mi
132 lines
5.7 KiB
Bash
132 lines
5.7 KiB
Bash
# Non-secret deployment configuration only.
|
|
# Copy to .env, replace placeholders, then run: ./scripts/validate-env .env
|
|
# Secrets are supplied at runtime by deployment/secrets/han-secrets.
|
|
SECRETS_SOURCE=file
|
|
APP_ENV=production-like
|
|
RELEASE_VERSION=change-me-release
|
|
LOG_LEVEL=INFO
|
|
COMPOSE_PROJECT_NAME=han-chat
|
|
|
|
# Immutable service images built by their owning modules.
|
|
API_BACKEND_IMAGE=han-chat-api-backend:local
|
|
MESSAGE_SAFETY_IMAGE=han-chat-message-safety:local
|
|
BITRIX_LOCAL_APP_IMAGE=han-chat-bitrix-local-app:local
|
|
BITRIX_SYNC_IMAGE=han-chat-bitrix-sync:local
|
|
KEYCLOAK_IMAGE=han-chat-keycloak:local
|
|
SMS_SERVICE_IMAGE=han-chat-sms-service:local
|
|
|
|
# Managed PostgreSQL is external to Compose. Credential-bearing DSNs are secrets.
|
|
HAN_PG_HOST=managed-pg.private.example
|
|
HAN_PG_PORT=5433
|
|
HAN_PG_DATABASE=han_chat
|
|
PG_CA_HOST_PATH=/opt/han-chat/secrets/pg/ca.pem
|
|
# PgBouncer session mode uses database-level search_path; runtime DSNs must not pass options/currentSchema.
|
|
KEYCLOAK_DB_URL=jdbc:postgresql://managed-pg.private.example:5433/han_chat?sslmode=verify-full&sslrootcert=/run/secrets/pg-ca.pem
