Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
124 lines (107 loc) · 5.09 KB
/
Copy path.env.example
File metadata and controls
124 lines (107 loc) · 5.09 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
# Docker Compose Environment Variables
# Copy to .env and configure before running docker-compose up
# ============================================
# CORE CONFIGURATION
# ============================================
NODE_ENV=production
DOMAIN=your-domain.com
# ============================================
# AUTHENTICATION
# ============================================
JWT_SECRET=CHANGE-THIS-TO-A-SECURE-RANDOM-STRING
ADMIN_SECRET=CHANGE-THIS-TO-SECURE-ADMIN-CREATION-SECRET
# Required — the backend refuses to boot without it (backend-rust/src/config/mod.rs).
# Exact origins only, comma-separated, no wildcard (CORS_ORIGIN=* is rejected).
# Production is single-domain behind Caddy, so this is normally just DOMAIN.
CORS_ORIGIN=https://your-domain.com
# ============================================
# WEBAUTHN CONFIGURATION
# ============================================
WEBAUTHN_RP_NAME=Attendix Attendance System
WEBAUTHN_RP_ID=your-domain.com
WEBAUTHN_ORIGIN=https://your-domain.com
# ============================================
# STORAGE CONFIGURATION
# ============================================
# Choose: 'cloudinary' or 's3'
STORAGE_PROVIDER=s3
# Cloudinary (required when STORAGE_PROVIDER=cloudinary)
CLOUDINARY_CLOUD_NAME=your-cloudinary-name
CLOUDINARY_API_KEY=your-api-key
CLOUDINARY_API_SECRET=your-api-secret
# AWS S3 (required when STORAGE_PROVIDER=s3)
AWS_S3_BUCKET=your-s3-bucket-name
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=your-aws-access-key-id
AWS_SECRET_ACCESS_KEY=your-aws-secret-access-key
# ECR images (docker-compose.prod.yml) — defaults already point at
# tgl/attendix in ap-south-1; only set these to override.
# ECR_REGISTRY=559444199242.dkr.ecr.ap-south-1.amazonaws.com
# ECR_REPOSITORY=tgl/attendix
# IMAGE_TAG=latest
# ============================================
# REDIS CACHE
# ============================================
REDIS_PASSWORD=change_this_to_a_secure_redis_password
REDIS_URL=redis://:change_this_to_a_secure_redis_password@redis:6379
# ============================================
# POSTGRES
# ============================================
POSTGRES_DB=attendance_geotag
POSTGRES_USER=attendix
POSTGRES_PASSWORD=change_this_to_a_secure_postgres_password
PG_MAX_POOL_SIZE=30
PG_MIN_POOL_SIZE=5
# ============================================
# TIMESCALEDB (session-monitoring telemetry only)
# A separate database/container from POSTGRES above — telemetry_events lives
# here as a TimescaleDB hypertable; everything else (sessions, attendance,
# device locks, etc.) stays on the regular Postgres instance untouched.
# ============================================
TIMESCALE_DB=attendix_telemetry
TIMESCALE_USER=attendix_telemetry
TIMESCALE_PASSWORD=change_this_to_a_secure_timescaledb_password
# ============================================
# POSTGRES BACKUP (pg-backup service, docker-compose.postgres.yml)
# Nightly pg_dump uploaded to s3://$AWS_S3_BUCKET/postgres-backups/ — reuses
# the AWS_* credentials above, no separate bucket needed.
# ============================================
BACKUP_CRON_SCHEDULE=0 2 * * *
BACKUP_RETENTION_DAYS=30
# ============================================
# FRONTEND CONFIGURATION
# ============================================
# DEV_BYPASS_ALL: Controls the Developer Bypass Mode at the environment level.
# If true:
# - Injects mock buttons in the student frontend for testing (Bypass Camera/Location/WebAuthn).
# - Relaxes backend constraints so mock submissions are accepted and recorded with a "flagged" audit trail.
# If false:
# - The system runs in strict production mode. Mock buttons are hidden.
# - All hardware and location checks are strictly enforced and cannot be bypassed.
# Note: You can now also toggle this dynamically via the Admin Dashboard > Settings.
DEV_BYPASS_ALL=false
# ============================================
# MONITORING: Grafana (docker-compose.monitoring.yml)
# Grafana is reached only through Caddy at /logging-grafana-main. Override
# GRAFANA_ROOT_URL for prod so it emits links against the real domain, not
# localhost. Prometheus has no route/host port at all — internal-only,
# reachable only by Grafana as http://prometheus:9090.
# ============================================
GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=change-this-grafana-password
GRAFANA_ROOT_URL=https://your-domain.com/logging-grafana-main/
# CIDRs whose X-Forwarded-For is trusted (the Caddy container's subnet).
# Rate limiting is keyed on the extracted IP; an unvalidated header here lets
# any client bypass every limiter by varying it.
TRUSTED_PROXIES=172.18.0.0/16
# Bearer token for Prometheus scrapes of the backend /metrics endpoint.
# Generate with: openssl rand -base64 48
METRICS_TOKEN=
# Optional KMS key for server-side encryption of Postgres dumps in S3.
# Unset falls back to SSE-S3 (AES256), which is still applied.
BACKUP_KMS_KEY_ID=
# Origin the site is served from, used to build shareable short links
# ({PUBLIC_BASE_URL}/s/{code}). Distinct from WEBAUTHN_ORIGIN, which is the
# WebAuthn relying-party origin — set this to what a student's browser sees
# (e.g. https://attendix.example.com), not the backend's own port.
PUBLIC_BASE_URL=http://localhost