mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
282ab8d844
The enrollment minter inferred SENCHO_PRIMARY_URL from the request Host header, which baked loopback or LAN addresses into the compose YAML when the admin opened Add Node on the central's own machine. Pilots on a different network (a public cloud VPS, for example) cannot dial that. SENCHO_PUBLIC_URL on the primary now wins when set and well-formed (http(s)://, no loopback). Trailing slashes are stripped. Falls back to the request Host when unset or invalid.
129 lines
5.1 KiB
Bash
129 lines
5.1 KiB
Bash
# Sencho Configuration
|
|
# Copy this file to .env and update the values for production
|
|
|
|
# Directory containing docker-compose files
|
|
COMPOSE_DIR=/path/to/your/compose/files
|
|
|
|
# Database and state directory inside the container (default: /app/data)
|
|
DATA_DIR=/app/data
|
|
|
|
# Optional path to a host-installed Trivy binary. Sencho first looks for a
|
|
# managed install under DATA_DIR/bin/trivy; if absent and TRIVY_BIN is set,
|
|
# Sencho uses that path; otherwise it falls back to `trivy` on PATH. Once a
|
|
# managed install is present, the managed copy takes precedence over this.
|
|
TRIVY_BIN=
|
|
|
|
# Node environment (set automatically in Docker image; only change for local dev)
|
|
NODE_ENV=production
|
|
|
|
# Frontend URL for CORS in production (leave empty for same-origin setups)
|
|
FRONTEND_URL=
|
|
|
|
# Global API rate limit (requests per minute per user session, production only)
|
|
# Authenticated requests are keyed by user ID; unauthenticated by IP.
|
|
# Internal node-to-node traffic (node_proxy tokens) bypasses this limit entirely.
|
|
API_RATE_LIMIT=200
|
|
|
|
# Polling endpoint rate limit (requests per minute, production only)
|
|
# Applies to dashboard/status polling endpoints that are exempt from the global limit.
|
|
# Increase for environments with many concurrent browser sessions behind shared NAT.
|
|
API_POLLING_RATE_LIMIT=300
|
|
|
|
# Public URL of THIS primary instance, used to bake an externally-reachable
|
|
# SENCHO_PRIMARY_URL into pilot enrollment YAML. Set this when the primary
|
|
# sits behind a reverse proxy or Cloudflare Tunnel so pilots on a different
|
|
# network can dial the public hostname instead of the request Host header
|
|
# the admin happens to be on (loopback, LAN, etc.). Must be http(s)://; no
|
|
# trailing slash. When unset, enrollment falls back to the request Host.
|
|
SENCHO_PUBLIC_URL=
|
|
|
|
# ─── Pilot agent (remote host only) ──────────────────────────────
|
|
# These three vars are required ONLY on a remote host running as a
|
|
# pilot-agent reverse-tunnel container. The primary instance does not
|
|
# read them. See docs/features/pilot-agent.mdx for the full setup.
|
|
|
|
# Switches the container into agent mode. The primary instance leaves
|
|
# this unset.
|
|
SENCHO_MODE=
|
|
|
|
# WebSocket-capable URL of the controlling Sencho instance. Use https://
|
|
# scheme; the agent rewrites it to wss:// for the tunnel upgrade.
|
|
SENCHO_PRIMARY_URL=
|
|
|
|
