first commit

2026-10-09 02:48:31 +07:00
commit 8db22bfaa6
17 changed files with 1722 additions and 0 deletions
@@ -0,0 +1,77 @@
+# =============================================================================
+# Env untuk stack sicabe-host (satu file untuk SEMUA host).
+# Salin ke .env lalu isi nilainya:  cp env.example .env
+#
+# Dipakai oleh: docker-socket-proxy + config-agent + gateway (semua host),
+# dan control-panel (hanya host panel / profile "panel").
+# =============================================================================
+
+# ── Image dari registry (WAJIB) ──────────────────────────────────────────────
+# Hasil: ./scripts/build-image.sh --all --push --registry <registry>
+# Kosongkan SICABE_REGISTRY bila memakai image lokal (mis. saat uji).
+#SICABE_REGISTRY=registry.example.com/sicabe
+SICABE_TAG=latest
+
+# ── Gateway (WAJIB, semua host) ──────────────────────────────────────────────
+# Satu API key untuk docker-proxy + config-agent (diperiksa nginx).
+GATEWAY_API_KEY=
+# Bind ke 127.0.0.1 (default, aman) atau IP internal. JANGAN ke internet.
+GATEWAY_BIND_IP=127.0.0.1
+GATEWAY_PORT=22375
+
+# ── Config-agent (WAJIB, semua host) ─────────────────────────────────────────
+# Direktori deploy sicabe-doc di host ini (berisi .env, config/trino/catalog, ...).
+SICABE_DEPLOY_DIR=/path/ke/sicabe-doc/deploy
+# UID/GID host yang menulis file (katalog/OPA) — agar tidak root-owned.
+AGENT_UID=1000
+AGENT_GID=1000
+# CA TLS Trino — WAJIB di host panel agar panel memverifikasi sertifikat Trino
+# (self-signed). Isi direktori yang memuat PEM-nya (dihasilkan
+# ./scripts/export-trino-ca.sh → <panel>/.ca/trino.crt).
+# Di host NON-panel boleh dikosongkan (panel-lah yang butuh CA).
+AGENT_CA_HOST_PATH=/path/ke/sicabe-control-panel/.ca
+AGENT_CA_FILE=/ca/trino.crt
+
+# =============================================================================
+# Di bawah ini HANYA untuk host panel (profile "panel").
+# Boleh dibiarkan kosong di host non-panel (compose tetap valid).
+# =============================================================================
+
+# ── Panel: wajib ─────────────────────────────────────────────────────────────
+# URL publik panel (harus sama dengan yang diakses browser & redirect URI Keycloak).
+PANEL_URL=http://localhost:3000
+PANEL_PORT=3000
+# openssl rand -base64 32
+NEXTAUTH_SECRET=
+
+# ── Login lokal (hybrid dengan SSO) — OPSIONAL ───────────────────────────────
+# Akun lokal tanpa Keycloak; password = bcrypt hash. Pakai varian _B64 di sini
+# karena Compose meng-interpolasi '$' (bcrypt selalu memuat '$').
+#   node -e "console.log(Buffer.from(require('bcryptjs').hashSync('PASSWORD',10)).toString('base64'))"
+#PANEL_LOCAL_USER=admin
+#PANEL_LOCAL_PASSWORD_HASH_B64=
+#PANEL_LOCAL_ROLE=data-admin
+# Identitas Trino utk sesi lokal (tanpa JWT) — service account (Basic).
+#TRINO_SERVICE_ACCOUNT=svc_dbt
+# Client Keycloak panel (scripts/create-keycloak-client.sh).
+KEYCLOAK_CLIENT_SECRET=dev-keycloak-secret
+# Host/agent yang dikelola panel. WAJIB ada `configUrl` (config-agent).
+# Di host panel (network host) gateway lokal = 127.0.0.1:${GATEWAY_PORT}.
+# Format JSON tanpa kutip pembungkus (hindari masalah parsing .env).
+SICABE_HOSTS=[{"name":"local-gw","proxyUrl":"http://127.0.0.1:22375","apiKey":"CHANGE_ME","configUrl":"http://127.0.0.1:22375","configApiKey":"CHANGE_ME","publicHost":"localhost","enabled":true}]
+
+# ── Panel: opsional (ada default di kode) ────────────────────────────────────
+KEYCLOAK_URL=http://127.0.0.1:12080
+KEYCLOAK_CLIENT_ID=sicabe-control-panel
+KEYCLOAK_WEB_URL=http://localhost:12080
+TRINO_URL=https://localhost:12443
+TRINO_WEB_URL=https://localhost:12443
+NESSIE_URL=http://127.0.0.1:12120
+AIRFLOW_URL=http://127.0.0.1:12082
+STARROCKS_HOST=127.0.0.1
+STARROCKS_PORT=12930
+STARROCKS_WEB_URL=http://localhost:12030
+OPENMETADATA_URL=http://127.0.0.1:12085
+GRAFANA_URL=http://127.0.0.1:12300
+MINIO_CONSOLE_URL=http://localhost:12901
+SICABE_COMPOSE_PROJECTS=sicabe