sajeyks/ungleich-user
1
0
Fork 0
forked from ungleich-public/ungleich-user
Code Pull requests Activity
ungleich-user/env.sample

69 lines
3.2 KiB
Text
Raw Normal View History

Read all configuration in settings and document it in env.sample The OTP server variables were read straight from the environment in views.py. They are now OTP_* settings next to everything else, under the same environment variable names, so existing deployments are unaffected. Remove LDAP_SERVER and LDAP_USERS_DN, which nothing used. env.sample moves to the repository root (where .env is read from) and lists every variable settings.py reads, including defaults and which values are secrets.
2026-11-06 15:26:26 +03:00
# Configuration for the ungleich account webapp.
#
# Every setting is an environment variable. In development, copy this file
# (or dev/env.dev) to .env in the repository root. In Kubernetes, values
# marked [secret] go in a Secret and the rest in a ConfigMap.
#
# Required unless a default is shown.
# --- Django -----------------------------------------------------------------
SECRET_KEY="" # [secret] long random string
ALLOWED_HOSTS="account.ungleich.ch" # comma separated
DEBUG=False
LOG_LEVEL=INFO # root log level; output goes to stdout
#DJANGO_LOG_LEVEL=INFO
#LDAP3_LOG=False # ldap3 protocol logging (very verbose)
Add production HTTPS and proxy settings - Session and CSRF cookies are secure-only unless DEBUG is on. - TRUST_X_FORWARDED_PROTO honours X-Forwarded-Proto from a TLS terminating ingress. Without it, Django 4+ fails the CSRF origin check on every form POST. - CSRF_TRUSTED_ORIGINS, SECURE_SSL_REDIRECT and SECURE_HSTS_SECONDS are configurable and off by default. HSTS for subdomains and preload are left to ungleich, since they affect all of *.ungleich.ch.
2026-11-06 15:27:27 +03:00
# --- HTTPS / proxy ------------------------------------------------------------
#TRUST_X_FORWARDED_PROTO=False # True behind a TLS-terminating ingress
#CSRF_TRUSTED_ORIGINS="" # comma separated, e.g. https://account.ungleich.ch
#SESSION_COOKIE_SECURE= # default: True unless DEBUG
#CSRF_COOKIE_SECURE= # default: True unless DEBUG
#SECURE_SSL_REDIRECT=False # usually done by the ingress
#SECURE_HSTS_SECONDS=0 # read Django's HSTS docs before raising
Support PostgreSQL configured from the environment Sessions, password reset tokens and pending registrations live in the database, so running more than one replica needs a shared one. With DATABASE_HOST set the app uses PostgreSQL (psycopg 3 binary wheels, no system libraries) with persistent, health-checked connections. Otherwise SQLite is used, at a path configurable with SQLITE_PATH so a single replica can keep it on a volume. docker-compose.dev.yml gains a PostgreSQL 18 service on localhost:5433. The full test suite passes on SQLite and PostgreSQL.
2026-11-06 15:31:01 +03:00
# --- Database -----------------------------------------------------------------
# Sessions, reset tokens and pending registrations. Set DATABASE_HOST to use
# PostgreSQL (required for more than one replica); otherwise SQLite is used.
#DATABASE_HOST=""
#DATABASE_PORT=5432
#DATABASE_NAME=ungleich_user
#DATABASE_USER=ungleich_user
#DATABASE_PASSWORD="" # [secret]
#DATABASE_SSLMODE=prefer
#DATABASE_CONN_MAX_AGE=60
#SQLITE_PATH=./db.sqlite3 # only without DATABASE_HOST
Read all configuration in settings and document it in env.sample The OTP server variables were read straight from the environment in views.py. They are now OTP_* settings next to everything else, under the same environment variable names, so existing deployments are unaffected. Remove LDAP_SERVER and LDAP_USERS_DN, which nothing used. env.sample moves to the repository root (where .env is read from) and lists every variable settings.py reads, including defaults and which values are secrets.
2026-11-06 15:26:26 +03:00
# --- LDAP -------------------------------------------------------------------
# Space separated; the first reachable server is used (failover).
LDAPSERVER="ldap://ldap1.ungleich.ch ldap://ldap2.ungleich.ch"
#LDAP_USE_TLS=False # StartTLS on every connection
LDAP_ADMIN_DN="" # DN with write access to customers
LDAP_ADMIN_PASSWORD="" # [secret]
# Users log in from any of these (space separated) search bases.
LDAPSEARCH="ou=customers,dc=ungleich,dc=ch ou=users,dc=ungleich,dc=ch"
# Usernames and uidNumbers must be unique below this base.
ENTIRE_SEARCH_BASE="dc=ungleich,dc=ch"
# New registrations are created here.
LDAP_CUSTOMER_DN="ou=customers,dc=ungleich,dc=ch"
LDAP_CUSTOMER_GROUP_ID= # gidNumber for new customers
LDAP_DEFAULT_START_UID= # new uidNumbers are always above this
# --- Email ------------------------------------------------------------------
EMAIL_FROM_ADDRESS=""
#EMAIL_HOST=localhost
#EMAIL_PORT=25
#EMAIL_USE_TLS=True
#EMAIL_HOST_USER=""
#EMAIL_HOST_PASSWORD="" # [secret]
#EMAIL_TIMEOUT=10
# --- OTP server -------------------------------------------------------------
OTPSERVER="" # base URL of the OTP API
ADMIN_NAME=""
ADMIN_REALM=""
ADMIN_SEED="" # [secret] base32 TOTP seed of ADMIN_NAME
USER_REALM="" # realm for seeds of new users
ALLOWED_REALMS="" # comma separated realms users may request
Time out requests to the OTP server None of the calls to the OTP server set a timeout, so a hanging OTP server blocked a web worker indefinitely. Each call now times out after OTP_TIMEOUT seconds (default 10).
2026-11-06 15:26:48 +03:00
#OTP_TIMEOUT=10 # seconds per request to the OTP server
Copy permalink