mirror of
https://github.com/gl-inet/glkvm-cloud.git
synced 2026-09-20 01:25:22 +00:00
GL.iNet-Yongping.Xie
329468bf61
Introduce a reverse proxy mode to better integrate with front-end proxies such as Nginx. In this mode, both port-based access to GLKVM Cloud and direct web access to device UIs are supported simultaneously, improving deployment flexibility behind proxies. Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
68 lines
1.9 KiB
Bash
Executable File
68 lines
1.9 KiB
Bash
Executable File
# Images
|
|
GLKVM_IMAGE=glzhitong/glkvm-cloud:latest
|
|
COTURN_IMAGE=coturn/coturn:edge-alpine
|
|
|
|
# Enable reverse proxy mode (e.g. Nginx in front of GLKVM Cloud).
|
|
# When enabled, TLS is handled by the proxy and GLKVM Cloud runs in plain HTTP.
|
|
REVERSE_PROXY_ENABLED=false
|
|
|
|
# GLKVM access IP seen by devices/users.
|
|
# Leave empty to auto-detect at container start.
|
|
GLKVM_ACCESS_IP=
|
|
|
|
# rttys
|
|
RTTYS_TOKEN=DeviceTokenYouCanChangeMe
|
|
RTTYS_PASS=StrongP@ssw0rd
|
|
RTTYS_DEVICE_PORT=5912
|
|
RTTYS_WEBUI_PORT=443
|
|
RTTYS_HTTP_PROXY_PORT=10443
|
|
|
|
# TURN
|
|
TURN_PORT=3478
|
|
TURN_USER=glkvmcloudwebrtcuser
|
|
TURN_PASS=AnotherS3cret
|
|
|
|
# LDAP Authentication (Optional)
|
|
LDAP_ENABLED=false
|
|
LDAP_SERVER=your-ldap-server.com
|
|
LDAP_PORT=389
|
|
LDAP_USE_TLS=false
|
|
LDAP_BIND_DN=cn=service-account,ou=users,dc=company,dc=com
|
|
LDAP_BIND_PASSWORD=service-password
|
|
LDAP_BASE_DN=ou=users,dc=company,dc=com
|
|
|
|
# User filter examples for different LDAP implementations:
|
|
# Active Directory: (&(objectClass=person)(sAMAccountName=%s))
|
|
# OpenLDAP: (&(objectClass=inetOrgPerson)(uid=%s))
|
|
# FreeIPA: (&(objectClass=person)(uid=%s))
|
|
# Generic LDAP: (uid=%s)
|
|
LDAP_USER_FILTER=(uid=%s)
|
|
|
|
LDAP_ALLOWED_GROUPS=admins,operators
|
|
LDAP_ALLOWED_USERS=user1,user2
|
|
|
|
# OIDC Authentication (Optional, generic OIDC provider)
|
|
OIDC_ENABLED=false
|
|
OIDC_ISSUER=
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
OIDC_AUTH_URL=
|
|
OIDC_TOKEN_URL=
|
|
|
|
# Redirect URL registered in your OIDC provider.
|
|
# The path part (/auth/oidc/callback) is fixed by GLKVM Cloud and must not be changed.
|
|
# Example:
|
|
# OIDC_REDIRECT_URL=https://your-domain.example.com/auth/oidc/callback
|
|
OIDC_REDIRECT_URL=
|
|
|
|
OIDC_SCOPES="openid profile email"
|
|
|
|
# Email-based whitelist (exact email or domain like @example.com)
|
|
OIDC_ALLOWED_USERS=
|
|
# Subject (sub) whitelist (stable user IDs)
|
|
OIDC_ALLOWED_SUBS=
|
|
# Username whitelist (preferred_username or name)
|
|
OIDC_ALLOWED_USERNAMES=
|
|
# Groups whitelist (e.g. admin, devops)
|
|
OIDC_ALLOWED_GROUPS=
|