102 lines
3.6 KiB
Bash
102 lines
3.6 KiB
Bash
# Local `.env` file used solely for Development purposes.
|
|
|
|
# --- Image / deployment ------------------------------------------------------
|
|
|
|
# Host name of the container running the Website service.
|
|
HOST_CONTAINER=containers.rock-n-code.com
|
|
|
|
# Owner of the container running the Website service.
|
|
HOST_OWNER=ccn
|
|
|
|
# Password for authenticating to the container registry.
|
|
HOST_PASSWORD=
|
|
|
|
# Host port mapped to the container's port 8080.
|
|
HOST_PORT=8080
|
|
|
|
# User name for authenticating to the container registry.
|
|
HOST_USER=
|
|
|
|
# Name of the Docker image to pull/run.
|
|
IMAGE_NAME=website
|
|
|
|
# Platform of the deployment image
|
|
IMAGE_PLATFORM=linux/amd64
|
|
|
|
# Platform of the *local* build only (docker-compose.override.yml)
|
|
BUILD_PLATFORM=linux/arm64
|
|
|
|
# Tag of the image to pull/run.
|
|
# Use a semver in production; avoid `latest` so rollbacks are unambiguous.
|
|
IMAGE_TAG=latest
|
|
|
|
# --- Application config ------------------------------------------------------
|
|
|
|
# Server name reported by the HTTP service.
|
|
HTTP_SERVER_NAME=CCNWebsite
|
|
|
|
# Log verbosity: trace | debug | info | notice | warning | error | critical
|
|
LOG_LEVEL=debug
|
|
|
|
# --- Analytics ---------------------------------------------------------------
|
|
|
|
# Umami website identifier; empty omits the tracker. Set `String.Analytics.origin`
|
|
# and allow it in `security.contentSecurityPolicy` first, or the tracker is blocked.
|
|
ANALYTICS_WEBSITE_ID=
|
|
|
|
# Comma-delimited hosts the tracker reports from; empty reports from every host.
|
|
# A host the deployment does not serve drops every visit silently.
|
|
ANALYTICS_DOMAINS=
|
|
|
|
# Whether the pages also embed the session recorder script: true | false
|
|
ANALYTICS_RECORDER=false
|
|
|
|
# --- Security ----------------------------------------------------------------
|
|
|
|
# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and
|
|
# `connect-src`, or the tracker is blocked; drop those two once analytics is off.
|
|
SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
|
|
|
|
# `X-Content-Type-Options`: disables MIME sniffing.
|
|
SECURITY_CONTENT_TYPE_OPTIONS=nosniff
|
|
|
|
# `X-Frame-Options`: DENY | SAMEORIGIN
|
|
SECURITY_FRAME_OPTIONS=DENY
|
|
|
|
# `Referrer-Policy`.
|
|
SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin
|
|
|
|
# `Permissions-Policy`: denies browser features the site does not use.
|
|
SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
|
|
|
|
# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but
|
|
# remember it stickily once seen, so it stays off in local development.
|
|
# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains
|
|
|
|
# --- Persistence -------------------------------------------------------------
|
|
|
|
# Persistence driver: inMemory (default, no infrastructure) or postgres.
|
|
DATABASE_DRIVER=inMemory
|
|
|
|
# PostgreSQL connection, used when DATABASE_DRIVER=postgres.
|
|
DATABASE_HOST=localhost
|
|
|
|
# Name of the database to connect to.
|
|
DATABASE_NAME=ccn
|
|
|
|
# Provide the real password via the environment or a secret — never commit it.
|
|
DATABASE_PASSWORD=ccn
|
|
|
|
# Maximum pooled connections per event loop, one loop per core — an 8-core host
|
|
# can open 8 times this, and every replica that many again.
|
|
DATABASE_POOL_MAX_PER_EVENT_LOOP=4
|
|
|
|
# Port of the database to connect to.
|
|
DATABASE_PORT=5432
|
|
|
|
# TLS posture when connecting: off | prefer | require. Plaintext is the usual
|
|
# choice over a private container network; use `require` across one you share.
|
|
DATABASE_TLS=off
|
|
|
|
# Username of the database to connect as.
|
|
DATABASE_USERNAME=ccn |