ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
39 lines
2.6 KiB
Bash
39 lines
2.6 KiB
Bash
# Production environment template for rn-platform-01's `api` service.
|
|
# Copy to platform.env OUTSIDE git (see infra/backup/README.md "secrets" and
|
|
# docs/PRODUCTION_DEPLOYMENT.md §10), fill in real values, never commit the filled file.
|
|
# infra/.gitignore already excludes *.env (only *.env.template is tracked).
|
|
|
|
# ── Postgres ────────────────────────────────────────────────────────────────────────────
|
|
# `postgres`/`provisioner` are Docker Compose service names, not localhost — production runs
|
|
# these on a named bridge network (rn-platform-internal), not network_mode: host like dev.
|
|
PLATFORM_DB_URL=postgres://rootnode_platform:__REPLACE_WITH_STRONG_PASSWORD__@postgres:5432/rootnode_platform
|
|
|
|
# ── Provisioner ─────────────────────────────────────────────────────────────────────────
|
|
PROVISIONER_URL=http://provisioner:4100
|
|
PROVISIONER_SHARED_SECRET=__REPLACE_openssl_rand_hex_32__
|
|
|
|
# ── Listen ──────────────────────────────────────────────────────────────────────────────
|
|
PLATFORM_API_PORT=4300
|
|
|
|
# ── Sessions (production values — do NOT inherit dev defaults) ────────────────────────────
|
|
STUDENT_SESSION_TTL_HOURS=8
|
|
STUDENT_SESSION_IDLE_HOURS=2
|
|
INSTRUCTOR_SESSION_TTL_HOURS=12
|
|
INSTRUCTOR_SESSION_IDLE_HOURS=2
|
|
|
|
# ── Cookies / proxy — MUST be set for production, unlike dev ──────────────────────────────
|
|
# Secure requires the origin to actually be HTTPS end-to-end (see docs/PRODUCTION_NETWORK_SECURITY.md §8).
|
|
COOKIE_SECURE=1
|
|
# Only set to 1 once a trusted reverse proxy (Cloudflare/nginx/Caddy, see infra/docker/reverse-proxy/)
|
|
# is actually in front of the Gateway — otherwise req.ip becomes spoofable via X-Forwarded-For.
|
|
TRUST_PROXY=1
|
|
|
|
# ── Frontend (baked into the platform/api image at build time; listed here for reference) ─
|
|
# FRONTEND_DIST_DIR=/frontend-dist
|
|
|
|
# ── Future OIDC (Phase 3A adapter — not wired yet, see docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md §16) ─
|
|
# OIDC_ISSUER_URL=
|
|
# OIDC_CLIENT_ID=
|
|
# OIDC_CLIENT_SECRET=__do_not_commit__
|
|
# OIDC_REDIRECT_URL=https://academy.example.com/api/auth/oidc/callback
|