Admin
f99f74f4a1
Infrastructure now gives each project its own Postgres role, RabbitMQ user and vhost, S3 identity limited to its bucket and a Zitadel service account that owns only its project, instead of handing out the admin accounts. - Postgres, RabbitMQ and S3 settings default to Musify's own (musify). - MassTransit connects to the `musify` vhost (RABBITMQ_VHOST, taken from the address path); RABBITMQ_DEFAULT_USER/PASS become RABBITMQ_USER and RABBITMQ_PASSWORD. - zitadel-init mounts ZITADEL_PAT_DIR (Infrastructure's zitadel/.output/musify) and uses that PAT. It no longer creates the Zitadel project, which that account can't do: Infrastructure does.
74 lines
2.9 KiB
Bash
74 lines
2.9 KiB
Bash
# Production configuration for deploy/compose.yml + compose.prod.yml.
|
|
# Copy to deploy/.env.prod, then:
|
|
#
|
|
# 1. replace every `*.example.com` with your actual domains (each service
|
|
# below has its own, independent domain — they don't need to share a
|
|
# root, e.g. for DNS providers that don't allow multi-level
|
|
# subdomains),
|
|
# 2. replace every CHANGE_ME with a strong random value
|
|
# (`openssl rand -hex 24`),
|
|
# 3. point each domain below at the server and add its vhost to the shared
|
|
# edge (Infrastructure's edge/conf.d).
|
|
#
|
|
# Requires ../../../Infrastructure running first, on the same Docker host,
|
|
# with its own `infra-net` network already created. See
|
|
# ../../../Infrastructure/README.md. Not versioned. Keep it readable only by
|
|
# the deploy user (chmod 600).
|
|
|
|
DOTNET_ENVIRONMENT=Production
|
|
|
|
# --- Domains -------------------------------------------------------------
|
|
# Public URLs. They must match the vhosts of the shared edge nginx
|
|
# (Infrastructure's edge/conf.d), which is what serves them; the domains are
|
|
# independent, they don't need to share a root.
|
|
PUBLIC_WEB_URL=https://musify.example.com
|
|
PUBLIC_API_URL=https://musifyapi.example.com
|
|
PUBLIC_STREAM_URL=https://musifystream.example.com
|
|
PUBLIC_AUTH_URL=https://auth.example.com
|
|
S3_PUBLIC_URL=https://s3.example.com
|
|
|
|
# --- PostgreSQL (Infrastructure's shared instance, Musify's own database) ---
|
|
# Musify's own role, owner of musify_db only.
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_USER=musify
|
|
# = Infrastructure's MUSIFY_DB_PASSWORD
|
|
POSTGRES_PASSWORD=CHANGE_ME
|
|
POSTGRES_DB=musify_db
|
|
|
|
# --- Zitadel (OIDC, shared instance) -----------------------------------------
|
|
# Folder with Musify's own Zitadel PAT, written by Infrastructure's `provision`.
|
|
ZITADEL_PAT_DIR=../../../Infrastructure/zitadel/.output/musify
|
|
ZITADEL_DEV_MODE=false
|
|
|
|
# OIDC clients: the zitadel-init one-shot service (see compose.yml) fills
|
|
# these in automatically on `docker compose up -d`.
|
|
AUTH_CLIENT_ID=
|
|
WEB_CLIENT_ID=
|
|
WEB_CLIENT_SECRET=
|
|
|
|
# --- RabbitMQ (shared instance, MassTransit) --------------------------------
|
|
RABBITMQ_HOST=rabbitmq
|
|
RABBITMQ_VHOST=musify
|
|
RABBITMQ_USER=musify
|
|
# = Infrastructure's MUSIFY_RABBITMQ_PASSWORD
|
|
RABBITMQ_PASSWORD=CHANGE_ME
|
|
|
|
# --- SeaweedFS (S3, shared instance, Musify's own bucket) --------------------
|
|
SEAWEEDFS_HOST=seaweedfs
|
|
# = Infrastructure's MUSIFY_S3_ACCESS_KEY / MUSIFY_S3_SECRET_KEY
|
|
S3_ACCESS_KEY=CHANGE_ME
|
|
S3_SECRET_KEY=CHANGE_ME
|
|
S3_BUCKET=webapi-storage
|
|
S3_INTERNAL_URL=http://seaweedfs:8333
|
|
S3_USE_HTTP=false
|
|
|
|
# --- Jaeger (shared instance, tracing) ---------------------------------------
|
|
JAEGER_HOST=jaeger
|
|
|
|
# --- Web player --------------------------------------------------------------
|
|
# Key material for the encrypted session cookie. Rotating it logs everyone out.
|
|
SESSION_SECRET=CHANGE_ME
|
|
AUTH_ALLOW_INSECURE_HTTP=false
|
|
|
|
# --- Misc --------------------------------------------------------------------
|
|
AUTH_REQUIRE_HTTPS=true |