155 lines
7.5 KiB
Plaintext
155 lines
7.5 KiB
Plaintext
# Parallel Synology HTTP deployment.
|
|
# This intentionally uses high ports and does not touch existing nodedc-demo.
|
|
|
|
AUTH_DOMAIN=auth.nas.nodedc
|
|
AUTH_ADMIN_DOMAIN=auth-admin.nas.nodedc
|
|
AUTH_ADMIN_LAN_HOST=172.22.0.222
|
|
LAUNCHER_DOMAIN=launcher.nas.nodedc
|
|
TASK_DOMAIN=task.nas.nodedc
|
|
BIM_DOMAIN=bim.nodedc.tech
|
|
NODEDC_PUBLIC_HTTP_PORT=18080
|
|
PLATFORM_HTTP_PORT=18080
|
|
SYNOLOGY_TASK_MANAGER_UPSTREAM=host.docker.internal:18090
|
|
SYNOLOGY_BIM_VIEWER_UPSTREAM=host.docker.internal:18100
|
|
|
|
AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
|
|
AUTHENTIK_TAG=2026.2.2
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED=false
|
|
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS=127.0.0.0/8,172.16.0.0/12
|
|
|
|
PG_DB=authentik
|
|
PG_USER=authentik
|
|
PG_PASS=replace-with-random-synology-secret
|
|
AUTHENTIK_SECRET_KEY=replace-with-random-synology-secret
|
|
AUTHENTIK_BOOTSTRAP_EMAIL=admin@nodedc.local
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD=replace-with-random-synology-secret
