Admin
f99f74f4a1
Infrastructure now gives each project its own Postgres role, RabbitMQ user and vhost, S3 identity limited to its bucket and a Zitadel service account that owns only its project, instead of handing out the admin accounts. - Postgres, RabbitMQ and S3 settings default to Musify's own (musify). - MassTransit connects to the `musify` vhost (RABBITMQ_VHOST, taken from the address path); RABBITMQ_DEFAULT_USER/PASS become RABBITMQ_USER and RABBITMQ_PASSWORD. - zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's zitadel/.output/musify) and uses that PAT. It no longer creates the Zitadel project, which that account can't do: Infrastructure does.
78 lines
3.2 KiB
Bash
78 lines
3.2 KiB
Bash
# Development configuration for deploy/compose.yml + compose.dev.yml.
|
|
# Copy to deploy/.env and adjust.
|
|
#
|
|
# cp deploy/.env.example deploy/.env
|
|
#
|
|
# Requires ../../../Infrastructure running first (Postgres, Zitadel,
|
|
# SeaweedFS, RabbitMQ, Jaeger). See ../../../Infrastructure/README.md.
|
|
# Musify has its own credentials on every shared service (role, vhost, S3
|
|
# identity, Zitadel service account), provisioned by Infrastructure. Every
|
|
# value marked "= Infrastructure's MUSIFY_*" below has to be the same as that
|
|
# setting in Infrastructure's .env.
|
|
|
|
DOTNET_ENVIRONMENT=Development
|
|
|
|
# --- Public URLs -------------------------------------------------------------
|
|
# How each service is reached from *outside* Docker. `host.docker.internal`
|
|
# resolves to the same address from the browser, from apps running on the
|
|
# host and from inside the containers, which is what makes the OIDC issuer
|
|
# and the presigned S3 URLs valid in both run modes.
|
|
PUBLIC_WEB_URL=http://localhost:3000
|
|
PUBLIC_API_URL=http://localhost:5111
|
|
PUBLIC_STREAM_URL=http://localhost:8081
|
|
PUBLIC_AUTH_URL=http://host.docker.internal:8080
|
|
|
|
# --- PostgreSQL (Infrastructure's shared instance, Musify's own database) ---
|
|
# Musify's own role, owner of musify_db only.
|
|
POSTGRES_HOST=host.docker.internal
|
|
POSTGRES_USER=musify
|
|
# = Infrastructure's MUSIFY_DB_PASSWORD
|
|
POSTGRES_PASSWORD=musify
|
|
POSTGRES_DB=musify_db
|
|
|
|
# --- Zitadel (OIDC, shared instance) -----------------------------------------
|
|
# Folder with Musify's own Zitadel PAT (a service account that owns the
|
|
# Musify project only), written by Infrastructure's `provision`. Adjust if
|
|
# your Infrastructure checkout lives somewhere else relative to this one.
|
|
ZITADEL_PAT_DIR=../../../Infrastructure/zitadel/.output/musify
|
|
# Allows the OIDC apps this project creates to use plain-http redirect URIs
|
|
# (dev only).
|
|
ZITADEL_DEV_MODE=true
|
|
|
|
# OIDC clients: the zitadel-init one-shot service (see compose.yml) fills
|
|
# these in automatically on `docker compose up -d`.
|
|
AUTH_CLIENT_ID=
|
|
WEB_CLIENT_ID=
|
|
WEB_CLIENT_SECRET=
|
|
|
|
# --- RabbitMQ (shared instance, MassTransit) --------------------------------
|
|
# Musify's own user, only on its own vhost.
|
|
RABBITMQ_HOST=host.docker.internal
|
|
RABBITMQ_VHOST=musify
|
|
RABBITMQ_USER=musify
|
|
# = Infrastructure's MUSIFY_RABBITMQ_PASSWORD
|
|
RABBITMQ_PASSWORD=musify
|
|
|
|
# --- SeaweedFS (S3, shared instance, Musify's own bucket) --------------------
|
|
# Musify's own identity, limited to S3_BUCKET.
|
|
SEAWEEDFS_HOST=host.docker.internal
|
|
# = Infrastructure's MUSIFY_S3_ACCESS_KEY / MUSIFY_S3_SECRET_KEY
|
|
S3_ACCESS_KEY=musify_access_key
|
|
S3_SECRET_KEY=musify_secret_key
|
|
S3_BUCKET=webapi-storage
|
|
S3_PUBLIC_URL=http://host.docker.internal:8333
|
|
S3_INTERNAL_URL=http://host.docker.internal:8333
|
|
S3_USE_HTTP=true
|
|
|
|
# --- Jaeger (shared instance, tracing) ---------------------------------------
|
|
JAEGER_HOST=host.docker.internal
|
|
|
|
# --- Web player --------------------------------------------------------------
|
|
# Key material for the encrypted session cookie: any long random string.
|
|
SESSION_SECRET=dev-session-secret-change-me-0123456789abcdef
|
|
# Allows the plain-HTTP Zitadel issuer in a production Node build (dev only).
|
|
AUTH_ALLOW_INSECURE_HTTP=true
|
|
|
|
# --- Misc --------------------------------------------------------------------
|
|
AUTH_REQUIRE_HTTPS=false
|