Перенесены секреты из .env в SM
This commit is contained in:
mi
@@ -1,4 +1,7 @@
|
||||
# Copy to .env, replace every placeholder, then run: ./scripts/validate-env .env
|
||||
# Non-secret deployment configuration only.
|
||||
# Copy to .env, replace placeholders, then run: ./scripts/validate-env .env
|
||||
# Secrets are supplied at runtime by deployment/secrets/han-secrets.
|
||||
SECRETS_SOURCE=file
|
||||
APP_ENV=production-like
|
||||
RELEASE_VERSION=change-me-release
|
||||
LOG_LEVEL=INFO
|
||||
@@ -12,22 +15,15 @@ BITRIX_SYNC_IMAGE=han-chat-bitrix-sync:local
|
||||
KEYCLOAK_IMAGE=han-chat-keycloak:local
|
||||
SMS_SERVICE_IMAGE=han-chat-sms-service:local
|
||||
|
||||
# Managed PostgreSQL is external to Compose. All production DSNs must verify TLS.
|
||||
# Managed PostgreSQL is external to Compose. Credential-bearing DSNs are secrets.
|
||||
HAN_PG_HOST=managed-pg.private.example
|
||||
HAN_PG_PORT=5433
|
||||
HAN_PG_DATABASE=han_chat
|
||||
PG_CA_HOST_PATH=/opt/han-chat/secrets/pg/ca.pem
|
||||
# PgBouncer session mode uses each role's database-level search_path; do not pass libpq options.
|
||||
DATABASE_URL=postgresql+asyncpg://han_app:change-me@managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
|
||||
BITRIX_DATABASE_URL=postgresql://bitrix_local_app:change-me@managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
|
||||
BITRIX_SYNC_APP_DATABASE_URL=postgresql://bitrix_sync_user:change-me@managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
|
||||
BITRIX_SYNC_DATABASE_URL=postgresql://bitrix_sync_user:change-me@managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
|
||||
MESSAGE_SAFETY_DATABASE_URL=postgresql://message_safety_app:change-me@managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
|
||||
SMS_DATABASE_URL=postgresql+asyncpg://sms_user:change-me@managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
|
||||
# PgBouncer session mode uses database-level search_path; runtime DSNs must not pass options/currentSchema.
|
||||
KEYCLOAK_DB_URL=jdbc:postgresql://managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
|
||||
KEYCLOAK_DB_SCHEMA=keycloak
|
||||
KEYCLOAK_DB_USERNAME=keycloak_user
|
||||
KEYCLOAK_DB_PASSWORD=change-me
|
||||
|
||||
PUBLIC_HOST=chat.example.ru
|
||||
PUBLIC_WEB_URL=https://chat.example.ru
|
||||
@@ -70,61 +66,21 @@ KEYCLOAK_REALM=han-chat
|
||||
KEYCLOAK_AUDIENCE=han-chat-api
|
||||
# На мок среде true,true. На продакшн false,false.
|
||||
KEYCLOAK_OTP_MOCK_ENABLED=true
|
||||
KEYCLOAK_OTP_MOCK_CODE=change-me
|
||||
KEYCLOAK_OTP_MOCK_RISK_ACCEPTED=false
|
||||
KEYCLOAK_YANDEX_CAPTCHA_ENABLED=false
|
||||
# Обязательны только при KEYCLOAK_YANDEX_CAPTCHA_ENABLED=true.
|
||||
# Public site key; the server key stays in Secrets Manager when CAPTCHA is enabled.
|
||||
KEYCLOAK_YANDEX_CAPTCHA_CLIENT_KEY=
|
||||
KEYCLOAK_YANDEX_CAPTCHA_SERVER_KEY=
|
||||
# (openssl rand -hex 32)
|
||||
KEYCLOAK_OTP_HMAC_KEY=change-me
|
||||
KEYCLOAK_OTP_SETTINGS_MAX_STALE_SEC=300
|
||||
KEYCLOAK_SETTINGS_BRIDGE_URL=http://api-backend:8000/internal/settings/v1/otp
|
||||
KEYCLOAK_SMS_SERVICE_URL=http://sms-service:8080
|
||||
# Должен совпадать с SMS_SERVICE_TOKEN.
|
||||
KEYCLOAK_SMS_SERVICE_TOKEN=change-me
|
||||
KEYCLOAK_ADMIN=bootstrap-admin
|
||||
# (openssl rand -hex 32)
|
||||
KEYCLOAK_ADMIN_PASSWORD=change-me
|
||||
# (openssl rand -hex 32)
|
||||
CURSOR_HMAC_SECRET=change-me
|
||||
|
||||
# Redis пароль 1 (openssl rand -hex 32)
|
||||
REDIS_API_PASSWORD=change-me
|
||||
REDIS_URL=redis://api_backend:change-me@redis:6379/0
|
||||
REDIS_REALTIME_URL=redis://api_backend:change-me@redis:6379/1
|
||||
# Redis пароль 2 (openssl rand -hex 32)
|
||||
REDIS_SAFETY_PASSWORD=change-me
|
||||
MESSAGE_SAFETY_REDIS_URL=redis://message_safety:change-me@redis:6379/2
|
||||
# Redis пароль 3 (openssl rand -hex 32)
|
||||
REDIS_HEALTH_PASSWORD=change-me
|
||||
|
||||
REDIS_MAXMEMORY=384mb
|
||||
REDIS_EVICTION_POLICY=volatile-lru
|
||||
|
||||
#token1 (openssl rand -hex 32)
|
||||
MESSAGE_SAFETY_SERVICE_TOKEN=change-me
|
||||
#token2 (openssl rand -hex 32)
|
||||
BITRIX_LOCAL_APP_INTERNAL_TOKEN=change-me
|
||||
BITRIX_INTERNAL_API_TOKEN=change-me
|
||||
#token3 (openssl rand -hex 32)
|
||||
BITRIX_API_FORWARD_TOKEN=change-me
|
||||
BITRIX_API_INBOX_TOKEN=change-me
|
||||
#token4 (openssl rand -hex 32)
|
||||
BITRIX_SYNC_SERVICE_TOKEN=change-me
|
||||
#token5 (openssl rand -hex 32)
