123 lines
5.0 KiB
Bash
123 lines
5.0 KiB
Bash
APP_NAME=Clusev
|
|
APP_ENV=local
|
|
APP_KEY=
|
|
APP_DEBUG=true
|
|
APP_URL=http://localhost
|
|
|
|
APP_LOCALE=de
|
|
APP_FALLBACK_LOCALE=en
|
|
APP_FAKER_LOCALE=de_DE
|
|
|
|
APP_MAINTENANCE_DRIVER=file
|
|
BCRYPT_ROUNDS=12
|
|
|
|
LOG_CHANNEL=stack
|
|
LOG_STACK=single
|
|
LOG_DEPRECATIONS_CHANNEL=null
|
|
LOG_LEVEL=debug
|
|
|
|
# ── Database (MariaDB) ───────────────────────────────────────────────
|
|
DB_CONNECTION=mariadb
|
|
DB_HOST=mariadb
|
|
DB_PORT=3306
|
|
DB_DATABASE=clusev
|
|
DB_USERNAME=clusev
|
|
DB_PASSWORD=change-me-strong
|
|
# mariadb container only (compose), not read by Laravel:
|
|
DB_ROOT_PASSWORD=change-me-strong-root
|
|
|
|
# ── Cache / Queue via Redis · Session via database ───────────────────
|
|
REDIS_CLIENT=phpredis
|
|
REDIS_HOST=redis
|
|
REDIS_PORT=6379
|
|
REDIS_PASSWORD=null
|
|
|
|
CACHE_STORE=redis
|
|
QUEUE_CONNECTION=redis
|
|
# database = sessions are listable/revocable in Settings (Redis stays for cache/queue)
|
|
SESSION_DRIVER=database
|
|
SESSION_LIFETIME=120
|
|
SESSION_ENCRYPT=false
|
|
SESSION_PATH=/
|
|
SESSION_DOMAIN=null
|
|
|
|
# ── Broadcasting (Laravel Reverb) ────────────────────────────────────
|
|
BROADCAST_CONNECTION=reverb
|
|
REVERB_APP_ID=changeme
|
|
REVERB_APP_KEY=changeme
|
|
REVERB_APP_SECRET=changeme
|
|
# client-facing (browser connects to the host-exposed port):
|
|
REVERB_HOST=localhost
|
|
REVERB_PORT=8080
|
|
REVERB_SCHEME=http
|
|
# server bind (inside the container):
|
|
REVERB_SERVER_HOST=0.0.0.0
|
|
REVERB_SERVER_PORT=8080
|
|
|
|
VITE_REVERB_APP_KEY="${REVERB_APP_KEY}"
|
|
VITE_REVERB_HOST="${REVERB_HOST}"
|
|
VITE_REVERB_PORT="${REVERB_PORT}"
|
|
VITE_REVERB_SCHEME="${REVERB_SCHEME}"
|
|
|
|
MAIL_MAILER=log
|
|
FILESYSTEM_DISK=local
|
|
|
|
# ── Docker Compose knobs (host ports / uid / image) ──────────────────
|
|
APP_PORT=80
|
|
VITE_PORT=5173
|
|
REVERB_HOST_PORT=8080
|
|
DB_PORT=3306
|
|
# Containers run as this host user (must own the bind-mount). nexxo=1002 on this VM.
|
|
HOST_UID=1002
|
|
HOST_GID=1002
|
|
# GHCR namespace for prod images (ghcr.io/<owner>/clusev):
|
|
GHCR_OWNER=OWNER
|
|
IMAGE_TAG=latest
|
|
|
|
# ── Reverse proxy / TLS (prod — written by install.sh) ───────────────
|
|
# Single knob: APP_DOMAIN empty -> Caddy serves plain HTTP on APP_PORT (bare-IP).
|
|
# APP_DOMAIN set -> Caddy auto-issues a Let's Encrypt cert + forces HTTPS.
|
|
# Changing the panel domain later = re-run install.sh with the new domain.
|
|
APP_DOMAIN=
|
|
APP_SCHEME=http
|
|
ACME_EMAIL=
|
|
# Deployed commit + branch, shown on the Version page. install.sh fills these from the host's
|
|
# .git (the prod image ships none) — leave empty; in dev the page reads .git directly.
|
|
CLUSEV_BUILD_SHA=
|
|
CLUSEV_BUILD_BRANCH=
|
|
# Update source for the in-app version check. install.sh sets this from the clone origin
|
|
# (git remote get-url origin). Left UNSET (keep this commented), it falls back to the public repo
|
|
# default in config/clusev.php — an empty value here would instead disable the check, so leave the
|
|
# key absent rather than blank. Never put a private repo URL in a tracked file — only in the .env.
|
|
# CLUSEV_REPOSITORY=https://github.com/clusev/clusev
|
|
# Dev-only release controls (dashboard Release page + host git-bridge + live pipeline). Leave unset on
|
|
# any non-dev install. Both values below are PRIVATE — never commit them, set only on the dev box:
|
|
# CLUSEV_RELEASE_CONTROLS=true # enables the /release page + watcher install
|
|
# GIT_STAGING_ACCESS_TOKEN= # GitHub PAT, READ only (Actions:Read + Contents:Read)
|
|
# CLUSEV_STAGING_SLUG=owner/private-mirror # the GitHub-private mirror repo (for live CI status)
|
|
# Display timezone for dashboard times (DB stays UTC). install.sh sets this from the host; UTC default.
|
|
APP_TIMEZONE=UTC
|
|
# External reverse-proxy TLS: set to the upstream proxy's address/CIDR so Caddy trusts its
|
|
# X-Forwarded-Proto. Leave as 127.0.0.1/32 (trust nothing) when Caddy terminates TLS itself.
|
|
TRUSTED_PROXY_CIDR=127.0.0.1/32
|
|
# Derived from APP_DOMAIN by install.sh (":${APP_PORT}" vs "https://${APP_DOMAIN}"):
|
|
SITE_ADDRESS=:80
|
|
# Prod image: locally-built tag, or a pinned GHCR digest (ghcr.io/<owner>/clusev@sha256:..).
|
|
CLUSEV_IMAGE=clusev-app:prod
|
|
# HMAC key for the (v1.x) in-dashboard self-updater intent file — separate from APP_KEY.
|
|
UPDATE_HMAC_KEY=
|
|
# Shared secret between the app and the terminal sidecar (the /terminal page). The sidecar presents
|
|
# it to the internal resolve endpoint that hands out decrypted SSH credentials. install.sh generates
|
|
# it; leave empty to DISABLE the terminal (the resolve endpoint then 403s).
|
|
TERMINAL_SIDECAR_SECRET=
|
|
|
|
# ── Optional demo server (seeded by FleetSeeder) ─────────────────────
|
|
# Leave HOST empty for an empty fleet (add servers at runtime). With a host set,
|
|
# the seeder creates one real server + an encrypted credential. Never committed.
|
|
CLUSEV_DEMO_SSH_NAME=demo-01
|
|
CLUSEV_DEMO_SSH_HOST=
|
|
CLUSEV_DEMO_SSH_PORT=22
|
|
CLUSEV_DEMO_SSH_USER=root
|
|
CLUSEV_DEMO_SSH_PASSWORD=
|
|
# CLUSEV_DEMO_SSH_KEY= # private-key PEM instead of a password (preferred)
|