woggioni
a89bd06010
CI / Build and push docker image (push) Successful in 2m27s
kaya-oidc 0.0.6 can run several providers in one app (OIDCProviders), each with its own login route and namespaced session state. Adopt it: providers are configured in indexed, contiguous OIDC_<n>_* blocks (0-based) with OIDC_<n>_PROVIDER naming the provider in its login URL and session keys. The old unindexed OIDC_ISSUER/OIDC_CLIENT_ID/... names are no longer read; startup fails with a rename hint when they are set. With no OIDC variables at all, the single dev mock provider named "default" is used, as before. The platform now authenticates through OIDCProviders: auth.current_user returns the session's user (sessions stay single-identity, so at most one provider is logged in) and require_auth/route handlers use it, while the websocket path keeps scanning for any provider's user. New routes expose the configuration to the SPA and keep old links working: GET /api/auth/providers lists the login URLs, GET /auth/login redirects to the first provider and GET /auth/logout to whichever provider the session is logged in with. The lobby renders one login button per provider from that endpoint. Update the env examples, compose and k8s manifests to the indexed scheme, document the multiple-provider setup and the migration, and cover it with config, auth and route tests.
101 lines
4.4 KiB
Bash
101 lines
4.4 KiB
Bash
# Database (match statistics). The app assembles the DSN from these
|
|
# parts; DATABASE_PORT may be left unset to use the driver default
|
|
# (5432 for Postgres). DATABASE_OPTIONS is a raw query string appended
|
|
# to the URL (e.g. ssl=require); leave empty for none.
|
|
DATABASE_ENGINE=postgres
|
|
DATABASE_HOST=localhost
|
|
DATABASE_PORT=5432
|
|
DATABASE_NAME=tavolo
|
|
DATABASE_USER=tavolo
|
|
DATABASE_PASSWORD=password
|
|
DATABASE_OPTIONS=
|
|
# Full-DSN override: when set, the parts above are ignored. Used by the
|
|
# test suite (sqlite://:memory:) and handy for managed-DB URLs.
|
|
#DATABASE_URL=postgres://tavolo:password@localhost:5432/tavolo
|
|
|
|
# OIDC providers. Each provider is an indexed block: OIDC_<n>_PROVIDER
|
|
# (required; names the provider in the login URL /auth/<provider>/login and
|
|
# in its session state), OIDC_<n>_ISSUER, OIDC_<n>_CLIENT_ID,
|
|
# OIDC_<n>_CLIENT_SECRET (optional: leave unset for public clients),
|
|
# OIDC_<n>_REDIRECT_URI (defaults to
|
|
# http://localhost:8080/auth/<provider>/callback), OIDC_<n>_POST_LOGIN_REDIRECT
|
|
# and OIDC_<n>_POST_LOGOUT_REDIRECT (default /). Indices must be contiguous
|
|
# from 0; add a second provider with an OIDC_1_* block (and so on).
|
|
#
|
|
# The values below target the dev mock-oauth2-server (it does not validate
|
|
# clients, so any client id/secret works). For a real IdP like Keycloak,
|
|
# use its values and register the redirect URI there.
|
|
OIDC_0_PROVIDER=default
|
|
OIDC_0_ISSUER=http://localhost:8180/tavolo
|
|
OIDC_0_CLIENT_ID=tavolo
|
|
OIDC_0_CLIENT_SECRET=dev-secret
|
|
OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback
|
|
# A second provider, e.g. Google:
|
|
#OIDC_1_PROVIDER=google
|
|
#OIDC_1_ISSUER=https://accounts.google.com
|
|
#OIDC_1_CLIENT_ID=...
|
|
#OIDC_1_CLIENT_SECRET=...
|
|
#OIDC_1_REDIRECT_URI=http://localhost:8080/auth/google/callback
|
|
|
|
# Redis (session and live-game storage). Unset to fall back to in-memory
|
|
# stores (only sensible for local development with a single worker).
|
|
REDIS_URL=redis://localhost:6379/0
|
|
|
|
# How long a live game survives in Redis without activity.
|
|
GAME_TTL_SECONDS=86400
|
|
|
|
# Seconds the between-hands scoring summary waits for acknowledgements
|
|
# before dealing the next hand anyway.
|
|
HAND_ACK_TIMEOUT_SECONDS=30
|
|
|
|
# Seconds a player has to play before the server plays a random legal card
|
|
# for them (covers disconnects and idle players).
|
|
TURN_TIMEOUT_SECONDS=30
|
|
|
|
# Path to a YAML logging configuration file (logging.config.dictConfig
|
|
# schema). Unset logs DEBUG to the console.
|
|
#LOGGING_CONFIG=/path/to/logging.yaml
|
|
|
|
# CORS (via kaya-cors' CorsMixin; same semantics as Starlette's
|
|
# CORSMiddleware). Disabled unless CORS_ALLOW_ORIGINS or
|
|
# CORS_ALLOW_ORIGIN_REGEX is set — the app serves the SPA and the API from
|
|
# the same origin, so no CORS headers are needed by default.
|
|
# Comma-separated list of origins allowed to make cross-origin requests,
|
|
# or "*" for any origin:
|
|
#CORS_ALLOW_ORIGINS=https://example.com,https://app.example.com
|
|
# Optional regex (fullmatch) allowed origins are additionally checked
|
|
# against — handy for dynamic preview URLs:
|
|
#CORS_ALLOW_ORIGIN_REGEX=https://tavolo-[a-z0-9-]+\.vercel\.app
|
|
# Comma-separated allowed methods, or "*" for all (default GET):
|
|
#CORS_ALLOW_METHODS=GET,POST
|
|
# Comma-separated allowed request headers, or "*" to mirror back whatever
|
|
# the browser requests (default: only the CORS-safelisted headers):
|
|
#CORS_ALLOW_HEADERS=Authorization,Content-Type
|
|
# Allow cookies/credentials on cross-origin requests (1/true/yes/on):
|
|
#CORS_ALLOW_CREDENTIALS=false
|
|
# Comma-separated response headers exposed to the browser:
|
|
#CORS_EXPOSE_HEADERS=
|
|
# Seconds browsers may cache the preflight response (default 600):
|
|
#CORS_MAX_AGE=600
|
|
|
|
# OpenTelemetry (via kaya-otel + the contrib instrumentation packages).
|
|
# Off unless OTEL_ENABLED is truthy; exports traces (HTTP/WebSocket,
|
|
# Postgres via asyncpg, Redis), metrics and logs over OTLP/HTTP (requires
|
|
# the tavolo-app "otel" extra, bundled in the Docker image). The endpoint
|
|
# defaults to the standard OTEL_EXPORTER_OTLP_ENDPOINT (localhost:4318)
|
|
# when unset.
|
|
#OTEL_ENABLED=true
|
|
#OTEL_SERVICE_NAME=tavolo
|
|
#OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318
|
|
#OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer token,X-Tenant=one
|
|
# Paths excluded from tracing and metrics (default /api/health).
|
|
#OTEL_EXCLUDED_PATHS=/api/health
|
|
# Metric export interval (ms, default 60000) and session/game count poll
|
|
# interval (seconds, default 15).
|
|
#OTEL_METRIC_EXPORT_INTERVAL_MILLIS=60000
|
|
#OTEL_METRICS_POLL_INTERVAL_SECONDS=15
|
|
|
|
# App server
|
|
APP_HOST=0.0.0.0
|
|
APP_PORT=8080
|