|
|
KEYCLOAK_DB_SCHEMA=keycloak
|
|
KEYCLOAK_DB_USERNAME=keycloak_user
|
|
|
|
PUBLIC_HOST=chat.example.ru
|
|
PUBLIC_WEB_URL=https://chat.example.ru
|
|
PUBLIC_API_URL=https://chat.example.ru/api
|
|
PUBLIC_AUTH_URL=https://chat.example.ru/auth
|
|
|
|
NGINX_HTTP_PORT=80
|
|
NGINX_HTTPS_PORT=443
|
|
NGINX_TLS_ENABLED=true
|
|
NGINX_TLS_CERTIFICATE=/etc/letsencrypt/live/chat.example.ru/fullchain.pem
|
|
NGINX_TLS_CERTIFICATE_KEY=/etc/letsencrypt/live/chat.example.ru/privkey.pem
|
|
NGINX_HSTS_MAX_AGE=31536000
|
|
NGINX_CLIENT_MAX_BODY_SIZE=8m
|
|
NGINX_RATE_LIMIT_API=60r/m
|
|
NGINX_RATE_LIMIT_AUTH=60r/m
|
|
NGINX_RATE_LIMIT_PUBLIC=60r/m
|
|
NGINX_RATE_LIMIT_POLLING=60r/m
|
|
NGINX_RATE_LIMIT_DOWNLOADS=30r/m
|
|
NGINX_RATE_LIMIT_NOTIFICATIONS_READ=120r/m
|
|
NGINX_RATE_LIMIT_NOTIFICATIONS_ACTION=60r/m
|
|
NGINX_RATE_LIMIT_NOTIFICATION_UPLOAD=20r/m
|
|
NGINX_RATE_LIMIT_NOTIFICATIONS_PUBLIC=60r/m
|
|
NGINX_RATE_LIMIT_BITRIX=120r/m
|
|
NGINX_RATE_LIMIT_SMS_CALLBACK=120r/m
|
|
NGINX_RATE_LIMIT_WS=30r/m
|
|
NGINX_MESSAGE_READ_TIMEOUT_SEC=330
|
|
NGINX_TRUSTED_PROXY_CIDR=127.0.0.1/32
|
|
TRUSTED_PROXY_CIDRS=172.16.0.0/12
|
|
BITRIX_FRAME_ANCESTORS=https://*.bitrix24.ru
|
|
S3_CONNECT_SRC=https://*.s3.ru-7.storage.selcloud.ru
|
|
|
|
FRONTEND_DEV_PROXY_ENABLED=false
|
|
# При false значение не используется
|
|
EXPO_DEV_SERVER_URL=http://host.docker.internal:8081
|
|
ACME_EMAIL=ops@example.ru
|
|
|
|
KEYCLOAK_PUBLIC_URL=https://chat.example.ru/auth
|
|
KEYCLOAK_INTERNAL_URL=http://keycloak:8080/auth
|
|
KEYCLOAK_REALM=han-chat
|
|
KEYCLOAK_AUDIENCE=han-chat-api
|
|
# На мок среде true,true. На продакшн false,false.
|
|
KEYCLOAK_OTP_MOCK_ENABLED=true
|
|
KEYCLOAK_OTP_MOCK_RISK_ACCEPTED=false
|
|
KEYCLOAK_YANDEX_CAPTCHA_ENABLED=false
|
|
# Public site key; the server key stays in Secrets Manager when CAPTCHA is enabled.
|
|
KEYCLOAK_YANDEX_CAPTCHA_CLIENT_KEY=
|
|
KEYCLOAK_OTP_SETTINGS_MAX_STALE_SEC=300
|
|
KEYCLOAK_SETTINGS_BRIDGE_URL=http://api-backend:8000/internal/settings/v1/otp
|
|
KEYCLOAK_SMS_SERVICE_URL=http://sms-service:8080
|
|
KEYCLOAK_ADMIN=bootstrap-admin
|
|
|
|
REDIS_MAXMEMORY=384mb
|
|
REDIS_EVICTION_POLICY=volatile-lru
|
|
|
|
# i-Digital Direct non-secret configuration.
|
|
IDGTL_SMS_BASE_URL=https://direct.i-dgtl.ru
|
|
IDGTL_SMS_CALLBACK_PUBLIC_URL=https://chat.example.ru/callbacks/idgtl/sms
|
|
|
|
BITRIX_LOCAL_APP_BASE_URL=http://bitrix-local-app:8080
|
|
BITRIX_API_INBOX_PATH=/internal/openlines/v1/inbox
|
|
BITRIX_API_FORWARD_URL=http://api-backend:8000/internal/openlines/v1/inbox
|
|
MESSAGE_SAFETY_URL=http://message-safety:8080
|
|
MESSAGE_SAFETY_POST_TIMEOUT_SEC=5
|
|
MESSAGE_SAFETY_TASK_POLL_INTERVAL_SEC=2
|
|
MESSAGE_SAFETY_TASK_POLL_MAX_SEC=300
|
|
MESSAGE_SAFETY_TASK_TTL_SEC=900
|
|
MESSAGE_SAFETY_FILE_SCAN_TIMEOUT_SEC=60
|
|
MESSAGE_SAFETY_RULES_VERSION=2026-01-01
|
|
#Отключение синхронизации (при отключенной синхронизации параметры ниже не работают)
|
|
BITRIX_SYNC_ENABLED=false
|
|
BITRIX_SYNC_CRM_BASE_URL=https://example.bitrix24.ru
|
|
BITRIX_SYNC_CONTACT_MAP_INTERVAL_SEC=60
|
|
BITRIX_SYNC_CONTACT_UPDATE_INTERVAL_SEC=30
|
|
BITRIX_SYNC_CRM_MAX_CONCURRENCY=2
|
|
BITRIX_SYNC_CONTACT_LIST_BATCH_SIZE=50
|
|
BITRIX_CLIENT_ID=change-me-client-id
|
|
BITRIX_CONNECTOR_ID=han_mobile_app
|
|
BITRIX_CONNECTOR_NAME=HAN Mobile App
|
|
BITRIX_OPEN_LINE_ID=<N>
|
|
BITRIX_EXPECTED_DOMAIN=<ваш-портал>.bitrix24.ru
|
|
BITRIX_PUBLIC_BASE_URL=https://chat.example.ru/bitrix
|
|
|
|
BITRIX_HTTP_TIMEOUT_SEC=10
|
|
BITRIX_LOCAL_APP_HTTP_TIMEOUT_SEC=20
|
|
|
|
SELECTEL_S3_ENDPOINT_URL=https://s3.ru-7.storage.selcloud.ru
|
|
SELECTEL_S3_BUCKET_DOCUMENTS=han-chat-documents
|
|
SELECTEL_S3_BUCKET_ATTACHMENTS=han-chat-attachments
|
|
SELECTEL_S3_BUCKET_QUARANTINE=han-chat-quarantine
|
|
|
|
OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4317
|
|
OTEL_SERVICE_NAME_API=api-backend
|
|
OTEL_SERVICE_NAME_SMS_API=sms-service
|
|
OTEL_SERVICE_NAME_SMS_WORKER=sms-worker
|
|
SMS_METRICS_PORT=9464
|
|
#Если есть внешний OTLP-сервис, замените (Точный формат авторизации зависит от провайдера):
|
|
#Если внешнего OTLP-сервиса пока нет, otlp.example.invalid:4317 можно временно оставить, но Collector будет постоянно пытаться подключиться, писать предупреждения и накапливать очередь.
|
|
OTEL_REMOTE_ENDPOINT=otlp.example.invalid:4317
|
|
# true только для plaintext OTLP внутри доверенной приватной сети (например self-hosted SigNoz).
|
|
OTEL_REMOTE_TLS_INSECURE=false
|
|
# SDK отправляет все spans локальному Collector; решение о хранении принимает tail_sampling.
|
|
OTEL_TRACES_SAMPLER=always_on
|
|
# OTEL_QUEUE_SIZE пока документирует целевую ёмкость, конфигурация Collector закреплена в YAML.
|
|
OTEL_QUEUE_SIZE=10000
|
|
|