|
|
AUTHENTIK_BOOTSTRAP_TOKEN=replace-with-random-synology-secret
|
|
|
|
LAUNCHER_BASE_URL=https://hub.nodedc.ru
|
|
TASK_BASE_URL=https://ops.nodedc.ru
|
|
NODEDC_BIM_VIEWER_PUBLIC_URL=https://bim.nodedc.tech
|
|
TASK_LOGOUT_URI=https://ops.nodedc.ru/logout
|
|
TASK_INTERNAL_LOGOUT_URL=https://ops.nodedc.ru/api/internal/nodedc/logout/
|
|
NODEDC_ENGINE_DOCKER_NETWORK=nodedc-demo_default
|
|
NODEDC_ENGINE_INTERNAL_URL=http://nodedc-demo-nodedc-backend-1:3001
|
|
|
|
# Platform Map Gateway — private service and one shared persistent TileCache.
|
|
# Optional one-time legacy bootstrap only. Preferred operation: an authorized
|
|
# Foundry admin saves the token through Page Library → Platform settings; it is
|
|
# then stored in the private NAS cache volume and never exposed to Foundry UI,
|
|
# deploy artifact or browser env. Do not paste a real token into this example.
|
|
CESIUM_ION_TOKEN=
|
|
CESIUM_ION_ASSET_ALLOWLIST=1,2,96188
|
|
MAP_CACHE_MODE=readwrite
|
|
MAP_CACHE_MAX_MB=20480
|
|
MAP_GATEWAY_HOST_BIND=127.0.0.1:18103
|
|
# Created by the root-owned deploy runner on first Map Gateway rollout.
|
|
# These are NAS paths, visible through SMB as nodedc-platform/map-gateway/.
|
|
MAP_LIVE_CACHE_HOST_DIR=/volume1/docker/nodedc-platform/map-gateway/live-tile-cache
|
|
MAP_OFFLINE_SNAPSHOT_HOST_DIR=/volume1/docker/nodedc-platform/map-gateway/offline-snapshot
|
|
MAP_GATEWAY_UPSTREAM_ALLOWLIST=api.cesium.com,assets.ion.cesium.com,tile.openstreetmap.org,dev.virtualearth.net,ecn.t0.tiles.virtualearth.net,ecn.t1.tiles.virtualearth.net,ecn.t2.tiles.virtualearth.net,ecn.t3.tiles.virtualearth.net
|
|
MAP_GATEWAY_LEGACY_CACHE_HOSTS=
|
|
MAP_GATEWAY_OFFLINE_PROVIDER_ALLOWLIST=
|
|
|
|
LAUNCHER_OIDC_ISSUER=https://id.nodedc.ru/application/o/launcher/
|
|
LAUNCHER_OIDC_CLIENT_ID=nodedc-launcher
|
|
LAUNCHER_OIDC_CLIENT_SECRET=replace-with-random-synology-secret
|
|
LAUNCHER_OIDC_REDIRECT_URI=https://hub.nodedc.ru/auth/callback
|
|
LAUNCHER_OIDC_LOGGED_OUT_REDIRECT_URI=https://hub.nodedc.ru/auth/logged-out
|
|
LAUNCHER_LOGOUT_URI=https://hub.nodedc.ru/logout
|
|
LAUNCHER_COOKIE_DOMAIN=.nodedc.ru
|
|
|
|
PLANE_OIDC_ISSUER=https://id.nodedc.ru/application/o/task-manager/
|
|
PLANE_OIDC_CLIENT_ID=nodedc-task-manager
|
|
PLANE_OIDC_CLIENT_SECRET=replace-with-random-synology-secret
|
|
PLANE_OIDC_REDIRECT_URI=https://ops.nodedc.ru/auth/oidc/callback
|
|
|
|
NODEDC_AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
|
|
AUTHENTIK_BASE_URL=http://nodedc-platform-authentik-server:9000
|
|
NODEDC_AUTHENTIK_SERVICE_TOKEN=replace-with-authentik-api-token
|
|
AUTHENTIK_SERVICE_TOKEN=replace-with-authentik-api-token
|
|
NODEDC_INTERNAL_ACCESS_TOKEN=replace-with-random-synology-secret
|
|
SESSION_SECRET=replace-with-random-synology-secret
|
|
COOKIE_DOMAIN=.nas.nodedc
|
|
COOKIE_SECURE=false
|
|
|
|
# External Data Plane — provider-neutral storage. Generate a distinct database
|
|
# password; it must never reuse NODEDC_INTERNAL_ACCESS_TOKEN or a provider key.
|
|
EXTERNAL_DATA_PLANE_TIMESCALE_IMAGE=timescale/timescaledb-ha:pg16.14-ts2.28.2-all
