Initial DC CMS extraction

infra/.env.synology.example

@@ -0,0 +1,52 @@
+# public domains routed by Synology Reverse Proxy to 172.22.0.222:9918
+CMS_DOMAIN=cms.dcserve.ru
+CMS_AUTH_DOMAIN=auth.dcserve.ru
+CMS_AUTH_ADMIN_DOMAIN=auth-admin.dcserve.ru
+CMS_PUBLIC_URL=https://cms.dcserve.ru
+CMS_AUTH_PUBLIC_URL=https://auth.dcserve.ru
+CMS_AUTH_ADMIN_PUBLIC_URL=https://auth-admin.dcserve.ru
+CMS_HTTP_BIND=172.22.0.222:9918
+CMS_AUTH_HTTP_BIND=172.22.0.222:9919
+CMS_AUTH_ADMIN_HTTP_BIND=127.0.0.1:9920
+CMS_EXTERNAL_SCHEME=https
+
+# mounted NODE.DC site root on Synology
+CMS_NODEDC_SITE_PATH=/volume1/docker/dc-cms/sites/nodedc
+
+# authentik image
+AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
+AUTHENTIK_TAG=2026.2.2
+AUTHENTIK_ERROR_REPORTING__ENABLED=false
+AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS=127.0.0.0/8,172.16.0.0/12
+
+# authentik database
+PG_DB=authentik
+PG_USER=authentik
+PG_PASS=replace-with-random-secret
+
+# authentik first-start bootstrap
+AUTHENTIK_SECRET_KEY=replace-with-random-secret
+AUTHENTIK_BOOTSTRAP_EMAIL=dcctouch@gmail.com
+AUTHENTIK_BOOTSTRAP_PASSWORD=replace-with-temporary-password
+AUTHENTIK_BOOTSTRAP_TOKEN=replace-with-random-token
+
+# CMS bootstrap user. Used by infra/scripts/bootstrap-authentik.sh.
+CMS_BOOTSTRAP_ADMIN_EMAIL=dcctouch@gmail.com
+CMS_BOOTSTRAP_ADMIN_PASSWORD=replace-with-temporary-password
+CMS_BOOTSTRAP_ADMIN_NAME=DCTOUCH CMS Admin
+
+# CMS OIDC application. bootstrap-authentik.sh creates the matching provider.
+CMS_AUTH_ENABLED=true
+CMS_BASE_URL=https://cms.dcserve.ru
+CMS_OIDC_ISSUER=https://auth.dcserve.ru/application/o/dc-cms/
+CMS_OIDC_CLIENT_ID=dc-cms
+CMS_OIDC_CLIENT_SECRET=replace-with-random-secret
+CMS_OIDC_REDIRECT_URI=https://cms.dcserve.ru/auth/callback
+CMS_OIDC_LOGGED_OUT_REDIRECT_URI=https://cms.dcserve.ru/auth/logged-out
+CMS_LOGOUT_URI=https://cms.dcserve.ru/auth/logout
+CMS_REQUIRED_GROUPS=dc-cms:owner,dc-cms:admin,dc-cms:editor,dc-cms:publisher
+
+# CMS app session
+CMS_SESSION_SECRET=replace-with-random-secret
+COOKIE_DOMAIN=
+COOKIE_SECURE=true