mirror of
https://github.com/gl-inet/glkvm-cloud.git
synced 2026-09-20 17:43:29 +00:00
GL.iNet-Yongping.Xie
cd231e996b
Add brief comments explaining the reverse proxy mode switch. Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
84 lines
2.6 KiB
Bash
Executable File
84 lines
2.6 KiB
Bash
Executable File
# Images
|
|
GLKVM_IMAGE=glzhitong/glkvm-cloud:latest
|
|
COTURN_IMAGE=coturn/coturn:edge-alpine
|
|
|
|
# Enable reverse proxy mode (e.g. Nginx in front of GLKVM Cloud).
|
|
# When enabled, TLS is handled by the proxy and GLKVM Cloud runs in plain HTTP.
|
|
#
|
|
# Note:
|
|
# In reverse-proxy mode, remote device access depends on the correct forwarded headers
|
|
# from the front-end proxy. If these headers are missing or incorrect, GLKVM Cloud may
|
|
# generate redirect URLs with the internal port (e.g. :10443).
|
|
#
|
|
# Please make sure your Nginx config includes:
|
|
# proxy_set_header Host $host;
|
|
# proxy_set_header X-Forwarded-Host $host;
|
|
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
# proxy_set_header X-Forwarded-Port $server_port;
|
|
# proxy_set_header X-Real-IP $remote_addr;
|
|
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
#
|
|
# Reference (verified working example):
|
|
# https://github.com/gl-inet/glkvm-cloud/blob/main/docker-compose/nginx-reverse-proxy-example.conf
|
|
REVERSE_PROXY_ENABLED=false
|
|
|
|
# GLKVM access IP seen by devices/users.
|
|
# Leave empty to auto-detect at container start.
|
|
GLKVM_ACCESS_IP=
|
|
|
|
# rttys
|
|
RTTYS_TOKEN=DeviceTokenYouCanChangeMe
|
|
RTTYS_PASS=StrongP@ssw0rd
|
|
RTTYS_DEVICE_PORT=5912
|
|
RTTYS_WEBUI_PORT=443
|
|
RTTYS_HTTP_PROXY_PORT=10443
|
|
|
|
# TURN
|
|
TURN_PORT=3478
|
|
TURN_USER=glkvmcloudwebrtcuser
|
|
TURN_PASS=AnotherS3cret
|
|
|
|
# LDAP Authentication (Optional)
|
|
LDAP_ENABLED=false
|
|
LDAP_SERVER=your-ldap-server.com
|
|
LDAP_PORT=389
|
|
LDAP_USE_TLS=false
|
|
LDAP_BIND_DN=cn=service-account,ou=users,dc=company,dc=com
|
|
LDAP_BIND_PASSWORD=service-password
|
|
LDAP_BASE_DN=ou=users,dc=company,dc=com
|
|
|
|
# User filter examples for different LDAP implementations:
|
|
# Active Directory: (&(objectClass=person)(sAMAccountName=%s))
|
|
# OpenLDAP: (&(objectClass=inetOrgPerson)(uid=%s))
|
|
# FreeIPA: (&(objectClass=person)(uid=%s))
|
|
# Generic LDAP: (uid=%s)
|
|
LDAP_USER_FILTER=(uid=%s)
|
|
|
|
LDAP_ALLOWED_GROUPS=admins,operators
|
|
LDAP_ALLOWED_USERS=user1,user2
|
|
|
|
# OIDC Authentication (Optional, generic OIDC provider)
|
|
OIDC_ENABLED=false
|
|
OIDC_ISSUER=
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
OIDC_AUTH_URL=
|
|
OIDC_TOKEN_URL=
|
|
|
|
# Redirect URL registered in your OIDC provider.
|
|
# The path part (/auth/oidc/callback) is fixed by GLKVM Cloud and must not be changed.
|
|
# Example:
|
|
# OIDC_REDIRECT_URL=https://your-domain.example.com/auth/oidc/callback
|
|
OIDC_REDIRECT_URL=
|
|
|
|
OIDC_SCOPES="openid profile email"
|
|
|
|
# Email-based whitelist (exact email or domain like @example.com)
|
|
OIDC_ALLOWED_USERS=
|
|
# Subject (sub) whitelist (stable user IDs)
|
|
OIDC_ALLOWED_SUBS=
|
|
# Username whitelist (preferred_username or name)
|
|
OIDC_ALLOWED_USERNAMES=
|
|
# Groups whitelist (e.g. admin, devops)
|
|
OIDC_ALLOWED_GROUPS=
|