first commit

2026-10-09 02:48:31 +07:00
commit 8db22bfaa6
17 changed files with 1722 additions and 0 deletions
@@ -0,0 +1,70 @@
+# =============================================================================
+# Env untuk panel yang berjalan sebagai CONTAINER.
+# Salin ke .env LALU ISI NILAINYA (jangan commit .env):
+#     cp deploy/panel/env.example deploy/panel/.env
+#
+# Beda penting dari .env dev (panel di host):
+#   - Panel di container TIDAK bisa membaca filesystem platform → WAJIB pakai
+#     config-agent (`configUrl`) di SICABE_HOSTS.
+#   - Alamat ke service di HOST memakai `host.docker.internal` (atau
+#     `network_mode: host`, lihat docker-compose.yml).
+# =============================================================================
+
+# ── Wajib ────────────────────────────────────────────────────────────────────
+# URL publik panel — HARUS sama dengan yang diakses browser.
+NEXTAUTH_URL=http://localhost:3000
+# Rahasia NextAuth (WAJIB di produksi). Buat: openssl rand -base64 32
+NEXTAUTH_SECRET=
+
+# ── Login lokal (hybrid dengan SSO) — OPSIONAL ───────────────────────────────
+#PANEL_LOCAL_USER=admin
+#PANEL_LOCAL_PASSWORD_HASH=$2b$10$...
+#PANEL_LOCAL_PASSWORD_HASH_B64=
+#PANEL_LOCAL_ROLE=data-admin
+#TRINO_SERVICE_ACCOUNT=svc_dbt
+
+# ── Keycloak (SSO & login dev ROPC) ──────────────────────────────────────────
+# Dari container, Keycloak di host diakses via host.docker.internal.
+KEYCLOAK_URL=http://host.docker.internal:12080
+KEYCLOAK_CLIENT_ID=sicabe-control-panel
+KEYCLOAK_CLIENT_SECRET=dev-keycloak-secret
+# URL yang dilihat browser (tautan Keycloak).
+KEYCLOAK_WEB_URL=http://localhost:12080
+#KEYCLOAK_REALM=sicabe
+
+# ── Host/agent yang dikelola (WAJIB configUrl) ───────────────────────────────
+# Gateway per host (nginx: docker-proxy + config-agent) jalan di HOST:22375.
+# Dari container → host.docker.internal:22375. `publicHost` = alamat yang
+# dilihat BROWSER (untuk tautan UI), mis. IP LAN host.
+SICABE_HOSTS='[{"name":"local-gw","proxyUrl":"http://host.docker.internal:22375","apiKey":"<gateway-key>","configUrl":"http://host.docker.internal:22375","configApiKey":"<gateway-key>","publicHost":"localhost","enabled":true}]'
+
+# ── Service (fallback; registry hasil scan diutamakan) ───────────────────────
+# CATATAN TLS Trino: sertifikat Trino (self-signed) punya SAN
+# `localhost / trino / sicabe-trino / trino-coordinator / 127.0.0.1`. Dari
+# container, `host.docker.internal` TIDAK ada di SAN → verifikasi TLS gagal.
+# Pilihan:
+#   (a) pakai `network_mode: host` (lihat docker-compose.yml) → 127.0.0.1 cocok;
+#   (b) tambah alias di extra_hosts yang ADA di SAN (mis. `sicabe-trino`), lalu
+#       set TRINO_URL=https://sicabe-trino:12443
+TRINO_URL=https://host.docker.internal:12443
+TRINO_WEB_URL=http://localhost:12443
+# CA diambil otomatis via config-agent (`/ca`) → tak perlu file lokal.
+
+NESSIE_URL=http://host.docker.internal:12120
+
+AIRFLOW_URL=http://host.docker.internal:12082
+STARROCKS_HOST=host.docker.internal
+STARROCKS_PORT=12930
+STARROCKS_WEB_URL=http://localhost:12030
+
+OPENMETADATA_URL=http://host.docker.internal:12085
+GRAFANA_URL=http://host.docker.internal:12300
+MINIO_CONSOLE_URL=http://localhost:12901
+
+# Dremio (bila ada)
+#DREMIO_URL=http://host.docker.internal:12947
+
+# ── Runtime state (di dalam volume panel-data) ───────────────────────────────
+SICABE_CONFIG_FILE=data/config.json
+SICABE_STATE_FILE=data/state.json
+SICABE_COMPOSE_PROJECTS=sicabe