64 lines
2.7 KiB
PHP
64 lines
2.7 KiB
PHP
<?php
|
|
|
|
namespace App\Support;
|
|
|
|
/**
|
|
* Deployment configuration an operator can change from the console instead of
|
|
* editing .env and restarting: which DNS zone customer instances live under,
|
|
* where the WireGuard hub is reachable, where Traefik's dynamic config lives,
|
|
* the public half of the SSH identity, and where the monitoring bridge is.
|
|
*
|
|
* None of these are secret — the counterpart credentials live in SecretVault,
|
|
* not here — but several are read from more than one class, so the Settings
|
|
* key name and its .env-derived default are centralised here rather than
|
|
* repeated at every call site, where a copy-pasted default could drift from
|
|
* the others.
|
|
*
|
|
* Falls back to the existing config() value (itself env()-derived) when
|
|
* nothing has been saved from the console yet, so an installation that
|
|
* already has these in .env keeps working unchanged until an operator
|
|
* chooses to move a value onto this page.
|
|
*
|
|
* Deliberately NOT here: CLUPILOT_WG_SUBNET and CLUPILOT_WG_HUB_IP. The
|
|
* compose file reads them too (vpn-dns, vpn-gateway), at container boot —
|
|
* moving them here would let the console show one value while the containers
|
|
* that already started keep another, which is worse than the single .env
|
|
* source of truth it would replace. KUMA_URL/KUMA_USERNAME are the same
|
|
* problem one layer further out: docker/kuma-bridge/app.py reads them from
|
|
* its own process environment at boot, and nothing in this application reads
|
|
* them at all, so there is no consumer here to wire them to.
|
|
*/
|
|
final class ProvisioningSettings
|
|
{
|
|
public static function dnsZone(): string
|
|
{
|
|
return (string) Settings::get('provisioning.dns_zone', (string) config('provisioning.dns.zone'));
|
|
}
|
|
|
|
public static function wgEndpoint(): string
|
|
{
|
|
return (string) Settings::get('provisioning.wg_endpoint', (string) config('provisioning.wireguard.endpoint'));
|
|
}
|
|
|
|
public static function wgHubPublicKey(): string
|
|
{
|
|
return (string) Settings::get('provisioning.wg_hub_pubkey', (string) config('provisioning.wireguard.hub_public_key'));
|
|
}
|
|
|
|
public static function traefikDynamicPath(): string
|
|
{
|
|
return (string) Settings::get('provisioning.traefik_dynamic_path', (string) config('provisioning.traefik.dynamic_path'));
|
|
}
|
|
|
|
/** The PUBLIC half only. The private key is a secret — see SecretVault's ssh.private_key. */
|
|
public static function sshPublicKey(): string
|
|
{
|
|
return (string) Settings::get('provisioning.ssh_public_key', (string) config('provisioning.ssh.public_key'));
|
|
}
|
|
|
|
public static function monitoringUrl(): string
|
|
{
|
|
return (string) Settings::get('monitoring.api_url', (string) config('services.monitoring.url'));
|
|
}
|
|
}
|