console/.env.example at main · device-management-toolkit/console · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# Application
APP_NAME=console
APP_REPO=device-management-toolkit/console
# AES-GCM key protecting device credentials. Leave empty to have Console take it
# from the secret store / OS keyring, or generate and store one on first run.
# If you set it yourself it must be exactly 16, 24 or 32 characters (AES-128,
# AES-192 or AES-256) and must not be repetitive — Console refuses to start
# otherwise. Generate one with: openssl rand -base64 24
APP_ENCRYPTION_KEY=
APP_ALLOW_INSECURE_CIPHERS=false
APP_COMMON_NAME=console.local
APP_DISABLE_CIRA=true

# HTTP Server
# Empty or 0.0.0.0 binds all interfaces.
# Override Compose bind hosts when needed.
# VAULT_HOST=127.0.0.1
# POSTGRES_HOST=127.0.0.1
# MONGO_HOST=127.0.0.1
# CONSOLE_HOST=127.0.0.1
HTTP_HOST=
HTTP_PORT=8181
WS_COMPRESSION=false
HTTP_ALLOWED_ORIGINS=*
HTTP_ALLOWED_HEADERS=*
# Lets a cross-origin browser send the session cookie. Ignored while
# HTTP_ALLOWED_ORIGINS is "*" (CORS forbids credentials with a wildcard).
# Same-origin deployments do not need this.
HTTP_ALLOW_CREDENTIALS=false

# TLS
# Enable TLS in release if the app terminates TLS itself. If behind an API gateway or LB that provides TLS, set to false.
HTTP_TLS_ENABLED=true
# If both are empty and HTTP_TLS_ENABLED=true, the server will generate a self-signed certificate at startup.
HTTP_TLS_CERT_FILE=
HTTP_TLS_KEY_FILE=

# Logger
LOG_LEVEL=info

# Remote Secret Store (Vault)
SECRET_ADDR=http://localhost:8200
SECRET_TOKEN=

# Database
DB_POOL_MAX=2
DB_PROVIDER=
# Postgres TLS comes from the DSN. With no sslmode set, migrations use
# sslmode=disable and the pool uses pgx's "prefer"; in production set
# sslmode=verify-full (and sslrootcert) explicitly.
DB_URL=

# EA
EA_URL=http://localhost:8000
EA_USERNAME=
EA_PASSWORD=

# Auth
AUTH_DISABLED=false
AUTH_ADMIN_USERNAME=standalone
# Uncomment to set your own admin password; otherwise Console generates one in config.yml
# AUTH_ADMIN_PASSWORD=
# Uncomment to set your own JWT signing secret; otherwise Console generates one in config.yml
# AUTH_JWT_KEY=
AUTH_JWT_EXPIRATION=24h
AUTH_REDIRECTION_JWT_EXPIRATION=5m
# Ignored when AUTH_CLIENT_ID is set (OIDC).
AUTH_COOKIE_ENABLED=true
AUTH_COOKIE_NAME=console_session
# Set false only when Console is served over plain HTTP on a non-localhost
# address; browsers drop Secure cookies there.
AUTH_COOKIE_SECURE=true
# strict | lax | none. "none" needs HTTP_ALLOW_CREDENTIALS and explicit origins.
# SameSite is currently the only CSRF defence for cookie auth, so "none" leaves
# state-changing requests unprotected. Keep strict unless you have to loosen it.
AUTH_COOKIE_SAME_SITE=strict
AUTH_CLIENT_ID=
AUTH_ISSUER=
GIN_MODE=release
# DB_URL=postgres://postgresadmin:admin123@localhost:5432/rpsdb
# OAUTH CONFIGURATION
AUTH_CLIENT_ID=
# ex. "https://login.microsoftonline.com/<tenant-id>/v2.0 for Azure Entra -- used for discovery
AUTH_ISSUER=