Admin
33bf75d245
Every project used the Postgres superuser, the RabbitMQ administrator, an admin S3 identity and the Zitadel instance-admin PAT, so any one of them could read or change the others' data. A new one-shot, `provision` (runs on every `up`, idempotent), gives each project in x-projects its own: - Postgres role, owner of its database. No database is open to PUBLIC anymore, so a role can only connect to its own. An existing database and everything in it is handed over to the project's role. - RabbitMQ user, with permissions on its own vhost only. - Zitadel service account, PROJECT_OWNER of its own project only; its PAT is written to zitadel/.output/<project>/ for that project's zitadel-init to mount instead of the admin PAT. SeaweedFS renders one S3 identity per project, limited to its bucket, and refuses to start with a clear message on a malformed or repeated key. The admin accounts stay with this stack. postgres-init is gone: provision creates the databases. *.sh files are checked out with LF so they run in the Linux containers from a Windows checkout.
67 lines
2.6 KiB
Bash
67 lines
2.6 KiB
Bash
# Development configuration for compose.yml + compose.dev.yml.
|
|
# Copy to .env and adjust.
|
|
#
|
|
# cp .env.example .env
|
|
|
|
# Address the dev ports are published on. 127.0.0.1 keeps them off the LAN.
|
|
# Use 0.0.0.0 only if your hosts file maps host.docker.internal to the LAN IP
|
|
# (then the browser can't reach 127.0.0.1-only ports through that name).
|
|
DEV_BIND_ADDRESS=127.0.0.1
|
|
|
|
# --- PostgreSQL (shared instance; superuser for this stack only) -------------
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=postgres
|
|
POSTGRES_HOST_PORT=5432
|
|
|
|
# --- Zitadel (OIDC) ----------------------------------------------------------
|
|
# The masterkey MUST be exactly 32 characters. host.docker.internal resolves
|
|
# to the same address from the browser, from apps on the host and from
|
|
# inside every project's containers, which is what makes the OIDC issuer
|
|
# valid everywhere without a shared Docker network in dev.
|
|
ZITADEL_MASTERKEY=MasterkeyNeedsToHave32Characters
|
|
ZITADEL_EXTERNAL_DOMAIN=host.docker.internal
|
|
ZITADEL_EXTERNAL_PORT=8080
|
|
ZITADEL_EXTERNAL_SECURE=false
|
|
ZITADEL_PUBLIC_SCHEME=http
|
|
# Login V2 UI (zitadel-login). In dev it has its own port; the URL has no
|
|
# trailing slash. Only read when the Zitadel instance is created.
|
|
ZITADEL_LOGIN_HOST_PORT=3900
|
|
ZITADEL_LOGIN_BASE_URL=http://host.docker.internal:3900/ui/v2/login
|
|
ZITADEL_DATABASE_PASSWORD=zitadel
|
|
# Console login: <username>@zitadel.<external domain>
|
|
ZITADEL_ADMIN_USERNAME=admin
|
|
ZITADEL_ADMIN_PASSWORD=Password1!
|
|
|
|
# --- SeaweedFS (S3; admin identity for this stack only) ---------------------
|
|
S3_ACCESS_KEY=admin_access_key
|
|
S3_SECRET_KEY=admin_secret_key
|
|
|
|
# --- RabbitMQ (administrator for this stack only) ---------------------------
|
|
RABBITMQ_DEFAULT_USER=guest
|
|
RABBITMQ_DEFAULT_PASS=guest
|
|
|
|
# --- pgAdmin (optional, `--profile tools`) -----------------------------------
|
|
PGADMIN_DEFAULT_EMAIL=admin@infra.dev
|
|
PGADMIN_DEFAULT_PASSWORD=admin
|
|
PGADMIN_HOST_PORT=5050
|
|
|
|
# --- Per-project credentials (see provision/) ---------------------------------
|
|
# Each project gets its own Postgres role/database, RabbitMQ user/vhost and S3
|
|
# identity limited to its bucket; the admin accounts above stay with this
|
|
# stack. Each project's own .env copies its values from here. An empty value
|
|
# means that project doesn't get that service.
|
|
MUSIFY_DB_PASSWORD=musify
|
|
MUSIFY_RABBITMQ_PASSWORD=musify
|
|
MUSIFY_S3_ACCESS_KEY=musify_access_key
|
|
MUSIFY_S3_SECRET_KEY=musify_secret_key
|
|
|
|
PING_DB_PASSWORD=ping
|
|
PING_RABBITMQ_PASSWORD=
|
|
PING_S3_ACCESS_KEY=ping_access_key
|
|
PING_S3_SECRET_KEY=ping_secret_key
|
|
|
|
DOCKERMANAGER_DB_PASSWORD=dockermanager
|
|
DOCKERMANAGER_RABBITMQ_PASSWORD=
|
|
DOCKERMANAGER_S3_ACCESS_KEY=
|
|
DOCKERMANAGER_S3_SECRET_KEY=
|