Linus GasserandClaude Opus 5.5
e7aaf18d2d
- use rustfs instead of minio and provide migration script - Schedule clean_pending_items/purge_deleted_items with celery beat - Give celery workers the S3 access key secret - Collabora admin access needs setting a password Following the [C4DT AI Policy](https://git.coopcloud.tech/c4dt/ai-policy/src/branch/main/AI-POLICY.md): #LLM_vibe #LLM_model Claude Opus 5.5 - [x] I take full responsibility for this code - [x] I understand every line of this code - [x] I tested this code thoroughly on my own computer / servers - [x] None of the commit messages were created using LLMs - [x] I will participate in any discussion on my own and will not use an LLM for the discussion Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
125 lines
5.2 KiB
Bash
125 lines
5.2 KiB
Bash
TYPE=lasuite-drive
|
|
|
|
DOMAIN=lasuite-drive.example.com
|
|
# public domain of the RustFS object storage (S3)
|
|
RUSTFS_DOMAIN="rustfs.${DOMAIN}"
|
|
COLLABORA_DOMAIN="collabora.${DOMAIN}"
|
|
ONLY_OFFICE_DOMAIN="onlyoffice.${DOMAIN}"
|
|
|
|
## Domain aliases
|
|
#EXTRA_DOMAINS=', `www.lasuite-docs.example.com`'
|
|
|
|
LETS_ENCRYPT_ENV=production
|
|
|
|
##############################################################################
|
|
# SECRETS
|
|
##############################################################################
|
|
# abbreviations are to fit abra 12 char secret recommendation
|
|
# DJANGO_SECRET_KEY
|
|
SECRET_DJANGO_SK_VERSION=v1
|
|
# ODIC_RP_CLIENT_SECRET
|
|
SECRET_OIDC_RPCS_VERSION=v1
|
|
# DJANGO_SUPERUSER_PASSWORD
|
|
SECRET_DJANGO_SP_VERSION=v1
|
|
# RUSTFS_SECRET_KEY
|
|
SECRET_RUSTFS_RP_VERSION=v1
|
|
# RUSTFS_ACCESS_KEY
|
|
SECRET_RUSTFS_RU_VERSION=v1
|
|
# POSTGRES_PASSWORD
|
|
SECRET_POSTGRES_P_VERSION=v1
|
|
# DJANGO_HOST_EMAIL_PASSWORD
|
|
SECRET_EMAIL_PASS_VERSION=v1
|
|
|
|
##############################################################################
|
|
# EMAIL
|
|
##############################################################################
|
|
DJANGO_EMAIL_BRAND_NAME="La Suite Numérique"
|
|
DJANGO_EMAIL_HOST="mail.example.com"
|
|
DJANGO_EMAIL_LOGO_IMG="http://$DOMAIN/assets/logo-suite-numerique.png"
|
|
DJANGO_EMAIL_PORT=1025
|
|
DJANGO_EMAIL_USE_SSL=True
|
|
DJANGO_EMAIL_USE_TLS=False
|
|
DJANGO_EMAIL_FROM=mail@example.com
|
|
|
|
##############################################################################
|
|
# SINGLE SIGN ON
|
|
##############################################################################
|
|
# NOTE: OpenID Connect (OIDC) single sign-on is **required**, see recipe README
|
|
OIDC_REALM=yourkeycloakrealm
|
|
AUTH_DOMAIN="auth.${DOMAIN}"
|
|
OIDC_OP_JWKS_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/certs
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/auth
|
|
OIDC_OP_TOKEN_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/token
|
|
OIDC_OP_USER_ENDPOINT=https://${AUTH_DOMAIN}/realms/${OIDC_REALM}/protocol/openid-connect/userinfo
|
|
OIDC_RP_CLIENT_ID=yourkeycloakclientid
|
|
OIDC_RP_SIGN_ALGO=RS256
|
|
OIDC_RP_SCOPES="openid email"
|
|
LOGIN_REDIRECT_URL=https://${DOMAIN}
|
|
LOGIN_REDIRECT_URL_FAILURE=https://${DOMAIN}
|
|
LOGOUT_REDIRECT_URL=https://${DOMAIN}
|
|
OIDC_REDIRECT_ALLOWED_HOSTS='["https://${AUTH_DOMAIN}", "https://${DOMAIN}"]'
|
|
OIDC_AUTH_REQUEST_EXTRA_PARAMS='{"acr_values": "eidas1"}'
|
|
|
|
##############################################################################
|
|
# LOGGING
|
|
##############################################################################
|
|
LOGGING_LEVEL_HANDLERS_CONSOLE=INFO
|
|
LOGGING_LEVEL_LOGGERS_ROOT=INFO
|
|
LOGGING_LEVEL_LOGGERS_APP=INFO
|
|
|
|
##############################################################################
|
|
# MIGRATIONS
|
|
##############################################################################
|
|
# Set to false to disable automatic migrations on backend startup
|
|
# AUTO_MIGRATIONS=true
|
|
|
|
##############################################################################
|
|
# COLLABORA ADMIN PANEL
|
|
##############################################################################
|
|
# Username for the Collabora admin panel (https://COLLABORA_DOMAIN/browser/dist/admin/admin.html)
|
|
# The distroless collabora image (>= 26.04) cannot read Docker secrets, so the
|
|
# password is passed as a plain env var (visible in `docker service inspect`).
|
|
# The admin panel is unusable while it is unset.
|
|
#COLLABORA_ADMIN_USERNAME=admin
|
|
#COLLABORA_ADMIN_PASSWORD=
|
|
|
|
##############################################################################
|
|
# BACKUPS
|
|
##############################################################################
|
|
# Set to false to disable backup-bot labels (default: true)
|
|
#ENABLE_BACKUPS=true
|
|
|
|
##############################################################################
|
|
# MAINTENANCE SCHEDULING
|
|
##############################################################################
|
|
# Celery Beat crontab (m h dom mon dow) followed by the command arguments
|
|
# Clean up uploads that never finished (default: daily at 0:30)
|
|
#CLEAN_PENDING_ITEMS_SCHEDULE="30 0 * * * --hours=48"
|
|
# Permanently purge items deleted from the trash (default: daily at 0:45)
|
|
#PURGE_DELETED_ITEMS_SCHEDULE="45 0 * * *"
|
|
|
|
##############################################################################
|
|
# SDK
|
|
##############################################################################
|
|
# Enable the SDK picker pages (/sdk) and relay API used by other La Suite apps
|
|
#SDK_ENABLED=false
|
|
|
|
##############################################################################
|
|
# MINIO MIGRATION
|
|
##############################################################################
|
|
# Only needed once when upgrading from recipe versions using MinIO (<= 0.13.x),
|
|
# see README "Migrating from MinIO"
|
|
#COMPOSE_FILE="compose.yml:compose.minio-migration.yml"
|
|
# versions of the old MinIO secrets, keep them from your previous config
|
|
#SECRET_MINIO_RP_VERSION=v1
|
|
#SECRET_MINIO_RU_VERSION=v1
|
|
|
|
##############################################################################
|
|
# WOPI SCHEDULING
|
|
##############################################################################
|
|
# Celery Beat crontab for the WOPI configuration task (default: daily at 3:00 AM)
|
|
#WOPI_CONFIGURATION_CRONTAB_MINUTE=0
|
|
#WOPI_CONFIGURATION_CRONTAB_HOUR=3
|
|
#WOPI_CONFIGURATION_CRONTAB_DAY_OF_MONTH=*
|
|
#WOPI_CONFIGURATION_CRONTAB_MONTH_OF_YEAR=*
|