62 lines
3.4 KiB
Plaintext
62 lines
3.4 KiB
Plaintext
# Server-side operational configuration. Nothing from this file is shipped to the browser.
|
||
# Private Platform Map Gateway URL. It is never returned to the browser.
|
||
NODEDC_MAP_GATEWAY_INTERNAL_URL=
|
||
# Gateway BFF waits this long for response headers; an active body then uses a
|
||
# separate progress-based idle limit rather than an absolute request deadline.
|
||
NODEDC_MAP_GATEWAY_HEADERS_TIMEOUT_MS=15000
|
||
NODEDC_MAP_GATEWAY_BODY_IDLE_TIMEOUT_MS=30000
|
||
# Private External Data Plane address. It is used only by the Foundry server;
|
||
# map pages use same-origin /api/applications/.../data-bindings/... routes.
|
||
NODEDC_EXTERNAL_DATA_PLANE_INTERNAL_URL=
|
||
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_SERVICE_ID=nodedc-module-foundry
|
||
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_KEY_ID=foundry-edp-managed-provisioner-v1
|
||
NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_AUDIENCE=nodedc-external-data-plane.managed-provisioning.v1
|
||
# Absolute path to a runner-managed directory of opaque reader grants. Each
|
||
# filename is sha256("<applicationId>/<pageId>/<bindingId>"); file content is
|
||
# exactly one ndc_edprb_ reader token. Files must be root-owned and read-only.
|
||
# Neither this directory nor any token is shipped to the browser or persisted
|
||
# in an application/page dataProductBinding.
|
||
NODEDC_EXTERNAL_DATA_PLANE_READER_GRANTS_DIR=
|
||
# Cesium Ion credentials belong only to the private Platform Map Gateway
|
||
# secret store (its legacy bootstrap may be environment-based), never here.
|
||
CESIUM_GAUSSIAN_SPLAT_ASSET_ID=
|
||
|
||
# NDC Module Foundry — server-side configuration. Do not put these values in a browser build.
|
||
# Foundry is published through the Synology reverse proxy:
|
||
# https://foundry.nodedc.ru -> 172.22.0.222:9920 -> container:3333.
|
||
# Keep the public URL without a trailing slash.
|
||
FOUNDRY_PUBLIC_URL=https://foundry.nodedc.ru
|
||
FOUNDRY_MCP_URL=
|
||
# MCP receives a short-lived capability minted server-side from the existing
|
||
# NODEDC_INTERNAL_ACCESS_TOKEN. Do not create or pass a separate Foundry secret.
|
||
FOUNDRY_MCP_CAPABILITY_TTL_MS=600000
|
||
FOUNDRY_MCP_ALLOWED_ORIGINS=
|
||
FOUNDRY_ALLOW_ALL_AUTHENTICATED=false
|
||
# user_root (dcctouch@gmail.com) and the Authentik group
|
||
# nodedc:module-foundry:access are included by default. Add only exceptional
|
||
# additional platform identities here.
|
||
FOUNDRY_ALLOWED_OWNER_IDS=
|
||
FOUNDRY_ALLOWED_OWNER_GROUPS=
|
||
FOUNDRY_HOST_BIND=172.22.0.222:9920
|
||
|
||
# Access is owned by Launcher + Authentik. Foundry has no standalone login form.
|
||
# Reuse the existing server-to-server value shared by NODE.DC services; do not create a browser token.
|
||
NODEDC_FOUNDRY_AUTH_REQUIRED=false
|
||
NODEDC_FOUNDRY_SERVICE_SLUG=module-foundry
|
||
NODEDC_LAUNCHER_BASE_URL=http://127.0.0.1:5173
|
||
NODEDC_LAUNCHER_INTERNAL_URL=http://127.0.0.1:5173
|
||
NODEDC_INTERNAL_ACCESS_TOKEN=
|
||
# Internal-only Ontology Core address used by the Foundry Codex Agent transport.
|
||
# It is never written to Codex config and never returned to the browser.
|
||
NODEDC_ONTOLOGY_CORE_URL=http://ontology-core:18104
|
||
NODEDC_FOUNDRY_SESSION_COOKIE=nodedc_foundry_session
|
||
NODEDC_FOUNDRY_SESSION_TTL_MS=43200000
|
||
# Production validation TTL is deliberately clamped to 15–30 seconds. A
|
||
# transient Launcher outage may use the last good identity only for read-only
|
||
# requests and only inside the bounded grace window.
|
||
NODEDC_FOUNDRY_SESSION_VALIDATION_TTL_MS=20000
|
||
NODEDC_FOUNDRY_SESSION_VALIDATION_GRACE_MS=30000
|
||
NODEDC_FOUNDRY_SESSION_VALIDATION_RETRY_MS=2000
|
||
NODEDC_FOUNDRY_COOKIE_SECURE=false
|
||
NODEDC_FOUNDRY_COOKIE_SAMESITE=Lax
|