serviceradar/.env.example at staging · tvancott42/serviceradar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# ServiceRadar Docker Configuration
# Copy this file to .env and customize as needed

# ============================================
# IMAGE VERSION
# ============================================

# ServiceRadar image tag (used by docker-compose.yml)
# Default: latest
APP_TAG=latest
# Production pin example (use with docker-compose.yml):
# APP_TAG=v1.0.78

# Optional: choose compose files automatically (no -f needed).
# For local dev overlay:
# COMPOSE_FILE=docker-compose.yml:docker-compose.dev.yml
# For production/base only:
# COMPOSE_FILE=docker-compose.yml

# ============================================
# DATABASE CONFIGURATION
# ============================================

# Proton database password (auto-generated if not set)
# PROTON_PASSWORD=your-secure-password

# Proton log level
PROTON_LOG_LEVEL=error

# ============================================
# API CONFIGURATION
# ============================================

# API authentication key
API_KEY=changeme

# JWT secret for token generation
JWT_SECRET=changeme

# Enable/disable authentication
AUTH_ENABLED=true

# ============================================
# ASH CLOAK (ENCRYPTION)
# ============================================

# Optional override for the AshCloak encryption key.
# If unset, docker compose will generate and persist one in the cloak-key volume.
# CLOAK_KEY=base64-encoded-32-byte-key

# ============================================
# NATS BOOTSTRAP (optional)
# ============================================

# By default, docker compose bootstraps NATS creds into a named volume and
# reuses them across restarts. Set NATS_CREDS_DIR to use a host path instead.
# NATS_CREDS_DIR=./docker/compose/creds

# Recommended for multi-tenant JWT provisioning: import an existing operator seed
# so datasvc can sign account JWTs across restarts.
# NATS_OPERATOR_NAME=serviceradar-dev
# NATS_OPERATOR_SEED=your-operator-seed
# NATS_SYSTEM_ACCOUNT_PUBLIC_KEY=your-system-account-public-key

# Device enrichment filesystem overrides for core-elx.
# Defaults to the repo path used by docker-compose.yml.
# DEVICE_ENRICHMENT_RULES_DIR_HOST=./docker/compose/rules/device-enrichment

# ============================================
# BUILD CONFIGURATION (for development)
# ============================================

# Version for local builds (when using docker-compose.dev.yml)
VERSION=dev

# Build ID for local builds
BUILD_ID=docker

# Config source (file, env, consul, etc.)
CONFIG_SOURCE=file

# ============================================
# CNPG REMOTE ACCESS (optional)
# ============================================
#
# Publish the CNPG Postgres port on the docker host.
# - Default bind is loopback for safety (not reachable from LAN).
# - To connect from a workstation, set CNPG_PUBLIC_BIND=0.0.0.0 (or a specific LAN IP)
#   and ensure your firewall allows inbound traffic on CNPG_PUBLIC_PORT.
# - These variables must be present in `.env` (or exported) when running `docker compose`.
#
# CNPG_PUBLIC_BIND=127.0.0.1
# CNPG_PUBLIC_PORT=5455
#
# If workstation clients connect by IP with CNPG_SSL_MODE=verify-full, ensure the CNPG
# server certificate includes the docker host IP in its SAN.
# CNPG_CERT_EXTRA_IPS=192.168.2.134
#
# CNPG requires mTLS + password. Provide client certs when connecting externally:
# CNPG_CERT_DIR=/path/to/certs (must contain root.pem, workstation.pem, workstation-key.pem)

# CNPG client settings (optional)
# - CNPG_HOST/CNPG_PORT are for local tooling (mix run, psql on host).
# - CNPG_DOCKER_HOST/CNPG_DOCKER_PORT are for docker services (internal DNS).
# CNPG_HOST=localhost
# CNPG_PORT=5455
# CNPG_DOCKER_HOST=cnpg
# CNPG_DOCKER_PORT=5432
# CNPG_SUPERUSER=postgres
# CNPG_USERNAME=serviceradar
# CNPG_PASSWORD= # optional seed value for the app role (written to cnpg-credentials volume)
# CNPG_SUPERUSER_PASSWORD= # optional seed value for the postgres superuser
# CNPG_DATABASE=serviceradar
# CNPG_SSL_MODE=verify-full
# CNPG_TLS_SERVER_NAME=cnpg