ldap:// on 389.
|
|
LDAP_STARTTLS=false
|
|
# Never true outside local development.
|
|
LDAP_ALLOW_INSECURE=false
|
|
|
|
# ---- Mail (relay app-03, no auth) ----
|
|
# Relay host. Empty disables mail.
|
|
SMTP_HOST=app-03.pesco.com
|
|
# Relay port.
|
|
SMTP_PORT=25
|
|
# Sender address.
|
|
SMTP_FROM=[email protected]
|
|
# Require STARTTLS.
|
|
SMTP_STARTTLS=true
|
|
# CA chain used to verify the relay.
|
|
SMTP_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|
|
# true logs notifications and sends nothing.
|
|
NOTIFY_DRY_RUN=false
|
|
|
|
# ---- VisualKit (VISUAL ERP, read only) ----
|
|
# SQL Server instance. Full name: containers have no search domain.
|
|
VISUAL_SERVER=vsql.pesco.com
|
|
# VISUAL database.
|
|
VISUAL_DATABASE=PESCOINC
|
|
# Read-only SQL login.
|
|
VISUAL_USER=visualkit_ro
|
|
# Its password, from the compose secret.
|
|
VISUAL_PASSWORD_FILE=/run/secrets/visualkit_password
|
|
# no until vsql has a trusted certificate (open question 6).
|
|
VISUAL_ENCRYPT=no
|
|
# ODBC driver name installed in the image.
|
|
VISUAL_DRIVER="ODBC Driver 18 for SQL Server"
|
|
|
|
# ---- MFilesKit (M-Files, read only; there is no test vault, so test reads production) ----
|
|
# M-Files REST endpoint.
|
|
MFILES_URL=https://mfiles.pescoinc.biz/REST
|
|
# Vault GUID.
|
|
MFILES_VAULT_GUID={BB69270D-023E-4EA8-B899-AD20B1349702}
|
|
# Read-only user. The entrypoint exports MFILES_PASSWORD from its secret file.
|
|
MFILES_USERNAME=mfileskitRO
|
|
# CA chain used to verify M-Files.
|
|
MFILES_CA_BUNDLE=/etc/ssl/pesco/ca.pem
|
|
|
|
# PS_BUILD is baked into the image at build time. Do not set it here.
|