147 lines
8.7 KiB
Bash
147 lines
8.7 KiB
Bash
# ============================================================================
|
|
# SiCABE Control Panel — konfigurasi env (salin ke .env lalu sesuaikan)
|
|
#
|
|
# SEMUA URL service dapat di-override dari environment. Nilai default di bawah
|
|
# memakai nama service dalam network compose (sicabe-doc/deploy, `name: sicabe`).
|
|
# Bila panel dijalankan DI HOST, pakai port host (12xxx) seperti kolom "host".
|
|
#
|
|
# Konvensi:
|
|
# * var tanpa prefix -> dibaca sisi SERVER (fetch/API, rahasia aman)
|
|
# * *_WEB_URL dll -> tautan/UI client; di-fetch dari /api/platform/endpoints
|
|
# * .env TIDAK di-commit; contoh ini ikut di-track (!.env.example)
|
|
# ============================================================================
|
|
|
|
# ── Trino ────────────────────────────────────────────────────────────────────
|
|
# Endpoint SQL/API (route /api/trino & /api/query). HTTPS saja: Trino memakai
|
|
# auth hybrid OAuth2 + Basic dengan allow-insecure-over-http=false (HTTP polos
|
|
# tidak melayani apa pun). Login dev pun memakai Bearer, didapat via Keycloak
|
|
# ROPC di CredentialsProvider.
|
|
# SSO & dev (Bearer/JWT) : HTTPS → https://localhost:12443
|
|
# dalam compose : http://trino:8080
|
|
TRINO_URL=https://localhost:12443
|
|
# CA utk Trino HTTPS self-signed. Pin sertifikat server (PEM) di sini.
|
|
# Bisa juga per-host lewat `caPem` di SICABE_HOSTS (lebih diutamakan).
|
|
TRINO_CA_FILE=.ca/trino.crt
|
|
# Nama host (entri SICABE_HOSTS) yang menjalankan Trino — untuk memilih CA per-host.
|
|
#SICABE_TRINO_HOST=host-prod-1
|
|
# Trino Web UI.
|
|
#TRINO_WEB_URL=https://localhost:12443
|
|
|
|
# ── Keycloak ─────────────────────────────────────────────────────────────────
|
|
# Base URL + realm utk OIDC (login panel & refresh token).
|
|
# dalam compose : http://keycloak:8080
|
|
# host : http://localhost:12080
|
|
KEYCLOAK_URL=http://keycloak:8080
|
|
KEYCLOAK_REALM=sicabe
|
|
# Client OIDC panel (harus ada di realm tsb).
|
|
KEYCLOAK_CLIENT_ID=sicabe-control-panel
|
|
# Secret client. WAJIB di-production (tanpa nilai -> fail saat login).
|
|
#KEYCLOAK_CLIENT_SECRET=
|
|
# Admin Console Keycloak (tautan dashboard utk admin).
|
|
#KEYCLOAK_WEB_URL=http://localhost:12080
|
|
|
|
# ── Iceberg table explorer backend (Nessie) ──────────────────────────────────
|
|
# Halaman /tables memakai catalog Iceberg REST Nessie.
|
|
# base ops = {NESSIE_URL}/iceberg/v1/{NESSIE_BRANCH}.
|
|
# dalam compose : http://nessie:19120
|
|
# host : http://localhost:12120
|
|
#NESSIE_URL=http://nessie:19120
|
|
#NESSIE_BRANCH=main
|
|
|
|
# ── Dremio (REST v3 — sources & SQL) ────────────────────────────────────────
|
|
# Endpoint REST Dremio OSS + kredensial lokal (login /apiv2 -> token _dremio).
|
|
# dalam compose : http://dremio:9047
|
|
# host : http://localhost:12947
|
|
DREMIO_URL=http://dremio:9047
|
|
DREMIO_USER=
|
|
DREMIO_PASSWORD=
|
|
|
|
# ── MinIO ────────────────────────────────────────────────────────────────────
|
|
# MinIO Console (tautan dashboard & sidebar).
|
|
# host : http://localhost:12901
|
|
#MINIO_CONSOLE_URL=http://localhost:12901
|
|
|
|
# ── StarRocks ────────────────────────────────────────────────────────────────
|
|
# FE MySQL protocol (route /api/starrocks).
|
|
# dalam compose : STARROCKS_HOST=starrocks-fe, PORT=9030
|
|
# host : STARROCKS_HOST=localhost, PORT=12930
|
|
STARROCKS_HOST=localhost
|
|
STARROCKS_PORT=12930
|
|
STARROCKS_USER=root
|
|
#STARROCKS_PASSWORD=
|
|
# StarRocks UI HTTP (tautan halaman StarRocks).
|
|
#STARROCKS_WEB_URL=http://localhost:12030
|
|
|
|
# ── Apache Airflow ───────────────────────────────────────────────────────────
|
|
# Base URL — dipakai utk REST API (lib/airflow) DAN tautan UI (sidebar/dashboard).
|
|
# dalam compose : http://airflow-webserver:8080
|
|
# host : http://localhost:12082
|
|
AIRFLOW_URL=http://localhost:12082
|
|
AIRFLOW_USER=admin
|
|
|
|
# ── OpenMetadata & Grafana (governance) ──────────────────────────────────────
|
|