|
|
EXTERNAL_DATA_PLANE_PG_DB=nodedc_data_plane
|
|
EXTERNAL_DATA_PLANE_PG_USER=nodedc_data_plane
|
|
EXTERNAL_DATA_PLANE_PG_PASS=replace-with-random-synology-secret
|
|
EXTERNAL_DATA_PLANE_HOST_BIND=127.0.0.1:18106
|
|
EXTERNAL_DATA_PLANE_DATABASE_POOL_SIZE=10
|
|
EXTERNAL_DATA_PLANE_RAW_RETENTION_DAYS=14
|
|
EXTERNAL_DATA_PLANE_MAX_BATCH_BYTES=5242880
|
|
EXTERNAL_DATA_PLANE_MAX_FACTS_PER_PUBLISH=5000
|
|
EXTERNAL_DATA_PLANE_MAX_ATTRIBUTES_BYTES_PER_FACT=65536
|
|
EXTERNAL_DATA_PLANE_MAX_PATCH_OPERATIONS=500
|
|
EXTERNAL_DATA_PLANE_MAX_PATCH_BYTES=262144
|
|
EXTERNAL_DATA_PLANE_PATCH_RETENTION_MS=3600000
|
|
EXTERNAL_DATA_PLANE_RECEIPT_RETENTION_MS=604800000
|
|
EXTERNAL_DATA_PLANE_RETENTION_DELETE_LIMIT=10000
|
|
EXTERNAL_DATA_PLANE_STREAM_HEARTBEAT_MS=20000
|
|
EXTERNAL_DATA_PLANE_STREAM_POLL_MS=1000
|
|
EXTERNAL_DATA_PLANE_MAX_READER_STREAMS=10
|
|
EXTERNAL_DATA_PLANE_WRITER_BINDING_MAX_TTL_DAYS=90
|
|
EXTERNAL_DATA_PLANE_MAX_FUTURE_SKEW_SECONDS=300
|
|
EXTERNAL_DATA_PLANE_RETENTION_SWEEP_MS=3600000
|
|
EXTERNAL_DATA_PLANE_LEGACY_INTAKE_ENABLED=false
|
|
# The writer-provisioner secret is a root-owned file under
|
|
# /volume1/docker/nodedc-platform/secrets/external-data-plane-provisioner/,
|
|
# never a shared .env value.
|
|
|
|
NOTIFICATION_PG_DB=nodedc_notifications
|
|
NOTIFICATION_PG_USER=nodedc_notifications
|
|
NOTIFICATION_PG_PASS=replace-with-random-synology-secret
|
|
NODEDC_NOTIFICATION_CORE_URL=http://notification-core:5185
|
|
|
|
AI_WORKSPACE_PG_DB=nodedc_ai_workspace
|
|
AI_WORKSPACE_PG_USER=nodedc_ai_workspace
|
|
AI_WORKSPACE_PG_PASS=replace-with-random-synology-secret
|
|
AI_WORKSPACE_ASSISTANT_TOKEN=replace-with-random-synology-secret
|
|
NODEDC_AI_WORKSPACE_ASSISTANT_URL=http://ai-workspace-assistant:18082
|
|
AI_WORKSPACE_OPS_ENTITLEMENT_URL=http://172.22.0.222:18190/api/internal/v1/ai-workspace/entitlements
|
|
AI_WORKSPACE_OPS_ENTITLEMENT_TOKEN=replace-with-ops-agent-gateway-internal-token
|
|
AI_WORKSPACE_OPS_ENTITLEMENT_REQUIRED=false
|
|
# Set only after Foundry passes Launcher handoff and Authentik access checks.
|
|
# Keep every existing entitlement adapter in this same JSON object. The adapter
|
|
# uses the existing NODE.DC internal service credential; no Foundry browser or
|
|
# worker secret is required.
|
|
# {"module-foundry":{"url":"https://foundry.nodedc.ru/api/ai-workspace/entitlements","required":false}}
|
|
AI_WORKSPACE_ENTITLEMENT_ADAPTERS_JSON=
|
|
|
|
AI_WORKSPACE_HUB_TOKEN=replace-with-random-synology-secret
|
|
AI_WORKSPACE_HUB_HOST_BIND=0.0.0.0:18081
|
|
AI_WORKSPACE_HUB_PUBLIC_URL=wss://ai-hub.nodedc.ru/api/ai-workspace/hub
|
|
AI_WORKSPACE_HUB_INTERNAL_URL=https://ai-hub.nodedc.ru
|
|
AI_WORKSPACE_HUB_FALLBACK_URLS=
|
|
AI_WORKSPACE_ONTOLOGY_MCP_ENABLED=true
|
|
# Optional public HTTP origin for the dynamic worker MCP URL. Normally it is
|
|
# derived from AI_WORKSPACE_HUB_PUBLIC_URL, so leave this empty.
|
|
AI_WORKSPACE_ONTOLOGY_MCP_PUBLIC_URL=
|
|
ONTOLOGY_CORE_HOST_BIND=127.0.0.1:18104
|
|
|
|
# Gelios Gateway — storage/read service. Provider credentials stay in the
|
|
# protected Engine Collector. Intake remains disabled until scope is approved.
|
|
GELIOS_TIMESCALE_IMAGE=timescale/timescaledb-ha:pg16.14-ts2.28.2-all
|
|
GELIOS_PG_DB=nodedc_gelios
|
|
GELIOS_PG_USER=nodedc_gelios
|
|
GELIOS_PG_PASS=replace-with-random-synology-secret
|
|
# URL-encode reserved characters in GELIOS_PG_PASS when forming this URL.
|
|
GELIOS_DATABASE_URL=postgresql://nodedc_gelios:replace-with-url-encoded-synology-secret@gelios-postgres:5432/nodedc_gelios
|
|
GELIOS_GATEWAY_HOST_BIND=127.0.0.1:18105
|
|
# Explicit tenant and connection identifiers are deployment configuration;
|
|
# do not encode a customer or pilot name in source defaults.
|
|
GELIOS_TENANT_ID=replace-with-tenant-id
|
|
GELIOS_CONNECTION_ID=gelios-connection-id
|
|
# `all` accepts every unit returned by this approved tenant + connection.
|
|
GELIOS_UNIT_SCOPE=allowlist
|
|
GELIOS_ALLOWED_UNIT_IDS=
|
|
GELIOS_INTAKE_ENABLED=false
|
|
GELIOS_RAW_RETENTION_DAYS=14
|
|
# Presentation state only; it does not change provider collection cadence.
|
|
GELIOS_POSITION_STALE_AFTER_MS=300000
|