103 lines
4.4 KiB
Plaintext
103 lines
4.4 KiB
Plaintext
# domains
|
|
NODEDC_ENV=local
|
|
AUTH_DOMAIN=auth.local.nodedc
|
|
AUTH_ADMIN_DOMAIN=auth-admin.local.nodedc
|
|
LAUNCHER_DOMAIN=launcher.local.nodedc
|
|
TASK_DOMAIN=task.local.nodedc
|
|
BIM_DOMAIN=bim.local.nodedc
|
|
NODEDC_BIM_VIEWER_PUBLIC_URL=http://localhost:8080
|
|
|
|
# proxy
|
|
PLATFORM_HTTP_PORT=80
|
|
PLATFORM_PROXY_IMAGE=nodedc/plane-proxy:ru
|
|
LOCAL_LAUNCHER_UPSTREAM=host.docker.internal:5173
|
|
LOCAL_TASK_MANAGER_UPSTREAM=host.docker.internal:8090
|
|
LOCAL_BIM_VIEWER_UPSTREAM=host.docker.internal:8080
|
|
|
|
# authentik image
|
|
AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
|
|
AUTHENTIK_TAG=2026.2.2
|
|
|
|
# authentik database
|
|
PG_DB=authentik
|
|
PG_USER=authentik
|
|
PG_PASS=change-me-generate-with-infra-scripts-init-dev-env
|
|
|
|
# authentik
|
|
AUTHENTIK_SECRET_KEY=change-me-generate-with-infra-scripts-init-dev-env
|
|
AUTHENTIK_ERROR_REPORTING__ENABLED=false
|
|
|
|
# optional first-start bootstrap
|
|
# AUTHENTIK_BOOTSTRAP_EMAIL=admin@nodedc.local
|
|
# AUTHENTIK_BOOTSTRAP_PASSWORD=
|
|
# AUTHENTIK_BOOTSTRAP_TOKEN=
|
|
|
|
# launcher oidc
|
|
LAUNCHER_OIDC_ISSUER=http://auth.local.nodedc/application/o/launcher/
|
|
LAUNCHER_OIDC_CLIENT_ID=nodedc-launcher
|
|
LAUNCHER_OIDC_CLIENT_SECRET=change-me-generate-with-bootstrap-authentik-dev
|
|
LAUNCHER_OIDC_REDIRECT_URI=http://launcher.local.nodedc/auth/callback
|
|
LAUNCHER_OIDC_LOGGED_OUT_REDIRECT_URI=http://launcher.local.nodedc/auth/logged-out
|
|
|
|
# plane oidc
|
|
PLANE_OIDC_ISSUER=http://auth.local.nodedc/application/o/task-manager/
|
|
PLANE_OIDC_CLIENT_ID=nodedc-task-manager
|
|
PLANE_OIDC_CLIENT_SECRET=change-me-generate-with-bootstrap-authentik-dev
|
|
PLANE_OIDC_REDIRECT_URI=http://task.local.nodedc/auth/oidc/callback
|
|
|
|
# security
|
|
SESSION_SECRET=change-me-generate-with-infra-scripts-init-dev-env
|
|
NODEDC_INTERNAL_ACCESS_TOKEN=change-me-generate-with-infra-scripts-init-dev-env
|
|
COOKIE_DOMAIN=.local.nodedc
|
|
COOKIE_SECURE=false
|
|
|
|
# notification core
|
|
NOTIFICATION_PG_DB=nodedc_notifications
|
|
NOTIFICATION_PG_USER=nodedc_notifications
|
|
NOTIFICATION_PG_PASS=change-me-generate-with-infra-scripts-init-dev-env
|
|
NODEDC_NOTIFICATION_CORE_URL=http://notification-core:5185
|
|
|
|
# AI Workspace Assistant shared registry/conversations
|
|
AI_WORKSPACE_PG_DB=nodedc_ai_workspace
|
|
AI_WORKSPACE_PG_USER=nodedc_ai_workspace
|
|
AI_WORKSPACE_PG_PASS=change-me-generate-with-infra-scripts-init-dev-env
|
|
AI_WORKSPACE_ASSISTANT_TOKEN=change-me-generate-with-infra-scripts-init-dev-env
|
|
NODEDC_AI_WORKSPACE_ASSISTANT_URL=http://ai-workspace-assistant:18082
|
|
AI_WORKSPACE_OPS_ENTITLEMENT_URL=http://host.docker.internal:4100/api/internal/v1/ai-workspace/entitlements
