first commit

.env.example

@@ -0,0 +1,146 @@
+# ============================================================================
+# SiCABE Control Panel — konfigurasi env (salin ke .env lalu sesuaikan)
+#
+# SEMUA URL service dapat di-override dari environment. Nilai default di bawah
+# memakai nama service dalam network compose (sicabe-doc/deploy, `name: sicabe`).
+# Bila panel dijalankan DI HOST, pakai port host (12xxx) seperti kolom "host".
+#
+# Konvensi:
+#   * var tanpa prefix  -> dibaca sisi SERVER (fetch/API, rahasia aman)
+#   * *_WEB_URL dll     -> tautan/UI client; di-fetch dari /api/platform/endpoints
+#   * .env TIDAK di-commit; contoh ini ikut di-track (!.env.example)
+# ============================================================================
+
+# ── Trino ────────────────────────────────────────────────────────────────────
+# Endpoint SQL/API (route /api/trino & /api/query). HTTPS saja: Trino memakai
+# auth hybrid OAuth2 + Basic dengan allow-insecure-over-http=false (HTTP polos
+# tidak melayani apa pun). Login dev pun memakai Bearer, didapat via Keycloak
+# ROPC di CredentialsProvider.
+#   SSO & dev (Bearer/JWT) : HTTPS → https://localhost:12443
+#   dalam compose          : http://trino:8080
+TRINO_URL=https://localhost:12443
+# CA utk Trino HTTPS self-signed. Pin sertifikat server (PEM) di sini.
+# Bisa juga per-host lewat `caPem` di SICABE_HOSTS (lebih diutamakan).
+TRINO_CA_FILE=.ca/trino.crt
+# Nama host (entri SICABE_HOSTS) yang menjalankan Trino — untuk memilih CA per-host.
+#SICABE_TRINO_HOST=host-prod-1
+# Trino Web UI.
+#TRINO_WEB_URL=https://localhost:12443
+
+# ── Keycloak ─────────────────────────────────────────────────────────────────
+# Base URL + realm utk OIDC (login panel & refresh token).
+#   dalam compose : http://keycloak:8080
+#   host          : http://localhost:12080
+KEYCLOAK_URL=http://keycloak:8080
+KEYCLOAK_REALM=sicabe
+# Client OIDC panel (harus ada di realm tsb).
+KEYCLOAK_CLIENT_ID=sicabe-control-panel
+# Secret client. WAJIB di-production (tanpa nilai -> fail saat login).
+#KEYCLOAK_CLIENT_SECRET=
+# Admin Console Keycloak (tautan dashboard utk admin).
+#KEYCLOAK_WEB_URL=http://localhost:12080
+
+# ── Iceberg table explorer backend (Nessie) ──────────────────────────────────
+# Halaman /tables memakai catalog Iceberg REST Nessie.
+# base ops = {NESSIE_URL}/iceberg/v1/{NESSIE_BRANCH}.
+#   dalam compose : http://nessie:19120
+#   host          : http://localhost:12120
+#NESSIE_URL=http://nessie:19120
+#NESSIE_BRANCH=main
+
+# ── Dremio (REST v3 — sources & SQL) ────────────────────────────────────────
+# Endpoint REST Dremio OSS + kredensial lokal (login /apiv2 -> token _dremio).
+#   dalam compose : http://dremio:9047
+#   host          : http://localhost:12947
+DREMIO_URL=http://dremio:9047
+DREMIO_USER=
+DREMIO_PASSWORD=
+
+# ── MinIO ────────────────────────────────────────────────────────────────────
+# MinIO Console (tautan dashboard & sidebar).
+#   host          : http://localhost:12901
+#MINIO_CONSOLE_URL=http://localhost:12901
+
+# ── StarRocks ────────────────────────────────────────────────────────────────
+# FE MySQL protocol (route /api/starrocks).
+#   dalam compose : STARROCKS_HOST=starrocks-fe, PORT=9030
+#   host          : STARROCKS_HOST=localhost, PORT=12930
+STARROCKS_HOST=localhost
+STARROCKS_PORT=12930
+STARROCKS_USER=root
+#STARROCKS_PASSWORD=
+# StarRocks UI HTTP (tautan halaman StarRocks).
+#STARROCKS_WEB_URL=http://localhost:12030
+
+# ── Apache Airflow ───────────────────────────────────────────────────────────
+# Base URL — dipakai utk REST API (lib/airflow) DAN tautan UI (sidebar/dashboard).
+#   dalam compose : http://airflow-webserver:8080
+#   host          : http://localhost:12082
+AIRFLOW_URL=http://localhost:12082
+AIRFLOW_USER=admin
+
+# ── OpenMetadata & Grafana (governance) ──────────────────────────────────────
+# URL API/UI — single source (halaman governance + tautan).
