Linus Gasser
262bd5a02e
- the new yhub service needs new initialisation and RSA keys - SOFT_MIGRATION on by default, add migrate_documents command - back up the yhub database too - document the v5 -> v6 upgrade in README and release/next Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md): #LLM_vibe #LLM_model Claude Opus 5.5 - [x] I take full responsibility for this code - [x] I understand every line of this code - [x] I tested this code thoroughly on my own computer / servers - [x] None of the commit messages were created using LLMs - [x] I will participate in any discussion on my own and will not use an LLM for the discussion
121 lines
5.2 KiB
Bash
121 lines
5.2 KiB
Bash
TYPE=lasuite-docs
|
|
|
|
DOMAIN=lasuite-docs.example.com
|
|
|
|
## Domain aliases
|
|
#EXTRA_DOMAINS=', `www.lasuite-docs.example.com`'
|
|
|
|
LETS_ENCRYPT_ENV=production
|
|
|
|
##############################################################################
|
|
# SECRETS
|
|
##############################################################################
|
|
# abbreviations are to fit abra 12 char secret recommendation
|
|
# DJANGO_SECRET_KEY
|
|
SECRET_DJANGO_SK_VERSION=v1
|
|
# ODIC_RP_CLIENT_SECRET
|
|
SECRET_OIDC_RPCS_VERSION=v1
|
|
# DJANGO_SUPERUSER_PASSWORD
|
|
SECRET_DJANGO_SP_VERSION=v1
|
|
# MINIO_ROOT_PASSWORD
|
|
SECRET_MINIO_RP_VERSION=v1
|
|
# MINIO_ROOT_USER
|
|
SECRET_MINIO_RU_VERSION=v1
|
|
# POSTGRES_PASSWORD
|
|
SECRET_POSTGRES_P_VERSION=v1
|
|
# Y_PROVIDER_API_KEY
|
|
SECRET_Y_API_KEY_VERSION=v1
|
|
# DJANGO_HOST_EMAIL_PASSWORD
|
|
SECRET_EMAIL_PASS_VERSION=v1
|
|
# JWT_PRIVATE_KEY of the backend (RSA PEM, must be inserted manually, see README)
|
|
SECRET_JWT_PK_VERSION=v1 # generate=false
|
|
# YHUB_JWT_PRIVATE_KEY of the collaboration server (RSA PEM, must be inserted manually, see README)
|
|
SECRET_YHUB_JWT_PK_VERSION=v1 # generate=false
|
|
|
|
##############################################################################
|
|
# EMAIL
|
|
##############################################################################
|
|
DJANGO_EMAIL_BRAND_NAME="La Suite Numérique"
|
|
DJANGO_EMAIL_HOST="mail.example.com"
|
|
DJANGO_EMAIL_LOGO_IMG="http://$DOMAIN/assets/logo-suite-numerique.png"
|
|
DJANGO_EMAIL_PORT=1025
|
|
DJANGO_EMAIL_USE_SSL=True
|
|
DJANGO_EMAIL_USE_TLS=False
|
|
DJANGO_EMAIL_FROM=mail@example.com
|
|
|
|
##############################################################################
|
|
# SINGLE SIGN ON
|
|
##############################################################################
|
|
# NOTE: OpenID Connect (OIDC) single sign-on is **required**, see recipe README
|
|
OIDC_REALM=yourkeycloakrealm
|
|
AUTH_DOMAIN=yourkeycloakdomain
|
|
OIDC_OP_JWKS_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/certs
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/auth
|
|
OIDC_OP_TOKEN_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/token
|
|
OIDC_OP_USER_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo
|
|
OIDC_RP_CLIENT_ID=yourkeycloakclientid
|
|
OIDC_RP_SIGN_ALGO=RS256
|
|
OIDC_RP_SCOPES="openid email"
|
|
LOGIN_REDIRECT_URL=https://${DOMAIN}
|
|
LOGIN_REDIRECT_URL_FAILURE=https://${DOMAIN}
|
|
LOGOUT_REDIRECT_URL=https://${DOMAIN}
|
|
OIDC_REDIRECT_ALLOWED_HOSTS='["https://auth.${DOMAIN}", "https://${DOMAIN}"]'
|
|
OIDC_AUTH_REQUEST_EXTRA_PARAMS='{"acr_values": "eidas1"}'
|
|
|
|
##############################################################################
|
|
# LOGGING
|
|
##############################################################################
|
|
LOGGING_LEVEL_HANDLERS_CONSOLE=INFO
|
|
LOGGING_LEVEL_LOGGERS_ROOT=INFO
|
|
LOGGING_LEVEL_LOGGERS_APP=INFO
|
|
|
|
##############################################################################
|
|
# MIGRATIONS
|
|
##############################################################################
|
|
# Set to false to disable automatic migrations on backend startup
|
|
# AUTO_MIGRATIONS=true
|
|
|
|
##############################################################################
|
|
# CONVERSION (file upload → Yjs via y-provider)
|
|
##############################################################################
|
|
# Allow uploading .docx/.md files for conversion to Yjs.
|
|
# Recipe sets this to true (upstream default is false).
|
|
# CONVERSION_UPLOAD_ENABLED=true
|
|
# Upstream defaults (uncomment to override):
|
|
# CONVERSION_FILE_MAX_SIZE=20971520
|
|
# CONVERSION_FILE_EXTENSIONS_ALLOWED=.docx,.md
|
|
# CONVERSION_API_ENDPOINT=convert
|
|
# CONVERSION_API_CONTENT_FIELD=content
|
|
# CONVERSION_API_TIMEOUT=30
|
|
# CONVERSION_API_SECURE=false
|
|
|
|
##############################################################################
|
|
# DATABASE CONNECTION POOL
|
|
##############################################################################
|
|
# Upstream default (uncomment to override):
|
|
# DB_PSYCOPG_POOL_ENABLED=false
|
|
|
|
##############################################################################
|
|
# EMAIL APP URL
|
|
##############################################################################
|
|
# DJANGO_EMAIL_URL_APP is set automatically in compose.yml to https://${DOMAIN}.
|
|
# Override is not exposed via .env — edit compose.yml directly if needed.
|
|
# (Upstream default falls back to Django's Site framework, not configured here.)
|
|
|
|
##############################################################################
|
|
# MEDIA AUTH HEADER
|
|
##############################################################################
|
|
# Header the backend reads for media auth subrequests.
|
|
# Upstream default matches the recipe's nginx config (X-Original-URL).
|
|
# MEDIA_AUTH_ORIGINAL_URL_HEADER=HTTP_X_ORIGINAL_URL
|
|
|
|
##############################################################################
|
|
# COLLABORATION SERVER (yhub) - SOFT MIGRATION
|
|
##############################################################################
|
|
# Since v6 the document content lives in the collaboration server, not in the
|
|
# media bucket. With SOFT_MIGRATION, a pre-v6 document is copied over the first
|
|
# time it is opened. Only set to false once
|
|
# `abra app cmd <app-name> backend migrate_documents` has covered all documents
|
|
# (or on a fresh v6 install); unmigrated documents would otherwise open empty.
|
|
# SOFT_MIGRATION=true
|