alex
2655a29886
- Add Traefik v3.2 service back to docker-compose.prod.yml with: - Dashboard with basic auth middleware - Let's Encrypt TLS challenge - HTTP→HTTPS redirect - Health checks and structured logging - Create docker-compose.traefik.yml for standalone Traefik deployment: - Mirrors production Traefik configuration - Isolated network for external proxy usage - Persistent certificate storage - Add TRAEFIK_ACME_EMAIL to .env.example - All compose files validated with docker compose config
42 lines
1.3 KiB
Bash
42 lines
1.3 KiB
Bash
# App identity
|
|
APP_NAME=Headquarter
|
|
ROOT_DOMAIN=localhost
|
|
TOOL_DOMAIN=tools.localhost
|
|
|
|
# API / Web URLs
|
|
API_URL=http://localhost:8000
|
|
WEB_URL=http://localhost:5173
|
|
CORS_ORIGINS=http://localhost:5173
|
|
|
|
# Database (local development)
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=postgres
|
|
POSTGRES_DB=headquarter
|
|
# DATABASE_URL uses a literal value because Pydantic Settings does not expand
|
|
# shell-style variable interpolation from .env files.
|
|
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/headquarter
|
|
|
|
# Authentik OIDC placeholders (wire in FN-004)
|
|
AUTHENTIK_ISSUER_URL=https://auth.example.com/application/o/headquarter/
|
|
AUTHENTIK_CLIENT_ID=your-client-id
|
|
AUTHENTIK_CLIENT_SECRET=your-client-secret
|
|
|
|
# Traefik / deployment placeholders (wire in FN-006)
|
|
TRAEFIK_NETWORK=traefik
|
|
TRAEFIK_ENTRYPOINT=websecure
|
|
TRAEFIK_CERT_RESOLVER=letsencrypt
|
|
TRAEFIK_LOG_LEVEL=INFO
|
|
TRAEFIK_ACME_EMAIL=admin@example.com
|
|
TOOL_SUBDOMAIN_PATTERN={tool}-{project}-{user}.tools.localhost
|
|
|
|
# Frontend build-time variables (passed to web container)
|
|
VITE_API_URL=http://localhost:8000
|
|
VITE_OIDC_ISSUER=https://auth.example.com/application/o/headquarter/
|
|
VITE_OIDC_CLIENT_ID=your-client-id
|
|
|
|
# Secrets (generate strong random values for production)
|
|
SECRET_ENCRYPTION_KEY=change-me-in-production
|
|
|
|
# Auth dev bypass (local development only — NEVER enable in production)
|
|
AUTH_DEV_BYPASS=false
|