# Non-secret deployment configuration only. # Copy to .env, replace placeholders, then run: ./scripts/validate-env .env # Secrets are supplied at runtime by deployment/secrets/han-secrets. SECRETS_SOURCE=file APP_ENV=production-like RELEASE_VERSION=change-me-release LOG_LEVEL=INFO COMPOSE_PROJECT_NAME=han-chat # Immutable production images. Replace every example digest during release materialization. API_BACKEND_IMAGE=registry.example.ru/han-chat/api-backend@sha256:0000000000000000000000000000000000000000000000000000000000000000 BITRIX_LOCAL_APP_IMAGE=registry.example.ru/han-chat/bitrix-local-app@sha256:0000000000000000000000000000000000000000000000000000000000000000 FRONTEND_STATIC_IMAGE=registry.example.ru/han-chat/frontend-static@sha256:0000000000000000000000000000000000000000000000000000000000000000 KEYCLOAK_IMAGE=registry.example.ru/han-chat/keycloak@sha256:0000000000000000000000000000000000000000000000000000000000000000 NGINX_IMAGE=registry.example.ru/han-chat/nginx@sha256:0000000000000000000000000000000000000000000000000000000000000000 OTEL_COLLECTOR_IMAGE=otel/opentelemetry-collector-contrib@sha256:0000000000000000000000000000000000000000000000000000000000000000 OTEL_QUEUE_INIT_IMAGE=alpine@sha256:0000000000000000000000000000000000000000000000000000000000000000 REDIS_IMAGE=registry.example.ru/han-chat/redis@sha256:0000000000000000000000000000000000000000000000000000000000000000 SMS_SERVICE_IMAGE=registry.example.ru/han-chat/sms-service@sha256:0000000000000000000000000000000000000000000000000000000000000000 TOOLBOX_IMAGE=curlimages/curl@sha256:0000000000000000000000000000000000000000000000000000000000000000 # Managed PostgreSQL is external to Compose. Credential-bearing DSNs are secrets. HAN_PG_HOST=managed-pg.private.example HAN_PG_PORT=5433 HAN_PG_DATABASE=han_chat PG_CA_HOST_PATH=/etc/han/ca/managed-postgresql-ca.pem # PgBouncer session mode uses database-level search_path; runtime DSNs must not pass options/currentSchema. KEYCLOAK_DB_URL=jdbc:postgresql://managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem KEYCLOAK_DB_SCHEMA=keycloak KEYCLOAK_DB_USERNAME=keycloak_user PUBLIC_HOST=chat.example.ru PUBLIC_WEB_URL=https://chat.example.ru PUBLIC_API_URL=https://chat.example.ru/api PUBLIC_AUTH_URL=https://chat.example.ru/auth NGINX_HTTP_PORT=80 NGINX_HTTPS_PORT=443 NGINX_TLS_ENABLED=true NGINX_TLS_CERTIFICATE=/run/tls/fullchain.pem NGINX_TLS_CERTIFICATE_KEY=/run/tls/privkey.pem NGINX_HSTS_MAX_AGE=31536000 NGINX_CLIENT_MAX_BODY_SIZE=8m NGINX_RATE_LIMIT_API=60r/m NGINX_RATE_LIMIT_AUTH=60r/m NGINX_RATE_LIMIT_PUBLIC=60r/m NGINX_RATE_LIMIT_POLLING=60r/m NGINX_RATE_LIMIT_DOWNLOADS=30r/m NGINX_RATE_LIMIT_NOTIFICATIONS_READ=120r/m NGINX_RATE_LIMIT_NOTIFICATIONS_ACTION=60r/m NGINX_RATE_LIMIT_NOTIFICATION_UPLOAD=20r/m NGINX_RATE_LIMIT_NOTIFICATIONS_PUBLIC=60r/m NGINX_RATE_LIMIT_BITRIX=120r/m NGINX_RATE_LIMIT_SMS_CALLBACK=120r/m NGINX_RATE_LIMIT_WS=30r/m NGINX_MESSAGE_READ_TIMEOUT_SEC=330 NGINX_TRUSTED_PROXY_CIDR=127.0.0.1/32 TRUSTED_PROXY_CIDRS=172.16.0.0/12 BITRIX_FRAME_ANCESTORS=https://*.bitrix24.ru