forked from ungleich-public/ungleich-user
Sajeyks
122bc387d8
None of the calls to the OTP server set a timeout, so a hanging OTP server blocked a web worker indefinitely. Each call now times out after OTP_TIMEOUT seconds (default 10).
49 lines
2.2 KiB
Text
49 lines
2.2 KiB
Text
# Configuration for the ungleich account webapp.
|
|
#
|
|
# Every setting is an environment variable. In development, copy this file
|
|
# (or dev/env.dev) to .env in the repository root. In Kubernetes, values
|
|
# marked [secret] go in a Secret and the rest in a ConfigMap.
|
|
#
|
|
# Required unless a default is shown.
|
|
|
|
# --- Django -----------------------------------------------------------------
|
|
SECRET_KEY="" # [secret] long random string
|
|
ALLOWED_HOSTS="account.ungleich.ch" # comma separated
|
|
DEBUG=False
|
|
LOG_LEVEL=INFO # root log level; output goes to stdout
|
|
#DJANGO_LOG_LEVEL=INFO
|
|
#LDAP3_LOG=False # ldap3 protocol logging (very verbose)
|
|
|
|
# --- LDAP -------------------------------------------------------------------
|
|
# Space separated; the first reachable server is used (failover).
|
|
LDAPSERVER="ldap://ldap1.ungleich.ch ldap://ldap2.ungleich.ch"
|
|
#LDAP_USE_TLS=False # StartTLS on every connection
|
|
LDAP_ADMIN_DN="" # DN with write access to customers
|
|
LDAP_ADMIN_PASSWORD="" # [secret]
|
|
|
|
# Users log in from any of these (space separated) search bases.
|
|
LDAPSEARCH="ou=customers,dc=ungleich,dc=ch ou=users,dc=ungleich,dc=ch"
|
|
# Usernames and uidNumbers must be unique below this base.
|
|
ENTIRE_SEARCH_BASE="dc=ungleich,dc=ch"
|
|
# New registrations are created here.
|
|
LDAP_CUSTOMER_DN="ou=customers,dc=ungleich,dc=ch"
|
|
LDAP_CUSTOMER_GROUP_ID= # gidNumber for new customers
|
|
LDAP_DEFAULT_START_UID= # new uidNumbers are always above this
|
|
|
|
# --- Email ------------------------------------------------------------------
|
|
EMAIL_FROM_ADDRESS=""
|
|
#EMAIL_HOST=localhost
|
|
#EMAIL_PORT=25
|
|
#EMAIL_USE_TLS=True
|
|
#EMAIL_HOST_USER=""
|
|
#EMAIL_HOST_PASSWORD="" # [secret]
|
|
#EMAIL_TIMEOUT=10
|
|
|
|
# --- OTP server -------------------------------------------------------------
|
|
OTPSERVER="" # base URL of the OTP API
|
|
ADMIN_NAME=""
|
|
ADMIN_REALM=""
|
|
ADMIN_SEED="" # [secret] base32 TOTP seed of ADMIN_NAME
|
|
USER_REALM="" # realm for seeds of new users
|
|
ALLOWED_REALMS="" # comma separated realms users may request
|
|
#OTP_TIMEOUT=10 # seconds per request to the OTP server
|