|
||||
KEYCLOAK_SETTINGS_BRIDGE_TOKEN=change-me
|
||||
#token6 (openssl rand -hex 32), должен совпадать с KEYCLOAK_SMS_SERVICE_TOKEN
|
||||
SMS_SERVICE_TOKEN=change-me
|
||||
# Тестовый продюсер Internal Notifications API. В БД хранится только hash.
|
||||
NOTIFICATIONS_TOKEN_PRODUCER_TEST=change-me
|
||||
|
||||
# i-Digital Direct. Перед production заменить placeholders согласованными значениями.
|
||||
# i-Digital Direct non-secret configuration.
|
||||
IDGTL_SMS_BASE_URL=https://direct.i-dgtl.ru
|
||||
IDGTL_SMS_API_KEY=change-me
|
||||
IDGTL_SMS_CALLBACK_PUBLIC_URL=https://chat.example.ru/callbacks/idgtl/sms
|
||||
IDGTL_SMS_CALLBACK_USERNAME=change-me
|
||||
IDGTL_SMS_CALLBACK_PASSWORD=change-me
|
||||
|
||||
BITRIX_LOCAL_APP_BASE_URL=http://bitrix-local-app:8080
|
||||
BITRIX_API_INBOX_PATH=/internal/openlines/v1/inbox
|
||||
@@ -139,28 +95,17 @@ MESSAGE_SAFETY_RULES_VERSION=2026-01-01
|
||||
#Отключение синхронизации (при отключенной синхронизации параметры ниже не работают)
|
||||
BITRIX_SYNC_ENABLED=false
|
||||
BITRIX_SYNC_CRM_BASE_URL=https://example.bitrix24.ru
|
||||
BITRIX_SYNC_CRM_WEBHOOK_URL=change-me
|
||||
BITRIX_SYNC_CONTACT_MAP_INTERVAL_SEC=60
|
||||
BITRIX_SYNC_CONTACT_UPDATE_INTERVAL_SEC=30
|
||||
BITRIX_SYNC_CRM_MAX_CONCURRENCY=2
|
||||
BITRIX_SYNC_CONTACT_LIST_BATCH_SIZE=50
|
||||
# (openssl rand -hex 32)
|
||||
BITRIX_SYNC_WEBHOOK_TOKEN=change-me
|
||||
|
||||
# Сначала регистрируется приложение в Битрикс24, потом тут прописываются секреты
|
||||
BITRIX_CLIENT_ID=change-me
|
||||
BITRIX_CLIENT_SECRET=change-me
|
||||
BITRIX_APPLICATION_TOKEN=change-me
|
||||
|
||||
BITRIX_CLIENT_ID=change-me-client-id
|
||||
BITRIX_CONNECTOR_ID=han_mobile_app
|
||||
BITRIX_CONNECTOR_NAME=HAN Mobile App
|
||||
BITRIX_OPEN_LINE_ID=<N>
|
||||
BITRIX_EXPECTED_DOMAIN=<ваш-портал>.bitrix24.ru
|
||||
BITRIX_PUBLIC_BASE_URL=https://chat.example.ru/bitrix
|
||||
|
||||
# ENCRYPTION_KEY обязательно через base64
|
||||
# Generate with: python -c "import base64,secrets; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).decode())"
|
||||
BITRIX_TOKEN_ENCRYPTION_KEY=change-me
|
||||
BITRIX_HTTP_TIMEOUT_SEC=10
|
||||
BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC=20
|
||||
|
||||
@@ -168,10 +113,6 @@ SELECTEL_S3_ENDPOINT_URL=https://s3.ru-7.storage.selcloud.ru
|
||||
SELECTEL_S3_BUCKET_DOCUMENTS=han-chat-documents
|
||||
SELECTEL_S3_BUCKET_ATTACHMENTS=han-chat-attachments
|
||||
SELECTEL_S3_BUCKET_QUARANTINE=han-chat-quarantine
|
||||
SELECTEL_S3_ACCESS_KEY=change-me
|
||||
SELECTEL_S3_SECRET_KEY=change-me
|
||||
SELECTEL_S3_QUARANTINE_READ_ACCESS_KEY=change-me
|
||||
SELECTEL_S3_QUARANTINE_READ_SECRET_KEY=change-me
|
||||
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
|
||||
OTEL_SERVICE_NAME_API=api-backend
|
||||
@@ -181,7 +122,6 @@ SMS_METRICS_PORT=9464
|
||||
#Если есть внешний OTLP-сервис, замените (Точный формат авторизации зависит от провайдера):
|
||||
#Если внешнего OTLP-сервиса пока нет, otlp.example.invalid:4317 можно временно оставить, но Collector будет постоянно пытаться подключиться, писать предупреждения и накапливать очередь.
|
||||
OTEL_REMOTE_ENDPOINT=otlp.example.invalid:4317
|
||||
OTEL_REMOTE_AUTH_HEADER=change-me
|
||||
# true только для plaintext OTLP внутри доверенной приватной сети (например self-hosted SigNoz).
|
||||
OTEL_REMOTE_TLS_INSECURE=false
|
||||
# SDK отправляет все spans локальному Collector; решение о хранении принимает tail_sampling.
|
||||
|
||||
Reference in New Issue
Block a user