S3_CONNECT_SRC=https://*.s3.ru-6.storage.selcloud.ru FRONTEND_DEV_PROXY_ENABLED=false # При false значение не используется EXPO_DEV_SERVER_URL=http://host.docker.internal:8081 ACME_EMAIL=ops@example.ru KEYCLOAK_PUBLIC_URL=https://chat.example.ru/auth KEYCLOAK_INTERNAL_URL=http://keycloak:8080/auth KEYCLOAK_REALM=han-chat KEYCLOAK_AUDIENCE=han-chat-api # На мок среде true,true. На продакшн false,false. KEYCLOAK_OTP_MOCK_ENABLED=true KEYCLOAK_OTP_MOCK_RISK_ACCEPTED=false KEYCLOAK_YANDEX_CAPTCHA_ENABLED=false # Public site key; the server key stays in Secrets Manager when CAPTCHA is enabled. KEYCLOAK_YANDEX_CAPTCHA_CLIENT_KEY= KEYCLOAK_OTP_SETTINGS_MAX_STALE_SEC=300 KEYCLOAK_SETTINGS_BRIDGE_URL=http://api-backend:8000/internal/settings/v1/otp KEYCLOAK_SMS_SERVICE_URL=http://sms-service:8080 KEYCLOAK_ADMIN=bootstrap-admin REDIS_MAXMEMORY=384mb REDIS_EVICTION_POLICY=volatile-lru # i-Digital Direct non-secret configuration. IDGTL_SMS_BASE_URL=https://direct.i-dgtl.ru IDGTL_SMS_CALLBACK_PUBLIC_URL=https://chat.example.ru/callbacks/idgtl/sms BITRIX_LOCAL_APP_BASE_URL=http://bitrix-local-app:8080 BITRIX_API_INBOX_PATH=/internal/openlines/v1/inbox BITRIX_API_FORWARD_URL=http://api-backend:8000/internal/openlines/v1/inbox MESSAGE_SAFETY_URL=https://processing.internal:8443 # Docker extra_hosts mapping for VM2 private listener: =. MESSAGE_SAFETY_EXTRA_HOST=processing.internal=192.168.0.4 MESSAGE_SAFETY_CA_HOST_PATH=/etc/han/ca/vm2-internal-ca.pem MESSAGE_SAFETY_API_PREFIX=/internal/safety/v2 MESSAGE_SAFETY_POST_TIMEOUT_SEC=5 MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC=2 MESSAGE_SAFETY_TASK_POLL_MAX_SEC=300 BITRIX_CLIENT_ID=change-me-client-id BITRIX_CONNECTOR_ID=han_mobile_app BITRIX_CONNECTOR_NAME=HAN Mobile App BITRIX_OPEN_LINE_ID= BITRIX_EXPECTED_DOMAIN=<ваш-портал>.bitrix24.ru BITRIX_PUBLIC_BASE_URL=https://chat.example.ru/bitrix BITRIX_HTTP_TIMEOUT_SEC=10 BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC=20 SELECTEL_S3_ENDPOINT_URL=https://s3.ru-7.storage.selcloud.ru SELECTEL_S3_BUCKET_DOCUMENTS=han-chat-documents SELECTEL_S3_BUCKET_ATTACHMENTS=han-chat-attachments SELECTEL_S3_BUCKET_QUARANTINE=han-chat-quarantine OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317 OTEL_SERVICE_NAME_API=api-backend OTEL_SERVICE_NAME_SMS_API=sms-service OTEL_SERVICE_NAME_SMS_WORKER=sms-worker SMS_METRICS_PORT=9464 #Если есть внешний OTLP-сервис, замените (Точный формат авторизации зависит от провайдера): #Если внешнего OTLP-сервиса пока нет, otlp.example.invalid:4317 можно временно оставить, но Collector будет постоянно пытаться подключиться, писать предупреждения и накапливать очередь. OTEL_REMOTE_ENDPOINT=otlp.example.invalid:4317 # true только для plaintext OTLP внутри доверенной приватной сети (например self-hosted SigNoz). OTEL_REMOTE_TLS_INSECURE=false # SDK отправляет все spans локальному Collector; решение о хранении принимает tail_sampling. OTEL_TRACES_SAMPLER=always_on # OTEL_QUEUE_SIZE пока документирует целевую ёмкость, конфигурация Collector закреплена в YAML. OTEL_QUEUE_SIZE=10000