27 lines
1.3 KiB
Bash
27 lines
1.3 KiB
Bash
# Public control-plane endpoint. Do not use localhost, an IP address, or example.com.
|
|
CASAN_PUBLIC_FQDN=control.casan.company.internal
|
|
CASAN_CP_HTTPS_PORT=443
|
|
|
|
# Host paths. These are provisioned outside the repository with restrictive permissions.
|
|
CASAN_CP_TLS_DIR=/opt/casan-control-panel/tls
|
|
CASAN_CP_OAUTH_ENV=/opt/casan-control-panel/oauth2-proxy.env
|
|
CASAN_CP_RUNTIME_ENV=/opt/casan-control-panel/runtime.env
|
|
CASAN_CP_VAULT_ENV=/opt/casan-control-panel/vault.env
|
|
CASAN_CP_STATE_DIR=/srv/casan/state
|
|
CASAN_CP_OUTPUT_DIR=/srv/casan/output
|
|
CASAN_CP_IDP_PUBLIC_KEY=/opt/casan-control-panel/idp-public.pem
|
|
|
|
# CI must publish immutable image references, not tags such as :latest.
|
|
CASAN_CP_API_IMAGE=registry.example.internal/casan/control-panel-api@sha256:replace-with-64-hex-digest
|
|
CASAN_CP_UI_IMAGE=registry.example.internal/casan/control-panel-ui@sha256:replace-with-64-hex-digest
|
|
CASAN_CP_OAUTH2_PROXY_IMAGE=quay.io/oauth2-proxy/oauth2-proxy@sha256:replace-with-64-hex-digest
|
|
|
|
# WORM anchor destination. The deploy identity needs only PutObject and
|
|
# GetObjectLockConfiguration for this bucket/prefix; use workload identity,
|
|
# never static credentials in this file.
|
|
CASAN_S3_BUCKET=casan-production-audit
|
|
CASAN_S3_PREFIX=audit-anchors
|
|
CASAN_S3_REGION=ap-northeast-1
|
|
CASAN_S3_RETENTION_DAYS=365
|
|
CASAN_S3_KMS_KEY_ID=alias/casan-audit
|