javierandClaude Fable 5.1
916df7e2f0
This commit contains the latest updates from the generic Website template, which rework the compression and localization: - Reworked the compression and localization in the Infrastructure package. (3c568e4) - Adopted the reworked compression and localization in the Website service. (08cf3e3) The template commit that only touched the root README (53676ed) was left out, as this project no longer carries that file. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
111 lines
4.1 KiB
Bash
111 lines
4.1 KiB
Bash
# Local `.env` file used solely for Development purposes.
|
|
|
|
# --- Image / deployment ------------------------------------------------------
|
|
|
|
# Host name of the container running the Website service.
|
|
HOST_CONTAINER=containers.rock-n-code.com
|
|
|
|
# Owner of the container running the Website service.
|
|
HOST_OWNER=ccn
|
|
|
|
# Password for authenticating to the container registry.
|
|
HOST_PASSWORD=
|
|
|
|
# Host port mapped to the container's port 8080.
|
|
HOST_PORT=8080
|
|
|
|
# User name for authenticating to the container registry.
|
|
HOST_USER=
|
|
|
|
# Name of the Docker image to pull/run.
|
|
IMAGE_NAME=website
|
|
|
|
# Platform of the deployment image
|
|
IMAGE_PLATFORM=linux/amd64
|
|
|
|
# Platform of the *local* build only (docker-compose.override.yml)
|
|
BUILD_PLATFORM=linux/arm64
|
|
|
|
# Tag of the image to pull/run.
|
|
# Use a semver in production; avoid `latest` so rollbacks are unambiguous.
|
|
IMAGE_TAG=latest
|
|
|
|
# --- Application config ------------------------------------------------------
|
|
|
|
# Server name reported by the HTTP service.
|
|
HTTP_SERVER_NAME=CCNWebsite
|
|
|
|
# Log verbosity: trace | debug | info | notice | warning | error | critical
|
|
LOG_LEVEL=debug
|
|
|
|
# --- Analytics ---------------------------------------------------------------
|
|
|
|
# Umami website identifier; empty omits the tracker. Set `String.Analytics.origin`
|
|
# and allow it in `security.contentSecurityPolicy` first, or the tracker is blocked.
|
|
ANALYTICS_WEBSITE_ID=
|
|
|
|
# Comma-delimited hosts the tracker reports from; empty reports from every host.
|
|
# A host the deployment does not serve drops every visit silently.
|
|
ANALYTICS_DOMAINS=
|
|
|
|
# Whether the pages also embed the session recorder script: true | false
|
|
ANALYTICS_RECORDER=false
|
|
|
|
# --- Security ----------------------------------------------------------------
|
|
|
|
# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and
|
|
# `connect-src`, or the tracker is blocked; drop those two once analytics is off.
|
|
SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
|
|
|
|
# `X-Content-Type-Options`: disables MIME sniffing.
|
|
SECURITY_CONTENT_TYPE_OPTIONS=nosniff
|
|
|
|
# `X-Frame-Options`: DENY | SAMEORIGIN
|
|
SECURITY_FRAME_OPTIONS=DENY
|
|
|
|
# `Referrer-Policy`.
|
|
SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin
|
|
|
|
# `Permissions-Policy`: denies browser features the site does not use.
|
|
SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
|
|
|
|
# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but
|
|
# remember it stickily once seen, so it stays off in local development.
|
|
# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains
|
|
|
|
# --- Reverse proxy -----------------------------------------------------------
|
|
|
|
# Both assert a TLS-terminating reverse proxy that sets the forwarded headers, so
|
|
# set them together; off for a directly reachable server, where clients can forge
|
|
# the headers. The former drives the HTTPS redirect, the latter keys the rate-limit
|
|
# buckets by the first `X-Forwarded-For` entry.
|
|
HTTPS_TRUST_FORWARDED_PROTO=false
|
|
RATE_LIMIT_TRUST_FORWARDED_FOR=false
|
|
|
|
# --- Persistence -------------------------------------------------------------
|
|
|
|
# Persistence driver: inMemory (default, no infrastructure) or postgres.
|
|
DATABASE_DRIVER=inMemory
|
|
|
|
# PostgreSQL connection, used when DATABASE_DRIVER=postgres.
|
|
DATABASE_HOST=localhost
|
|
|
|
# Name of the database to connect to.
|
|
DATABASE_NAME=ccn
|
|
|
|
# Provide the real password via the environment or a secret — never commit it.
|
|
DATABASE_PASSWORD=ccn
|
|
|
|
# Maximum pooled connections per event loop, one loop per core — an 8-core host
|
|
# can open 8 times this, and every replica that many again.
|
|
DATABASE_POOL_MAX_PER_EVENT_LOOP=4
|
|
|
|
# Port of the database to connect to.
|
|
DATABASE_PORT=5432
|
|
|
|
# TLS posture when connecting: off | prefer | require. Plaintext is the usual
|
|
# choice over a private container network; use `require` across one you share.
|
|
DATABASE_TLS=off
|
|
|
|
# Username of the database to connect as.
|
|
DATABASE_USERNAME=ccn |