# URL API/UI — single source (halaman governance + tautan).
|
|
# host : OpenMetadata http://localhost:12085, Grafana http://localhost:12300
|
|
OPENMETADATA_URL=http://localhost:12085
|
|
GRAFANA_URL=http://localhost:12300
|
|
|
|
# ── Auth (NextAuth) ──────────────────────────────────────────────────────────
|
|
NEXTAUTH_URL=http://localhost:3000
|
|
# WAJIB di-production.
|
|
# ── Login lokal (hybrid dengan SSO) ──────────────────────────────────────────
|
|
# Akun admin LOKAL dari env — bisa login tanpa browser SSO, berlaku juga di
|
|
# produksi. Password = BCRYPT HASH (bukan plaintext).
|
|
# Buat hash: node -e "console.log(require('bcryptjs').hashSync('PASSWORD',10))"
|
|
# Untuk Docker/Compose pakai varian _B64 (bcrypt memuat '$' yang bisa di-
|
|
# interpolasi Compose):
|
|
# node -e "console.log(Buffer.from(require('bcryptjs').hashSync('PASSWORD',10)).toString('base64'))"
|
|
#PANEL_LOCAL_USER=admin
|
|
#PANEL_LOCAL_PASSWORD_HASH=$2b$10$...
|
|
#PANEL_LOCAL_PASSWORD_HASH_B64=JDJiJDEwJC4uLg==
|
|
#PANEL_LOCAL_ROLE=data-admin
|
|
# Identitas Trino untuk sesi login lokal (tanpa JWT Keycloak): service account.
|
|
# Password dibaca dari .env platform via config-agent → TRINO_SVC_<ACC>_PASSWORD.
|
|
#TRINO_SERVICE_ACCOUNT=svc_dbt
|
|
#NEXTAUTH_SECRET=
|
|
|
|
# ── Multi-host Docker control ────────────────────────────────────────────────
|
|
# Registry host Docker yang dikelola panel (via docker-socket-proxy per host).
|
|
# Nilai JSON array. Bila kosong → default single host http://127.0.0.1:2375
|
|
# (kompatibel perilaku lama).
|
|
# Field per host: name (unik), proxyUrl, apiKey (opsional), enabled,
|
|
# sshTunnel (opsional: {host, port, user}).
|
|
# Multi-host (opsional, untuk Tahap 2): configUrl/configApiKey menunjuk ke
|
|
# `sicabe-config-agent` host tsb; caPem = CA TLS host (PEM) bila perlu.
|
|
# ⚠️ apiKey/configApiKey adalah SECRET — jangan di-commit; isi via env/deploy.
|
|
# Development lokal (single host, tanpa proxy):
|
|
# SICABE_HOSTS='[{"name":"local","proxyUrl":"unix:///var/run/docker.sock","enabled":true}]'
|
|
#SICABE_HOSTS='[{"name":"host-prod-1","proxyUrl":"http://127.0.0.1:22375","apiKey":"","configUrl":"http://127.0.0.1:22375","configApiKey":"","enabled":true}]'
|
|
# Config panel yang PERSISTEN (hosts/modules/services), diedit dari UI Settings.
|
|
# Bila file ini ada, ia MENGGANTIKAN SICABE_HOSTS di atas (env = seed saja).
|
|
# Memuat api key → gitignored, perms 0600.
|
|
#SICABE_CONFIG_FILE=data/config.json
|
|
# Lokasi file state (monitored toggle per container). Default data/state.json.
|
|
# Key = `${host}/${container}` (kompatibel dgn key lama `${container}`).
|
|
#SICABE_STATE_FILE=data/state.json
|
|
# Daftar project Docker Compose yang dimonitor (label com.docker.compose.project).
|
|
# Comma-separated; default "sicabe".
|
|
#SICABE_COMPOSE_PROJECTS=sicabe
|
|
# Override host per-service (opsional). Bila kosong, host di-resolve otomatis
|
|
# dari daftar host/komponen (dipakai untuk membaca kredensial dari host yang tepat).
|
|
#SICABE_AIRFLOW_HOST=host-prod-1
|
|
#SICABE_STARROCKS_HOST=host-prod-1
|
|
# Host yang menjalankan OPA (menu Authorization; baca/tulis config/opa/data.json).
|
|
#SICABE_OPA_HOST=host-prod-1
|
|
|
|
# ── Lain-lain ────────────────────────────────────────────────────────────────
|
|
# Direktori catalog Trino & file .env platform (bila dijalankan non-standar).
|
|
# .env platform dibaca READ-ONLY oleh panel (tidak pernah ditimpa).
|
|
#TRINO_CATALOG_DIR=deploy/config/trino/catalog
|
|
#SICABE_ENV_FILE=deploy/.env
|
|
# Dokumen data OPA (ACL authz Trino) — dibaca menu Authorization lewat ConfigStore.
|
|
#OPA_DATA_FILE=/path/ke/sicabe-doc/deploy/config/opa/data.json
|
|
# Project dbt SiCABE (dibaca /api/dbt untuk models, sources, lineage DAG).
|
|
# Panel di host: arahkan ke folder platform (mis. sicabe-doc/deploy/config/airflow/dbt/sicabe).
|
|
#DBT_PROJECT_DIR=/path/ke/sicabe-doc/deploy/config/airflow/dbt/sicabe
|
|
# Password admin Airflow dibaca dari SICABE_ENV_FILE (AIRFLOW_ADMIN_PASSWORD).
|