B0rbor4d
cc4c3fcecb
- Backend: Customer/Satellite Models, customer_id auf Server/Job/Audit - Satellite-API: heartbeat, poll (atomares Claiming), logs, result, scan-result, health-report - Auth via X-Api-Key (SHA-256 gehasht) - Job-Queue: pending/claimed/running/success/failed + Stale-Janitor - Batch-Trigger: ein Job pro Server, Satellite arbeitet sequenziell ab - Credentials bleiben lokal: nur symbolische credential_ref zentral - Neues Paket satellite/: Pull-Loop, WinRM/SSH/CAU/Scanner, PyInstaller-tauglich - Frontend: Kunden-Switcher, Satelliten-View, Polling statt WebSocket - Entfernt: WebSocket/Socket.io, Redis, zentrale Credentials, JobRunner - Docs: README/AGENTS/PROMPT auf neue Architektur aktualisiert
72 lines
2.9 KiB
Bash
72 lines
2.9 KiB
Bash
# Insight Updater - Environment Template (Zentrale)
|
|
# Copy to .env and fill in secrets
|
|
# Hinweis: WinRM/SSH/Credentials sind in den Satellite gewandert (satellite/config.yaml)
|
|
|
|
# =============================================================================
|
|
# CORE APPLICATION
|
|
# =============================================================================
|
|
APP_ENV=development
|
|
SECRET_KEY=change-me-min-32-characters-random
|
|
JWT_ALGORITHM=RS256
|
|
JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
|
|
JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
|
|
JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
|
|
JWT_REFRESH_TOKEN_EXPIRE_DAYS=7
|
|
|
|
# Initialer Admin (nur beim ersten Start, wenn keine User existieren)
|
|
ADMIN_INITIAL_PASSWORD=admin
|
|
|
|
# =============================================================================
|
|
# DATABASE
|
|
# =============================================================================
|
|
# Development: SQLite (file-based, zero config)
|
|
DATABASE_URL=sqlite+aiosqlite:///./data/app.db
|
|
|
|
# Production: PostgreSQL
|
|
# DATABASE_URL=postgresql+asyncpg://updater:secure-password@db:5432/insight_updater
|
|
DB_NAME=insight_updater
|
|
DB_USER=updater
|
|
DB_PASSWORD=change-me-db-password
|
|
|
|
# =============================================================================
|
|
# JOBS
|
|
# =============================================================================
|
|
# Sekunden ohne Satellite-Report, bevor ein claimed/running Job als failed gilt
|
|
JOB_STALE_TIMEOUT=3600
|
|
|
|
# =============================================================================
|
|
# LDAP / ACTIVE DIRECTORY (STUB - prepared for future implementation)
|
|
# =============================================================================
|
|
LDAP_ENABLED=false
|
|
LDAP_URI=ldaps://dc.insight.local:636
|
|
LDAP_BIND_DN=CN=svc_updater,OU=Services,DC=insight,DC=local
|
|
LDAP_BIND_PASSWORD=
|
|
LDAP_USER_SEARCH_BASE=OU=Users,DC=insight,DC=local
|
|
LDAP_USER_FILTER=(sAMAccountName={username})
|
|
|
|
# =============================================================================
|
|
# FRONTEND (injected at build time via Vite)
|
|
# =============================================================================
|
|
VITE_API_URL=http://localhost:8000
|
|
VITE_APP_TITLE=Insight Updater
|
|
|
|
# =============================================================================
|
|
# LOGGING
|
|
# =============================================================================
|
|
LOG_LEVEL=INFO
|
|
LOG_FORMAT=json # json | console
|
|
|
|
# =============================================================================
|
|
# DOCKER / DEPLOYMENT
|
|
# =============================================================================
|
|
COMPOSE_PROJECT_NAME=insight-updater
|
|
TRAEFIK_NETWORK=traefik-public
|
|
DOMAIN=updater.insight-it.de
|
|
|
|
# =============================================================================
|
|
# EXTERNAL SERVICES
|
|
# =============================================================================
|
|
VAULTWARDEN_URL=https://p.hartmannsche.cloud
|
|
GITEA_URL=https://gitea.insight-it.de
|
|
GITEA_REPO=b0rbor4d/insight-updater
|