87 lines
3.3 KiB
Bash
87 lines
3.3 KiB
Bash
# Environment configuration for KCA. Copy to .env or export the variables.
|
|
|
|
# --- Database --------------------------------------------------------------
|
|
# PostgreSQL (default). Run `aerich upgrade` before starting the app.
|
|
DATABASE_ENGINE=postgres
|
|
DATABASE_HOST=localhost
|
|
DATABASE_PORT=5432
|
|
DATABASE_NAME=kca
|
|
DATABASE_USER=kca
|
|
DATABASE_PASSWORD=password
|
|
#DATABASE_OPTIONS=
|
|
#DATABASE_URL=
|
|
|
|
# SQLite production alternative: DATABASE_NAME is an absolute or relative file
|
|
# path; host, port, user and password are ignored. Use a persistent writable
|
|
# filesystem and run `aerich upgrade` before starting the app.
|
|
#DATABASE_ENGINE=sqlite
|
|
#DATABASE_NAME=/data/kca.db
|
|
#DATABASE_OPTIONS=busy_timeout=5000
|
|
# Equivalent single-setting form:
|
|
#DATABASE_URL=sqlite:///data/kca.db?busy_timeout=5000
|
|
|
|
# --- OIDC ------------------------------------------------------------------
|
|
# Indexed blocks OIDC_0_*, OIDC_1_*, ... with contiguous indices from 0.
|
|
OIDC_0_PROVIDER=default
|
|
OIDC_0_ISSUER=http://localhost:8180/kca
|
|
OIDC_0_CLIENT_ID=kca
|
|
OIDC_0_CLIENT_SECRET=dev-secret
|
|
OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback
|
|
OIDC_0_POST_LOGIN_REDIRECT=http://localhost:8080/
|
|
OIDC_0_POST_LOGOUT_REDIRECT=http://localhost:8080/
|
|
|
|
# --- Sessions --------------------------------------------------------------
|
|
REDIS_URL=redis://localhost:6379/0
|
|
|
|
# --- Private-key encryption ------------------------------------------------
|
|
# REQUIRED in production: a random 32-byte AES-256 key, base64 or hex.
|
|
# openssl rand -base64 32
|
|
# When unset, a built-in development key is used (the UI warns about it).
|
|
#KCA_MASTER_KEY=
|
|
|
|
# Optional absolute path to an OpenSSL 3 libcrypto used for XCA legacy curves
|
|
# and hashes. Normally discovered automatically; no OpenSSL CLI is required.
|
|
#KCA_LIBCRYPTO=/usr/lib/x86_64-linux-gnu/libcrypto.so.3
|
|
|
|
# --- Application -----------------------------------------------------------
|
|
APP_HOST=0.0.0.0
|
|
APP_PORT=8080
|
|
STATIC_DIR=web/dist
|
|
MAX_UPLOAD_BYTES=20971520
|
|
KEYGEN_CONCURRENCY=2
|
|
SESSION_COOKIE_SECURE=false
|
|
#LOGGING_CONFIG=
|
|
|
|
# --- OpenTelemetry (optional) ----------------------------------------------
|
|
# The Docker image includes the 'otel' extra. Non-image installs need:
|
|
# uv sync --package kca-app --extra otel
|
|
# Export targets are OTLP/HTTP; the /v1/traces, /v1/metrics and /v1/logs
|
|
# paths are appended automatically.
|
|
OTEL_ENABLED=false
|
|
OTEL_SERVICE_NAME=kca
|
|
#OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
|
|
#OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer token,X-Tenant=one
|
|
OTEL_EXCLUDED_PATHS=/api/health
|
|
#OTEL_METRIC_EXPORT_INTERVAL_MILLIS=60000
|
|
#OTEL_METRICS_POLL_INTERVAL_SECONDS=15
|
|
|
|
# --- OCSP status publisher (optional) --------------------------------------
|
|
# When REDIS_URL is configured, KCA publishes one full CBOR status snapshot
|
|
# per CA to the same Redis instance and logical database used for sessions.
|
|
# Keys use a separate prefix and expire unless refreshed by the heartbeat.
|
|
KCA_OCSP_REDIS_PREFIX=ocsp
|
|
KCA_OCSP_PUBLISH_INTERVAL_SECONDS=1
|
|
# Republish unchanged snapshots to renew their Redis TTL. Keep the heartbeat
|
|
# comfortably below the key expiry.
|
|
KCA_OCSP_HEARTBEAT_INTERVAL_SECONDS=30
|
|
KCA_OCSP_REDIS_EXPIRY_SECONDS=60
|
|
|
|
# --- CORS (optional) -------------------------------------------------------
|
|
#CORS_ALLOW_ORIGINS=
|
|
#CORS_ALLOW_ORIGIN_REGEX=
|
|
#CORS_ALLOW_METHODS=GET
|
|
#CORS_ALLOW_HEADERS=
|
|
#CORS_ALLOW_CREDENTIALS=false
|
|
#CORS_EXPOSE_HEADERS=
|
|
#CORS_MAX_AGE=600
|