57 lines
1.8 KiB
Bash
57 lines
1.8 KiB
Bash
# NEXPA SourceHub 3.8 Production Candidate
|
|
SOURCEHUB_MAX_UPLOAD_MB=500
|
|
SOURCEHUB_ALLOWED_HOSTS=localhost,127.0.0.1,sourcehub.nexpa-ai.com
|
|
|
|
# ---------- Database ----------
|
|
# SOURCEHUB_DATABASE_URL=postgresql+psycopg://sourcehub:CHANGE_ME@postgres:5432/sourcehub
|
|
SOURCEHUB_DATA_DIR=data
|
|
|
|
# ---------- Storage ----------
|
|
SOURCEHUB_STORAGE_BACKEND=local
|
|
SOURCEHUB_STORAGE_DIR=storage
|
|
# SOURCEHUB_STORAGE_BACKEND=minio
|
|
# SOURCEHUB_MINIO_ENDPOINT=minio:9000
|
|
# SOURCEHUB_MINIO_ACCESS_KEY=CHANGE_ME
|
|
# SOURCEHUB_MINIO_SECRET_KEY=CHANGE_ME_LONG
|
|
# SOURCEHUB_MINIO_BUCKET=nexpa-sourcehub
|
|
# SOURCEHUB_MINIO_SECURE=false
|
|
|
|
# ---------- Authentication ----------
|
|
SOURCEHUB_AUTH_MODE=mock
|
|
SOURCEHUB_SESSION_SECRET=CHANGE_ME_TO_LONG_RANDOM_VALUE
|
|
SOURCEHUB_SESSION_HTTPS_ONLY=false
|
|
SOURCEHUB_CSRF_ENABLED=false
|
|
|
|
# Production OIDC
|
|
# SOURCEHUB_AUTH_MODE=oidc
|
|
# SOURCEHUB_SESSION_HTTPS_ONLY=true
|
|
# SOURCEHUB_CSRF_ENABLED=true
|
|
# SOURCEHUB_OIDC_METADATA_URL=https://<NEXPA-CORE>/.well-known/openid-configuration
|
|
# SOURCEHUB_OIDC_CLIENT_ID=<CLIENT_ID>
|
|
# SOURCEHUB_OIDC_CLIENT_SECRET=<CLIENT_SECRET>
|
|
# SOURCEHUB_OIDC_ROLE_CLAIM=roles
|
|
|
|
# ---------- Download security ----------
|
|
SOURCEHUB_DOWNLOAD_SECRET=CHANGE_ME_TO_ANOTHER_LONG_RANDOM_VALUE
|
|
SOURCEHUB_DOWNLOAD_TTL_SECONDS=300
|
|
|
|
# ---------- Malware scan ----------
|
|
SOURCEHUB_MALWARE_SCAN=disabled
|
|
# SOURCEHUB_MALWARE_SCAN=clamd
|
|
# SOURCEHUB_CLAMD_HOST=clamav
|
|
# SOURCEHUB_CLAMD_PORT=3310
|
|
|
|
# ---------- Gitea ----------
|
|
# SOURCEHUB_GITEA_BASE_URL=https://git.example.com
|
|
# SOURCEHUB_GITEA_TOKEN=<TOKEN>
|
|
|
|
# ---------- Deployment executor ----------
|
|
SOURCEHUB_DEPLOY_MODE=disabled
|
|
# SOURCEHUB_DEPLOY_MODE=webhook
|
|
# SOURCEHUB_DEPLOY_WEBHOOK_SECRET=<LONG_SHARED_SECRET>
|
|
# SOURCEHUB_DEPLOY_TARGETS_JSON={"core:PRODUCTION BASELINE":"https://deploy.internal/sourcehub/core"}
|
|
|
|
# ---------- Security headers ----------
|
|
SOURCEHUB_ENABLE_HSTS=false
|
|
# Production behind HTTPS: true
|