forked from ungleich-public/ungleich-user
Sajeyks
f8567b2a41
The OTP server variables were read straight from the environment in views.py. They are now OTP_* settings next to everything else, under the same environment variable names, so existing deployments are unaffected. Remove LDAP_SERVER and LDAP_USERS_DN, which nothing used. env.sample moves to the repository root (where .env is read from) and lists every variable settings.py reads, including defaults and which values are secrets.
48 lines
2.1 KiB
Text
48 lines
2.1 KiB
Text
# Configuration for the ungleich account webapp.
|
|
#
|
|
# Every setting is an environment variable. In development, copy this file
|
|
# (or dev/env.dev) to .env in the repository root. In Kubernetes, values
|
|
# marked [secret] go in a Secret and the rest in a ConfigMap.
|
|
#
|
|
# Required unless a default is shown.
|
|
|
|
# --- Django -----------------------------------------------------------------
|
|
SECRET_KEY="" # [secret] long random string
|
|
ALLOWED_HOSTS="account.ungleich.ch" # comma separated
|
|
DEBUG=False
|
|
LOG_LEVEL=INFO # root log level; output goes to stdout
|
|
#DJANGO_LOG_LEVEL=INFO
|
|
#LDAP3_LOG=False # ldap3 protocol logging (very verbose)
|
|
|
|
# --- LDAP -------------------------------------------------------------------
|
|
# Space separated; the first reachable server is used (failover).
|
|
LDAPSERVER="ldap://ldap1.ungleich.ch ldap://ldap2.ungleich.ch"
|
|
#LDAP_USE_TLS=False # StartTLS on every connection
|
|
LDAP_ADMIN_DN="" # DN with write access to customers
|
|
LDAP_ADMIN_PASSWORD="" # [secret]
|
|
|
|
# Users log in from any of these (space separated) search bases.
|
|
LDAPSEARCH="ou=customers,dc=ungleich,dc=ch ou=users,dc=ungleich,dc=ch"
|
|
# Usernames and uidNumbers must be unique below this base.
|
|
ENTIRE_SEARCH_BASE="dc=ungleich,dc=ch"
|
|
# New registrations are created here.
|
|
LDAP_CUSTOMER_DN="ou=customers,dc=ungleich,dc=ch"
|
|
LDAP_CUSTOMER_GROUP_ID= # gidNumber for new customers
|
|
LDAP_DEFAULT_START_UID= # new uidNumbers are always above this
|
|
|
|
# --- Email ------------------------------------------------------------------
|
|
EMAIL_FROM_ADDRESS=""
|
|
#EMAIL_HOST=localhost
|
|
#EMAIL_PORT=25
|
|
#EMAIL_USE_TLS=True
|
|
#EMAIL_HOST_USER=""
|
|
#EMAIL_HOST_PASSWORD="" # [secret]
|
|
#EMAIL_TIMEOUT=10
|
|
|
|
# --- OTP server -------------------------------------------------------------
|
|
OTPSERVER="" # base URL of the OTP API
|
|
ADMIN_NAME=""
|
|
ADMIN_REALM=""
|
|
ADMIN_SEED="" # [secret] base32 TOTP seed of ADMIN_NAME
|
|
USER_REALM="" # realm for seeds of new users
|
|
ALLOWED_REALMS="" # comma separated realms users may request
|