woggioni
aee1025015
- Parse and validate from snapshot JSON, reject future/missing timestamps - Enforce snapshot age vs in cache and stale fallback (no lifetime extension on repeat S3 reads) - OCSP: , , - Remove unused from signer - Publisher heartbeats: , republish clean snapshots past interval, preserve dirty-only behavior and concurrency - Config/env/docker/docs updates for heartbeat Rolling upgrade: enable publisher heartbeats before deploying the age-enforcing responder so existing snapshots remain within the age window.
77 lines
2.8 KiB
Bash
77 lines
2.8 KiB
Bash
# Environment configuration for KCA. Copy to .env or export the variables.
|
|
|
|
# --- Database --------------------------------------------------------------
|
|
DATABASE_ENGINE=postgres
|
|
DATABASE_HOST=localhost
|
|
DATABASE_PORT=5432
|
|
DATABASE_NAME=kca
|
|
DATABASE_USER=kca
|
|
DATABASE_PASSWORD=password
|
|
#DATABASE_OPTIONS=
|
|
#DATABASE_URL=
|
|
|
|
# --- OIDC ------------------------------------------------------------------
|
|
# Indexed blocks OIDC_0_*, OIDC_1_*, ... with contiguous indices from 0.
|
|
OIDC_0_PROVIDER=default
|
|
OIDC_0_ISSUER=http://localhost:8180/kca
|
|
OIDC_0_CLIENT_ID=kca
|
|
OIDC_0_CLIENT_SECRET=dev-secret
|
|
OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback
|
|
OIDC_0_POST_LOGIN_REDIRECT=http://localhost:8080/
|
|
OIDC_0_POST_LOGOUT_REDIRECT=http://localhost:8080/
|
|
|
|
# --- Sessions --------------------------------------------------------------
|
|
REDIS_URL=redis://localhost:6379/0
|
|
|
|
# --- Private-key encryption ------------------------------------------------
|
|
# REQUIRED in production: a random 32-byte AES-256 key, base64 or hex.
|
|
# openssl rand -base64 32
|
|
# When unset, a built-in development key is used (the UI warns about it).
|
|
#KCA_MASTER_KEY=
|
|
|
|
# --- Application -----------------------------------------------------------
|
|
APP_HOST=0.0.0.0
|
|
APP_PORT=8080
|
|
STATIC_DIR=web/dist
|
|
MAX_UPLOAD_BYTES=20971520
|
|
KEYGEN_CONCURRENCY=2
|
|
SESSION_COOKIE_SECURE=false
|
|
#LOGGING_CONFIG=
|
|
|
|
# --- OpenTelemetry (optional) ----------------------------------------------
|
|
# The Docker image includes the 'otel' extra. Non-image installs need:
|
|
# uv sync --package kca-app --extra otel
|
|
# Export targets are OTLP/HTTP; the /v1/traces, /v1/metrics and /v1/logs
|
|
# paths are appended automatically.
|
|
OTEL_ENABLED=false
|
|
OTEL_SERVICE_NAME=kca
|
|
#OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
|
|
#OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer token,X-Tenant=one
|
|
OTEL_EXCLUDED_PATHS=/api/health
|
|
#OTEL_METRIC_EXPORT_INTERVAL_MILLIS=60000
|
|
#OTEL_METRICS_POLL_INTERVAL_SECONDS=15
|
|
|
|
# --- OCSP status publisher (optional) --------------------------------------
|
|
# When a bucket is configured, KCA publishes one full JSON status snapshot
|
|
# per CA. The standalone OCSP responder reads these objects. Uses the normal
|
|
# AWS credential chain (AWS_ACCESS_KEY_ID /
|
|
# AWS_SECRET_ACCESS_KEY, role, instance profile, ...).
|
|
#KCA_OCSP_S3_BUCKET=kca-ocsp
|
|
KCA_OCSP_S3_PREFIX=ocsp
|
|
#KCA_OCSP_S3_REGION=eu-central-1
|
|
#KCA_OCSP_S3_ENDPOINT=http://localhost:9000
|
|
KCA_OCSP_S3_FORCE_PATH_STYLE=false
|
|
KCA_OCSP_PUBLISH_INTERVAL_SECONDS=1
|
|
# Republish unchanged snapshots as a liveness heartbeat. Keep this comfortably
|
|
# below the responder's s3.stale_grace_seconds (default 60).
|
|
KCA_OCSP_HEARTBEAT_INTERVAL_SECONDS=30
|
|
|
|
# --- CORS (optional) -------------------------------------------------------
|
|
#CORS_ALLOW_ORIGINS=
|
|
#CORS_ALLOW_ORIGIN_REGEX=
|
|
#CORS_ALLOW_METHODS=GET
|
|
#CORS_ALLOW_HEADERS=
|
|
#CORS_ALLOW_CREDENTIALS=false
|
|
#CORS_EXPOSE_HEADERS=
|
|
#CORS_MAX_AGE=600
|