ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
19 lines
792 B
Bash
19 lines
792 B
Bash
# Rendered by Ansible from infra/environments/{{ env }}/platform.env.template's shape —
|
|
# real values come from group_vars/{{ env }}.yml + the encrypted vault file. Do not hand-edit
|
|
# on the host; re-run the platform role instead.
|
|
|
|
# service names, not localhost — production runs these on a named Docker bridge network
|
|
# (rn-platform-internal), not network_mode: host like the dev compose file does.
|
|
PLATFORM_DB_URL=postgres://rootnode_platform:{{ vault_postgres_password }}@postgres:5432/rootnode_platform
|
|
PROVISIONER_URL=http://provisioner:4100
|
|
PROVISIONER_SHARED_SECRET={{ vault_provisioner_shared_secret }}
|
|
PLATFORM_API_PORT=4300
|
|
|
|
STUDENT_SESSION_TTL_HOURS=8
|
|
STUDENT_SESSION_IDLE_HOURS=2
|
|
INSTRUCTOR_SESSION_TTL_HOURS=12
|
|
INSTRUCTOR_SESSION_IDLE_HOURS=2
|
|
|
|
COOKIE_SECURE=1
|
|
TRUST_PROXY=1
|