+#   host          : OpenMetadata http://localhost:12085, Grafana http://localhost:12300
+OPENMETADATA_URL=http://localhost:12085
+GRAFANA_URL=http://localhost:12300
+
+# ── Auth (NextAuth) ──────────────────────────────────────────────────────────
+NEXTAUTH_URL=http://localhost:3000
+# WAJIB di-production.
+# ── Login lokal (hybrid dengan SSO) ──────────────────────────────────────────
+# Akun admin LOKAL dari env — bisa login tanpa browser SSO, berlaku juga di
+# produksi. Password = BCRYPT HASH (bukan plaintext).
+#   Buat hash:  node -e "console.log(require('bcryptjs').hashSync('PASSWORD',10))"
+# Untuk Docker/Compose pakai varian _B64 (bcrypt memuat '$' yang bisa di-
+# interpolasi Compose):
+#   node -e "console.log(Buffer.from(require('bcryptjs').hashSync('PASSWORD',10)).toString('base64'))"
+#PANEL_LOCAL_USER=admin
+#PANEL_LOCAL_PASSWORD_HASH=$2b$10$...
+#PANEL_LOCAL_PASSWORD_HASH_B64=JDJiJDEwJC4uLg==
+#PANEL_LOCAL_ROLE=data-admin
+# Identitas Trino untuk sesi login lokal (tanpa JWT Keycloak): service account.
+# Password dibaca dari .env platform via config-agent → TRINO_SVC_<ACC>_PASSWORD.
+#TRINO_SERVICE_ACCOUNT=svc_dbt
+#NEXTAUTH_SECRET=
+
+# ── Multi-host Docker control ────────────────────────────────────────────────
+# Registry host Docker yang dikelola panel (via docker-socket-proxy per host).
+# Nilai JSON array. Bila kosong → default single host http://127.0.0.1:2375
+# (kompatibel perilaku lama).
+#   Field per host: name (unik), proxyUrl, apiKey (opsional), enabled,
+#   sshTunnel (opsional: {host, port, user}).
+#   Multi-host (opsional, untuk Tahap 2): configUrl/configApiKey menunjuk ke
+#   `sicabe-config-agent` host tsb; caPem = CA TLS host (PEM) bila perlu.
+#   ⚠️ apiKey/configApiKey adalah SECRET — jangan di-commit; isi via env/deploy.
+#   Development lokal (single host, tanpa proxy):
+#     SICABE_HOSTS='[{"name":"local","proxyUrl":"unix:///var/run/docker.sock","enabled":true}]'
+#SICABE_HOSTS='[{"name":"host-prod-1","proxyUrl":"http://127.0.0.1:22375","apiKey":"","configUrl":"http://127.0.0.1:22375","configApiKey":"","enabled":true}]'
+# Config panel yang PERSISTEN (hosts/modules/services), diedit dari UI Settings.
+# Bila file ini ada, ia MENGGANTIKAN SICABE_HOSTS di atas (env = seed saja).
+# Memuat api key → gitignored, perms 0600.
+#SICABE_CONFIG_FILE=data/config.json
+# Lokasi file state (monitored toggle per container). Default data/state.json.
+# Key = `${host}/${container}` (kompatibel dgn key lama `${container}`).
+#SICABE_STATE_FILE=data/state.json
+# Daftar project Docker Compose yang dimonitor (label com.docker.compose.project).
+# Comma-separated; default "sicabe".
+#SICABE_COMPOSE_PROJECTS=sicabe
+# Override host per-service (opsional). Bila kosong, host di-resolve otomatis
+# dari daftar host/komponen (dipakai untuk membaca kredensial dari host yang tepat).
+#SICABE_AIRFLOW_HOST=host-prod-1
+#SICABE_STARROCKS_HOST=host-prod-1
+# Host yang menjalankan OPA (menu Authorization; baca/tulis config/opa/data.json).
+#SICABE_OPA_HOST=host-prod-1
+
+# ── Lain-lain ────────────────────────────────────────────────────────────────
+# Direktori catalog Trino & file .env platform (bila dijalankan non-standar).
+# .env platform dibaca READ-ONLY oleh panel (tidak pernah ditimpa).
+#TRINO_CATALOG_DIR=deploy/config/trino/catalog
+#SICABE_ENV_FILE=deploy/.env
+# Dokumen data OPA (ACL authz Trino) — dibaca menu Authorization lewat ConfigStore.
+#OPA_DATA_FILE=/path/ke/sicabe-doc/deploy/config/opa/data.json
+# Project dbt SiCABE (dibaca /api/dbt untuk models, sources, lineage DAG).
+# Panel di host: arahkan ke folder platform (mis. sicabe-doc/deploy/config/airflow/dbt/sicabe).
+#DBT_PROJECT_DIR=/path/ke/sicabe-doc/deploy/config/airflow/dbt/sicabe
+# Password admin Airflow dibaca dari SICABE_ENV_FILE (AIRFLOW_ADMIN_PASSWORD).