MMD
43e317eeba
- Delete backups/*.dump and all real credentials from README/docs
(prod MinIO creds, Casdoor passwords, server IP, admin password)
- All stack secrets now come from git-ignored .env (.env.example added);
docker-compose.prod.yml refuses to boot without them (${VAR:?})
- seed_casdoor.py: bcrypt password hashing, generated console/client secrets
- Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver
+ systemd unit + README (replaces unauthenticated deploy endpoint)
- docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist
49 lines
1.9 KiB
Bash
49 lines
1.9 KiB
Bash
# ============================================================
|
|
# ERP stack configuration — copy to .env and fill in real values.
|
|
# .env is git-ignored; NEVER commit real credentials.
|
|
# Local dev: cp .env.example .env (defaults work as-is)
|
|
# Production VPS: /srv/erp/.env with STRONG values for every entry —
|
|
# docker-compose.prod.yml refuses to boot without them.
|
|
# ============================================================
|
|
|
|
# --- Public hosts (production; local defaults live in docker-compose.yml) ---
|
|
APP_HOST=aramesh.bennu-api-bahrestan.ir
|
|
API_HOST=api.bennu-api-bahrestan.ir
|
|
AUTH_HOST=casdoor.bennu-api-bahrestan.ir
|
|
S3_HOST=s3.bennu-api-bahrestan.ir
|
|
STORAGE_HOST=storage.bennu-api-bahrestan.ir
|
|
|
|
# --- Traefik / Let's Encrypt ---
|
|
TRAEFIK_ACME_EMAIL=you@example.com
|
|
|
|
# --- Environment: "prod" enables the fail-fast startup checks in the API ---
|
|
ENVIRONMENT=prod
|
|
|
|
# --- PostgreSQL (app + Casdoor share the instance) ---
|
|
POSTGRES_PASSWORD=CHANGE_ME_strong_db_password
|
|
|
|
# --- MinIO object storage root credentials ---
|
|
MINIO_ROOT_USER=CHANGE_ME_minio_user
|
|
MINIO_ROOT_PASSWORD=CHANGE_ME_long_random_minio_password
|
|
|
|
# --- Casdoor OIDC application (must match the Casdoor application record) ---
|
|
CASDOOR_CLIENT_SECRET=CHANGE_ME_casdoor_client_secret
|
|
CASDOOR_ADMIN_PASSWORD=CHANGE_ME_casdoor_console_admin_password
|
|
|
|
# --- CORS: exact browser origins allowed to call the API (comma-separated) ---
|
|
CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir
|
|
|
|
# --- Developer Mode (X-User-* header identity + login panel) ---
|
|
# MUST stay false in production. Only for local debugging without tokens.
|
|
DEV_LOGIN_ENABLED=false
|
|
|
|
# --- Deploy webhook (Gitea push → rebuild; see infra/deploy-webhook/) ---
|
|
GITEA_WEBHOOK_SECRET=CHANGE_ME_long_random_webhook_secret
|
|
|
|
# --- Monitoring stack (see monitoring/docker-compose.monitoring.yml) ---
|
|
OPENPANEL_CLIENT_ID=
|
|
OPENPANEL_CLIENT_SECRET=
|
|
SENTRY_DSN_BACKEND=
|
|
SENTRY_DSN_FRONTEND=
|
|
GRAFANA_ADMIN_PASSWORD=CHANGE_ME_grafana_password
|