|
|
AI_WORKSPACE_OPS_ENTITLEMENT_TOKEN=replace-with-ops-agent-gateway-internal-token
|
|
AI_WORKSPACE_OPS_ENTITLEMENT_REQUIRED=false
|
|
AI_WORKSPACE_ASSISTANT_ACTION_RELAY_ENABLED=true
|
|
AI_WORKSPACE_ASSISTANT_ACTION_RELAY_ID=local-dev
|
|
|
|
# AI Workspace Hub for downloaded Codex workers.
|
|
# Default local development may use the deployed AI Hub only as a relay for remote Codex workers.
|
|
# Launcher/Engine/Ops/Auth downstream URLs must remain local.
|
|
# For Tailscale/ngrok-style relay URLs, set NODEDC_ENV=tunnel-local-e2e deliberately.
|
|
AI_WORKSPACE_HUB_TOKEN=change-me-generate-with-infra-scripts-init-dev-env
|
|
AI_WORKSPACE_HUB_HOST_BIND=127.0.0.1:18081
|
|
AI_WORKSPACE_HUB_PUBLIC_URL=wss://ai-hub.nodedc.ru/api/ai-workspace/hub
|
|
AI_WORKSPACE_HUB_INTERNAL_URL=https://ai-hub.nodedc.ru
|
|
AI_WORKSPACE_HUB_FALLBACK_URLS=
|
|
|
|
# map gateway — keep the actual ion token only in local/staging environment files or Docker secrets.
|
|
# Never copy it into workflow metadata, Git, frontend code, or a runtime cache key.
|
|
MAP_GATEWAY_HOST_BIND=127.0.0.1:18103
|
|
MAP_GATEWAY_ALLOW_ANONYMOUS=true
|
|
MAP_GATEWAY_CORS_ORIGIN=http://127.0.0.1:3333,http://localhost:3333
|
|
MAP_GATEWAY_UPSTREAM_ALLOWLIST=api.cesium.com,assets.ion.cesium.com,tile.openstreetmap.org,dev.virtualearth.net,ecn.t0.tiles.virtualearth.net,ecn.t1.tiles.virtualearth.net,ecn.t2.tiles.virtualearth.net,ecn.t3.tiles.virtualearth.net
|
|
# Imported Engine imagery is selected through the explicit offline cache
|
|
# profile, not through a global host-side block.
|
|
MAP_GATEWAY_LEGACY_CACHE_HOSTS=
|
|
# Leave empty unless the provider/data licence explicitly permits disconnected/offline use.
|
|
MAP_GATEWAY_OFFLINE_PROVIDER_ALLOWLIST=
|
|
MAP_GATEWAY_UPSTREAM_TIMEOUT_SECONDS=30
|
|
CESIUM_ION_TOKEN=
|
|
CESIUM_ION_ASSET_ALLOWLIST=1,2,96188
|
|
MAP_CACHE_MODE=readwrite
|
|
# Mutable cache is mounted at /var/lib/nodedc-map-live-cache by compose.
|
|
# MAP_OFFLINE_SNAPSHOT_DIR is intentionally wired by compose as a read-only
|
|
# imported Engine snapshot; never place secrets or the live cache there.
|
|
MAP_CACHE_MAX_MB=20480
|
|
MAP_CACHE_MAX_OBJECT_MB=128
|
|
MAP_CACHE_DEFAULT_TTL_SECONDS=604800
|