forked from ungleich-public/ungleich-user
Sajeyks
5a2e612faa
It opens with the five required variables, then what production usually sets (proxy header, PostgreSQL, mail relay, OTP), then every optional setting commented out at its default. It lists exactly the 51 variables the code reads.
100 lines
3.7 KiB
Bash
100 lines
3.7 KiB
Bash
# Environment for the ungleich account webapp (account.ungleich.ch).
|
|
#
|
|
# Copy to .env for `docker compose` / `docker run --env-file`, or use it as
|
|
# the list of variables to inject in Kubernetes. docker.md explains each one.
|
|
# Values marked [secret] belong in a Secret, not a ConfigMap.
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Required (the app refuses to start without these)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# [secret] Long random string. Generate one with:
|
|
# python3 -c 'import secrets; print(secrets.token_urlsafe(50))'
|
|
SECRET_KEY=
|
|
|
|
# LDAP server(s), space separated. The first reachable one is used.
|
|
LDAPSERVER="ldaps://ldap1.ungleich.ch ldaps://ldap2.ungleich.ch"
|
|
|
|
# Account that searches the directory and creates/changes customers.
|
|
LDAP_ADMIN_DN=
|
|
LDAP_ADMIN_PASSWORD= # [secret]
|
|
|
|
# Sender address of activation and password-reset emails.
|
|
EMAIL_FROM_ADDRESS=
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Usually set in production
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Behind an HTTPS ingress/proxy that sets X-Forwarded-Proto. Makes links in
|
|
# emails use https:// and lets Django know requests were secure.
|
|
TRUST_X_FORWARDED_PROTO=True
|
|
|
|
# PostgreSQL. Required for more than one replica; without DATABASE_HOST the
|
|
# app uses SQLite at SQLITE_PATH (one replica, on a persistent volume).
|
|
#DATABASE_HOST=
|
|
#DATABASE_PORT=5432
|
|
#DATABASE_NAME=ungleich_user
|
|
#DATABASE_USER=ungleich_user
|
|
#DATABASE_PASSWORD= # [secret]
|
|
#DATABASE_SSLMODE=prefer
|
|
|
|
# Mail relay (defaults: localhost:25 with STARTTLS).
|
|
#EMAIL_HOST=localhost
|
|
#EMAIL_PORT=25
|
|
#EMAIL_USE_TLS=True
|
|
#EMAIL_HOST_USER=
|
|
#EMAIL_HOST_PASSWORD= # [secret]
|
|
|
|
# OTP server. Optional: without OTPSERVER new accounts get no OTP seed.
|
|
# If OTPSERVER is set, the four variables after it are required too.
|
|
#OTPSERVER=
|
|
#ADMIN_SEED= # [secret] base32 TOTP seed of ADMIN_NAME
|
|
#ADMIN_NAME=
|
|
#ADMIN_REALM=
|
|
#USER_REALM= # realm for seeds of new users
|
|
#ALLOWED_REALMS= # comma separated realms users may request
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Optional, with production defaults (only set to change them)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
#ALLOWED_HOSTS=account.ungleich.ch # comma separated
|
|
#CSRF_TRUSTED_ORIGINS=https://account.ungleich.ch # default: https:// + each allowed host
|
|
|
|
# Directory layout. A different tree usually only needs ENTIRE_SEARCH_BASE.
|
|
#ENTIRE_SEARCH_BASE=dc=ungleich,dc=ch
|
|
#LDAP_CUSTOMER_DN=ou=customer,dc=ungleich,dc=ch # where registrations go
|
|
#LDAPSEARCH="ou=customer,dc=ungleich,dc=ch ou=users,dc=ungleich,dc=ch" # where logins are found
|
|
#LDAP_CUSTOMER_GROUP_ID=10004
|
|
#LDAP_DEFAULT_START_UID=10000
|
|
#LDAP_USER_OBJECT_CLASSES="inetOrgPerson posixAccount ldapPublicKey" # drop ldapPublicKey without the openssh-lpk schema
|
|
|
|
# LDAP TLS
|
|
#LDAP_USE_TLS=False # StartTLS, for ldap:// URIs only
|
|
#LDAP_TLS_VERIFY=True # verify server certificates
|
|
#LDAP_CA_FILE= # CA bundle for a private CA; default: system trust store
|
|
|
|
# Security headers
|
|
#SESSION_COOKIE_SECURE=True # default: True unless DEBUG
|
|
#CSRF_COOKIE_SECURE=True
|
|
#SECURE_SSL_REDIRECT=False # usually the ingress redirects to HTTPS
|
|
#SECURE_HSTS_SECONDS=0
|
|
|
|
# Runtime
|
|
#DEBUG=False
|
|
#LOG_LEVEL=INFO
|
|
#DJANGO_LOG_LEVEL=INFO
|
|
#LDAP3_LOG=False # very verbose ldap3 protocol logging
|
|
#SQLITE_PATH=/data/db.sqlite3
|
|
#DATABASE_CONN_MAX_AGE=60
|
|
#EMAIL_TIMEOUT=10
|
|
#OTP_TIMEOUT=10
|
|
#STATIC_ROOT=/app/static
|
|
#GUNICORN_WORKERS=2
|
|
#GUNICORN_THREADS=4
|
|
#GUNICORN_TIMEOUT=60
|
|
#GUNICORN_BIND=[::]:8000
|