75 lines
4.7 KiB
Bash
75 lines
4.7 KiB
Bash
|
# ─────────────────────────────────────────────────────────────────────────────
|
||
|
|
# sitomat control plane — copy to `docker/.env` and edit.
|
||
|
|
# cp docker/env.example docker/.env
|
||
|
|
#
|
||
|
|
# (Named `env.example`, not `.env.example`, on purpose: the tooling policy in
|
||
|
|
# this repo blocks files matching `*.env*`. The copy target `docker/.env` IS
|
||
|
|
# gitignored and is excluded from the image build context.)
|
||
|
|
#
|
||
|
|
# SINGLE DOMAIN (Opsi A): the reverse proxy serves the web UI AND the API on ONE
|
||
|
|
# origin, split by path. See docs/deployment.md → "Docker" and the nginx
|
||
|
|
# template at docker/nginx/templates/default.conf.template.
|
||
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
||
|
|
|
||
|
|
# ── REQUIRED ─────────────────────────────────────────────────────────────────
|
||
|
|
# Generate a fresh one — never reuse an example value:
|
||
|
|
# openssl rand -base64 32
|
||
|
|
BETTER_AUTH_SECRET=aLNwbyLRHByb9T9DWFpR4Ck88WAk9kuMGXAwLu6eV6g=
|
||
|
|
|
||
|
|
# ── REGISTRY IMAGES ──────────────────────────────────────────────────────────
|
||
|
|
# Which images the DEPLOY file pulls. Set BOTH here on the build host (used by
|
||
|
|
# docker/build-push.sh) and on EVERY deploy host. Example:
|
||
|
|
# SITOMAT_IMAGE_REGISTRY=registry.contoh.go.id/sitomat
|
||
|
|
# SITOMAT_IMAGE_TAG=1.0.0
|
||
|
|
# Deploy host then only needs: docker compose … pull && docker compose … up -d
|
||
|
|
SITOMAT_IMAGE_REGISTRY=registry.sicabe.com/sitomat
|
||
|
|
SITOMAT_IMAGE_TAG=1.0.0
|
||
|
|
|
||
|
|
# ── PUBLIC ORIGIN — ONE domain for web + API (Opsi A) ────────────────────────
|
||
|
|
# Both values are the SAME single origin; the proxy splits it by path.
|
||
|
|
# • no domain yet → server IP + proxy port, e.g. http://192.168.1.10:8080
|
||
|
|
# • with TLS → https://sitomat.contoh.go.id
|
||
|
|
# Exact origin: scheme + host + port, NO trailing slash.
|
||
|
|
#
|
||
|
|
# These are RUNTIME values (BETTER_AUTH_URL / WEB_URL) — change + `up -d` only.
|
||
|
|
API_PUBLIC_URL=http://localhost:8080
|
||
|
|
WEB_PUBLIC_URL=http://localhost:8080
|
||
|
|
|
||
|
|
# ── WEB API BASE (build-time) — LEAVE EMPTY ──────────────────────────────────
|
||
|
|
# Empty (recommended) = same-origin: the browser client resolves the API against
|
||
|
|
# `window.location.origin` and download links are relative, so the web image is
|
||
|
|
# DOMAIN-AGNOSTIC — changing the public domain needs NO rebuild.
|
||
|
|
# Set an absolute origin ONLY for the two-domain (split) setup; then a domain
|
||
|
|
# change requires: docker compose … build web && docker compose … up -d web
|
||
|
|
WEB_API_BASE_URL=
|
||
|
|
|
||
|
|
# ── HOST PORTS (optional) ────────────────────────────────────────────────────
|
||
|
|
# The single public entry is the PROXY. The api/web ports are for direct
|
||
|
|
# debugging only — the proxy reaches them on the compose network.
|
||
|
|
API_PORT=13000
|
||
|
|
WEB_PORT=13001
|
||
|
|
PROXY_PORT=8080
|
||
|
|
|
||
|
|
# ── SESSION COOKIE DOMAIN — leave EMPTY in single-domain mode ────────────────
|
||
|
|
# One origin ⇒ host-only cookie, which is exactly right. Set this ONLY if you
|
||
|
|
# deliberately put the web and API on DIFFERENT subdomains (not Opsi A).
|
||
|
|
#SESSION_COOKIE_DOMAIN=
|
||
|
|
|
||
|
|
# ── KEYCLOAK SSO (optional) ──────────────────────────────────────────────────
|
||
|
|
# Leave ALL THREE empty to disable Keycloak entirely. Setting OIDC_CLIENT_ID
|
||
|
|
# without OIDC_ISSUER_URL makes the API refuse to boot (fail fast).
|
||
|
|
#OIDC_CLIENT_ID=
|
||
|
|
#OIDC_CLIENT_SECRET=
|
||
|
|
#OIDC_ISSUER_URL=
|
||
|
|
|
||
|
|
# ── WEB BUILD FLAGS ──────────────────────────────────────────────────────────
|
||
|
|
# 🚨 NEXT_PUBLIC_DEMO_LOGIN must stay `false` on any server others can reach:
|
||
|
|
# `true` lets anyone sign in as any role WITHOUT a password.
|
||
|
|
NEXT_PUBLIC_DEMO_LOGIN=true
|
||
|
|
NEXT_PUBLIC_KEYCLOAK_ENABLED=false
|
||
|
|
|
||
|
|
# ── REVERSE PROXY (profile "proxy") ──────────────────────────────────────────
|
||
|
|
# The single hostname the proxy answers for (envsubst → nginx `server_name`).
|
||
|
|
# With a real domain: PUBLIC_HOST=sitomat.contoh.go.id
|
||
|
|
PUBLIC_HOST=localhost
|