forked from ungleich-public/ungleich-user
Sajeyks
d433708f86
- Session and CSRF cookies are secure-only unless DEBUG is on. - TRUST_X_FORWARDED_PROTO honours X-Forwarded-Proto from a TLS terminating ingress. Without it, Django 4+ fails the CSRF origin check on every form POST. - CSRF_TRUSTED_ORIGINS, SECURE_SSL_REDIRECT and SECURE_HSTS_SECONDS are configurable and off by default. HSTS for subdomains and preload are left to ungleich, since they affect all of *.ungleich.ch.
57 lines
2.7 KiB
Text
57 lines
2.7 KiB
Text
# Configuration for the ungleich account webapp.
|
|
#
|
|
# Every setting is an environment variable. In development, copy this file
|
|
# (or dev/env.dev) to .env in the repository root. In Kubernetes, values
|
|
# marked [secret] go in a Secret and the rest in a ConfigMap.
|
|
#
|
|
# Required unless a default is shown.
|
|
|
|
# --- Django -----------------------------------------------------------------
|
|
SECRET_KEY="" # [secret] long random string
|
|
ALLOWED_HOSTS="account.ungleich.ch" # comma separated
|
|
DEBUG=False
|
|
LOG_LEVEL=INFO # root log level; output goes to stdout
|
|
#DJANGO_LOG_LEVEL=INFO
|
|
#LDAP3_LOG=False # ldap3 protocol logging (very verbose)
|
|
|
|
# --- HTTPS / proxy ------------------------------------------------------------
|
|
#TRUST_X_FORWARDED_PROTO=False # True behind a TLS-terminating ingress
|
|
#CSRF_TRUSTED_ORIGINS="" # comma separated, e.g. https://account.ungleich.ch
|
|
#SESSION_COOKIE_SECURE= # default: True unless DEBUG
|
|
#CSRF_COOKIE_SECURE= # default: True unless DEBUG
|
|
#SECURE_SSL_REDIRECT=False # usually done by the ingress
|
|
#SECURE_HSTS_SECONDS=0 # read Django's HSTS docs before raising
|
|
|
|
# --- LDAP -------------------------------------------------------------------
|
|
# Space separated; the first reachable server is used (failover).
|
|
LDAPSERVER="ldap://ldap1.ungleich.ch ldap://ldap2.ungleich.ch"
|
|
#LDAP_USE_TLS=False # StartTLS on every connection
|
|
LDAP_ADMIN_DN="" # DN with write access to customers
|
|
LDAP_ADMIN_PASSWORD="" # [secret]
|
|
|
|
# Users log in from any of these (space separated) search bases.
|
|
LDAPSEARCH="ou=customers,dc=ungleich,dc=ch ou=users,dc=ungleich,dc=ch"
|
|
# Usernames and uidNumbers must be unique below this base.
|
|
ENTIRE_SEARCH_BASE="dc=ungleich,dc=ch"
|
|
# New registrations are created here.
|
|
LDAP_CUSTOMER_DN="ou=customers,dc=ungleich,dc=ch"
|
|
LDAP_CUSTOMER_GROUP_ID= # gidNumber for new customers
|
|
LDAP_DEFAULT_START_UID= # new uidNumbers are always above this
|
|
|
|
# --- Email ------------------------------------------------------------------
|
|
EMAIL_FROM_ADDRESS=""
|
|
#EMAIL_HOST=localhost
|
|
#EMAIL_PORT=25
|
|
#EMAIL_USE_TLS=True
|
|
#EMAIL_HOST_USER=""
|
|
#EMAIL_HOST_PASSWORD="" # [secret]
|
|
#EMAIL_TIMEOUT=10
|
|
|
|
# --- OTP server -------------------------------------------------------------
|
|
OTPSERVER="" # base URL of the OTP API
|
|
ADMIN_NAME=""
|
|
ADMIN_REALM=""
|
|
ADMIN_SEED="" # [secret] base32 TOTP seed of ADMIN_NAME
|
|
USER_REALM="" # realm for seeds of new users
|
|
ALLOWED_REALMS="" # comma separated realms users may request
|
|
#OTP_TIMEOUT=10 # seconds per request to the OTP server
|