B0rbor4d
cf7c29639c
Backend: config/db/security/logging core, SQLAlchemy models (Server, Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh, cau, audit, job_runner), REST API (auth, servers, updates, audit), Socket.io WebSocket layer. Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers, Updates, Audit, Login), axios + socket.io-client, nginx prod config.
85 lines
3.5 KiB
Bash
85 lines
3.5 KiB
Bash
# Insight Updater - Environment Template
|
|
# Copy to .env and fill in secrets
|
|
|
|
# =============================================================================
|
|
# CORE APPLICATION
|
|
# =============================================================================
|
|
APP_ENV=development
|
|
SECRET_KEY=change-me-min-32-characters-random
|
|
ENCRYPTION_KEY=change-me-32-bytes-base64-encoded
|
|
JWT_ALGORITHM=RS256
|
|
JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
|
|
JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
|
|
JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
|
|
JWT_REFRESH_TOKEN_EXPIRE_DAYS=7
|
|
|
|
# =============================================================================
|
|
# DATABASE
|
|
# =============================================================================
|
|
# Development: SQLite (file-based, zero config)
|
|
DATABASE_URL=sqlite+aiosqlite:///./data/app.db
|
|
|
|
# Production: PostgreSQL (uncomment and configure)
|
|
# DATABASE_URL=postgresql+asyncpg://updater:secure-password@db:5432/insight_updater
|
|
|
|
# =============================================================================
|
|
# REDIS (for Socket.io pub/sub, caching, rate limiting)
|
|
# =============================================================================
|
|
REDIS_URL=redis://redis:6379/0
|
|
|
|
# =============================================================================
|
|
# WINRM CONFIGURATION
|
|
# =============================================================================
|
|
WINRM_TRANSPORT=ntlm # ntlm | kerberos | credssp
|
|
WINRM_CERT_VALIDATION=ignore # ignore | validate
|
|
WINRM_OPERATION_TIMEOUT=60
|
|
WINRM_READ_TIMEOUT=120
|
|
WINRM_KERBEROS_DELEGATION=true
|
|
|
|
# =============================================================================
|
|
# SSH CONFIGURATION
|
|
# =============================================================================
|
|
SSH_TIMEOUT=30
|
|
SSH_KEY_PATH=/app/keys/ssh_host_key # optional host key for SSH server
|
|
|
|
# =============================================================================
|
|
# LDAP / ACTIVE DIRECTORY (STUB - prepared for future implementation)
|
|
# =============================================================================
|
|
LDAP_ENABLED=false
|
|
LDAP_URI=ldaps://dc.insight.local:636
|
|
LDAP_BIND_DN=CN=svc_updater,OU=Services,DC=insight,DC=local
|
|
LDAP_BIND_PASSWORD=
|
|
LDAP_USER_SEARCH_BASE=OU=Users,DC=insight,DC=local
|
|
LDAP_USER_FILTER=(sAMAccountName={username})
|
|
LDAP_GROUP_SEARCH_BASE=OU=Groups,DC=insight,DC=local
|
|
LDAP_GROUP_FILTER=(member={user_dn})
|
|
LDAP_CA_CERT_PATH=/app/certs/ldap-ca.pem
|
|
|
|
# =============================================================================
|
|
# FRONTEND (injected at build time via Vite)
|
|
# =============================================================================
|
|
VITE_API_URL=http://localhost:8000
|
|
VITE_WS_URL=ws://localhost:8000
|
|
VITE_APP_TITLE=Insight Updater
|
|
|
|
# =============================================================================
|
|
# LOGGING
|
|
# =============================================================================
|
|
LOG_LEVEL=INFO
|
|
LOG_FORMAT=json # json | console
|
|
|
|
# =============================================================================
|
|
# DOCKER / DEPLOYMENT
|
|
# =============================================================================
|
|
COMPOSE_PROJECT_NAME=insight-updater
|
|
TRAEFIK_NETWORK=traefik-public
|
|
DOMAIN=updater.insight-it.de
|
|
|
|
# =============================================================================
|
|
# EXTERNAL SERVICES
|
|
# =============================================================================
|
|
# Vaultwarden (for CI/CD secrets)
|
|
VAULTWARDEN_URL=https://p.hartmannsche.cloud
|
|
# Gitea
|
|
GITEA_URL=https://gitea.insight-it.de
|
|
GITEA_REPO=b0rbor4d/insight-updater |