Rogeeandrogee
fb83285617
* HH-445: deploy production observability and runbooks * fix(ops): share production database DSN * fix(HH-445): enforce database TLS gate * fix(HH-445): preserve production serve command * fix(prod): require external database dependencies * fix(prod): unify database host rejection gates * test(prod): enforce exact database TLS runbook contract --------- Co-authored-by: Rogee <rogee@ipao.vip>
49 lines
2.4 KiB
Bash
49 lines
2.4 KiB
Bash
# GoChat production variables. Copy to .env and replace every CHANGE_ME value.
|
|
|
|
GOCHAT_IMAGE_REF=ghcr.io/rogeecn/gochat@sha256:CHANGE_ME
|
|
GOCHAT_ENV=production
|
|
GOCHAT_PORT=3000
|
|
GOCHAT_SERVER_MODE=release
|
|
GOCHAT_SERVER_CORS_ALLOWED_ORIGINS=https://chat.CHANGE_ME.example.com
|
|
GOCHAT_SERVER_TRUSTED_PROXIES=10.0.0.0/8
|
|
GOCHAT_DATABASE_DSN=postgres://gochat:CHANGE_ME@db.CHANGE_ME.example.com:5432/gochat_production?sslmode=verify-full
|
|
GOCHAT_REDIS_DSN=rediss://:CHANGE_ME@redis.CHANGE_ME.example.com:6380/0
|
|
|
|
# Release mode requires external PostgreSQL/Redis endpoints with verified TLS.
|
|
# Set a complete GOCHAT_DATABASE_DSN with sslmode=verify-ca or verify-full.
|
|
# Compose passes this value unchanged to every database client. Keep these fixed
|
|
# container paths in the DSN and point the host variables at untracked files.
|
|
# GOCHAT_DATABASE_DSN='postgres://user:pass@db.example.com:5432/gochat?sslmode=verify-full&sslrootcert=/run/secrets/external-db-ca.crt&sslcert=/run/secrets/external-db-client.crt&sslkey=/run/secrets/external-db-client.key'
|
|
# GOCHAT_DATABASE_TLS_CA_FILE=../../.secrets/external-db-ca.crt
|
|
# GOCHAT_DATABASE_TLS_CLIENT_CERT_FILE=../../.secrets/external-db-client.crt
|
|
# GOCHAT_DATABASE_TLS_CLIENT_KEY_FILE=../../.secrets/external-db-client.key
|
|
# Set all three files to this group and grant group read permission (0640 is
|
|
# suitable for the private key). Compose adds the group to every DB client.
|
|
# GOCHAT_DATABASE_TLS_GID=65534
|
|
|
|
MEILI_IMAGE_REF=getmeili/meilisearch:v1.13@sha256:bed3fb650e62da53145777204891159242f6ea4ce69e215b36223af4aa64a0ae
|
|
|
|
MEILI_MASTER_KEY=CHANGE_ME
|
|
GOCHAT_JWT_SECRET=CHANGE_ME_WITH_AT_LEAST_32_RANDOM_CHARACTERS
|
|
# Optional during a bounded rotation window; comma-separated old 32+ byte secrets.
|
|
GOCHAT_JWT_PREVIOUS_SECRETS=
|
|
GOCHAT_JWT_ALLOW_INSECURE_HEADER_AUTH=false
|
|
GOCHAT_JWT_ACCESS_EXPIRY_MINUTES=15
|
|
GOCHAT_JWT_REFRESH_EXPIRY_HOURS=168
|
|
GOCHAT_JWT_WS_TICKET_TTL_SECONDS=30
|
|
|
|
# Generate with: openssl rand -base64 32
|
|
GOCHAT_ENCRYPTION_ENABLED=true
|
|
GOCHAT_ENCRYPTION_CURRENT_KEY_VERSION=1
|
|
GOCHAT_ENCRYPTION_AES_KEY=CHANGE_ME
|
|
|
|
# Alertmanager reads the HTTPS receiver from this untracked one-line file.
|
|
ALERTMANAGER_WEBHOOK_URL_FILE=../../.secrets/alertmanager-webhook-url
|
|
PROMETHEUS_PORT=9090
|
|
ALERTMANAGER_PORT=9093
|
|
PROMETHEUS_RETENTION=30d
|
|
|
|
# Optional connector. Supply the digest published by its release pipeline.
|
|
SHANGWUTONG_IMAGE_REF=ghcr.io/rogeecn/shangwutong@sha256:CHANGE_ME
|
|
GOCHAT_CONNECTOR_SERVICE_TOKEN=
|