# Single-use, 15-minute enrollment token issued by the primary when the
|
|
# pilot-agent node is created. After the first successful connect the
|
|
# agent persists a long-lived tunnel credential at /app/data/pilot.jwt
|
|
# and ignores this var on subsequent restarts.
|
|
SENCHO_ENROLL_TOKEN=
|
|
|
|
# Optional: path inside the agent container to a PEM CA bundle the
|
|
# agent should trust when validating the primary's TLS cert. Use this
|
|
# for self-hosted deployments terminating TLS with an internal CA.
|
|
# Leave unset to fall back to the system trust store. There is no
|
|
# escape hatch to disable TLS verification.
|
|
SENCHO_PILOT_CA_FILE=
|
|
|
|
# ─── SSO / LDAP Configuration ────────────────────────────────────
|
|
|
|
# LDAP / Active Directory
|
|
SSO_LDAP_ENABLED=false
|
|
SSO_LDAP_URL=ldap://ldap.example.com:389
|
|
SSO_LDAP_BIND_DN=cn=readonly,dc=example,dc=com
|
|
SSO_LDAP_BIND_PASSWORD=
|
|
SSO_LDAP_SEARCH_BASE=ou=users,dc=example,dc=com
|
|
SSO_LDAP_SEARCH_FILTER=(uid={{username}})
|
|
SSO_LDAP_ADMIN_GROUP_DN=
|
|
SSO_LDAP_DEFAULT_ROLE=viewer
|
|
SSO_LDAP_DISPLAY_NAME=LDAP
|
|
SSO_LDAP_TLS_REJECT_UNAUTHORIZED=true
|
|
|
|
# Google OIDC
|
|
SSO_OIDC_GOOGLE_ENABLED=false
|
|
SSO_OIDC_GOOGLE_CLIENT_ID=
|
|
SSO_OIDC_GOOGLE_CLIENT_SECRET=
|
|
|
|
# GitHub OAuth
|
|
SSO_OIDC_GITHUB_ENABLED=false
|
|
SSO_OIDC_GITHUB_CLIENT_ID=
|
|
SSO_OIDC_GITHUB_CLIENT_SECRET=
|
|
|
|
# Okta OIDC
|
|
SSO_OIDC_OKTA_ENABLED=false
|
|
SSO_OIDC_OKTA_ISSUER_URL=
|
|
SSO_OIDC_OKTA_CLIENT_ID=
|
|
SSO_OIDC_OKTA_CLIENT_SECRET=
|
|
|
|
# Custom OIDC (Keycloak, Authentik, Authelia, Zitadel, etc.)
|
|
SSO_OIDC_CUSTOM_ENABLED=false
|
|
SSO_OIDC_CUSTOM_DISPLAY_NAME=Custom OIDC
|
|
SSO_OIDC_CUSTOM_ISSUER_URL=
|
|
SSO_OIDC_CUSTOM_CLIENT_ID=
|
|
SSO_OIDC_CUSTOM_CLIENT_SECRET=
|
|
SSO_OIDC_CUSTOM_SCOPES=openid email profile
|
|
SSO_OIDC_CUSTOM_ID_CLAIM=
|
|
SSO_OIDC_CUSTOM_USERNAME_CLAIM=
|
|
SSO_OIDC_CUSTOM_EMAIL_CLAIM=
|
|
|
|
# Role mapping (shared across OIDC providers)
|
|
SSO_OIDC_ADMIN_CLAIM=groups
|
|
SSO_OIDC_ADMIN_CLAIM_VALUE=sencho-admins
|
|
SSO_DEFAULT_ROLE=viewer
|
|
|
|
# External base URL for OAuth callback URLs (required behind reverse proxy)
|
|
SSO_CALLBACK_URL=
|
|
|
|
# Experimental UI surfaces. When unset or any value other than "true",
|
|
# the UI hides surfaces that are kept in the repo but not yet promoted
|
|
# to the default 1.0 build (Fleet Routing tab, Fleet
|
|
# Deployments / Blueprints tab, Fleet Federation tab, Fleet Secrets
|
|
# sync tab, Fleet Actions tab). Backend routes for these surfaces stay
|
|
# live regardless. This flag controls UI discovery only.
|
|
SENCHO_EXPERIMENTAL=false
|
|
|
|
# Idle teardown (in ms) for on-demand mesh tunnels that central opens
|
|
# to Distributed API (proxy-mode) remotes. After this many milliseconds
|
|
# of zero active mesh streams, central closes the WebSocket; the next
|
|
# mesh dial re-opens it. Defaults to 5 minutes. Set to 0 to keep
|
|
# tunnels open until the remote drops them or central shuts down.
|
|
SENCHO_MESH_PROXY_TUNNEL_IDLE_MS=300000
|